---
title: "Web Bot Auth Signature Verifier (RFC 9421)"
method: POST
path: "/v1/tools/verify_webbotauth_signature"
tags: ["rfc9421", "web-bot-auth", "ed25519", "http-message-signatures", "agent-identity", "wave24"]
---

# Web Bot Auth Signature Verifier (RFC 9421)

`POST /v1/tools/verify_webbotauth_signature`

## Request

- Base URL: `https://ainumbers.co`
- URL: `https://ainumbers.co/v1/tools/verify_webbotauth_signature`
- Auth: none declared

Verify an RFC 9421 HTTP Message Signature for IETF Web Bot Auth (Ed25519). Reconstructs the signature base from covered components and @signature-params, verifies via crypto.subtle. Zero network, caller-supplied key. Emits ACCEPT or REFUSE.

**Tool URL:** https://ainumbers.co/chaingraph/art-129-webbotauth-signature-verifier.html
**AP2/Policy Mandate export:** yes

## Request body

- object
  - `covered_components` object[], required
    - `name` string, required
    - `value` string, required
  - `signature_params` string, required
  - `signature_b64` string, required
  - `public_key_jwk` object, required
  - `alg` string, required
  - `expected_tag` string
  - `created` number
  - `now_unix` number
  - `max_age_s` number

## Response `200`

Successful tool execution result

- object
  - `signature_cryptographically_valid` boolean
  - `alg_ok` boolean
  - `tag_ok` boolean
  - `fresh` boolean, nullable
  - `verdict` 'ACCEPT' | 'REFUSE'

---

[API](https://skmtc.dev/ainumbers/apis/ainumbers-co-fintech-intelligence-suite.md) · [All operations](https://skmtc.dev/ainumbers/apis/ainumbers-co-fintech-intelligence-suite/llms.txt) · [OpenAPI document](https://skmtc.dev/ainumbers/apis/ainumbers-co-fintech-intelligence-suite/revisions/b462e4f5bb28?raw)