---
title: "Web Bot Auth Nonce & Replay-Window Checker"
method: POST
path: "/v1/tools/check_webbotauth_nonce_replay"
tags: ["visa-tap", "rfc9421", "web-bot-auth", "nonce", "replay-defense", "agent-identity"]
---

# Web Bot Auth Nonce & Replay-Window Checker

`POST /v1/tools/check_webbotauth_nonce_replay`

## Request

- Base URL: `https://ainumbers.co`
- URL: `https://ainumbers.co/v1/tools/check_webbotauth_nonce_replay`
- Auth: none declared

Check a Visa TAP-shaped nonce for format (minimum entropy, base64url), freshness against the created/expires window (capped at TAP's 8-minute spread), and an optional caller-supplied seen-nonce record. Zero network, caller-supplied inputs only. Emits ACCEPT or REFUSE. Replay prevention depends on the caller supplying an accurate seen-nonce record from its own storage — this verifier is stateless and cannot detect replay on its own.

**Tool URL:** https://ainumbers.co/chaingraph/art-593-webbotauth-nonce-replay-check.html
**AP2/Policy Mandate export:** yes

## Request body

- object
  - `nonce` string, required
  - `created` number, required
  - `expires` number, required
  - `now_unix` number, required
  - `max_age_s` number
  - `seen_nonces` string[]
  - `nonce_already_used` boolean

## Response `200`

Successful tool execution result

- object
  - `format_ok` boolean
  - `spread_ok` boolean, nullable
  - `fresh` boolean, nullable
  - `already_used` boolean
  - `nonce_valid` boolean
  - `verdict` 'ACCEPT' | 'REFUSE'

---

[API](https://skmtc.dev/ainumbers/apis/ainumbers-co-fintech-intelligence-suite.md) · [All operations](https://skmtc.dev/ainumbers/apis/ainumbers-co-fintech-intelligence-suite/llms.txt) · [OpenAPI document](https://skmtc.dev/ainumbers/apis/ainumbers-co-fintech-intelligence-suite/revisions/b462e4f5bb28?raw)