visa-tap
rfc9421
web-bot-auth
nonce
replay-defense
agent-identity

Web Bot Auth Nonce & Replay-Window Checker

Check a Visa TAP-shaped nonce for format (minimum entropy, base64url), freshness against the created/expires window (capped at TAP's 8-minute spread), and an optional caller-supplied seen-nonce record. Zero network, caller-supplied inputs only. Emits ACCEPT or REFUSE. Replay prevention depends on the caller supplying an accurate seen-nonce record from its own storage — this verifier is stateless and cannot detect replay on its own.

Tool URL: https://ainumbers.co/chaingraph/art-593-webbotauth-nonce-replay-check.html AP2/Policy Mandate export: yes

post/v1/tools/check_webbotauth_nonce_replay

Request

  • Base URL: https://ainumbers.co
  • URL: https://ainumbers.co/v1/tools/check_webbotauth_nonce_replay
  • Auth: none declared

Request body

noncestring required
creatednumber required
expiresnumber required
now_unixnumber required
max_age_snumber
seen_noncesstring[]
nonce_already_usedboolean

Response

Successful tool execution result

format_okboolean
spread_okboolean nullable
freshboolean nullable
already_usedboolean
nonce_validboolean
verdict'ACCEPT' | 'REFUSE'

Changes

No recorded changes to this operation across all 1 revision of this API.