---
title: "Preflight an external agent/server"
method: POST
path: "/api/v1/gateway/verify-card"
---

# Preflight an external agent/server

`POST /api/v1/gateway/verify-card`

## Request

- Base URL: `https://app.axiorank.com`
- URL: `https://app.axiorank.com/api/v1/gateway/verify-card`
- Auth: HTTP bearer

Verify an external MCP server / A2A agent card before trusting it. Supply EITHER a `url` to fetch the card from OR an inline `document` (one is required). Returns the resolved identity (signature validity, key domain-binding), declared capabilities, auth, and a decision. Requires the `cards:verify` scope.

## Headers

- `Idempotency-Key` string

## Request body

- VerifyCardRequest
  - `url` string, uri
  - `document` unknown
  - `protocol` 'a2a' | 'mcp' | 'oauth' | 'api-catalog' | 'x402' | 'acp' | 'ucp' | 'mpp' | 'did' | 'acp-comm' | 'anp' | 'agntcy-slim' | 'authmd' | 'ap2' | 'content-permission' | 'agntcy-directory' | 'nlweb' | 'ans' | 'agent-skills' | 'webmcp' | 'nanda' | 'vc' | 'visa-tap' | 'spiffe' | 'agents-json' | 'l402' | 'oid4vci' | 'authzen' | 'mc-agent-pay' | 'visa-intelligent-commerce' | 'skyfire' | 'nekuda' | 'amex-agent-pay' | 'paypal-agentic-checkout'

## Response `200`

The preflight verdict.

- CardVerifyResponse
  - `decision` 'allow' | 'review' | 'deny', required
  - `reason` string, required
  - `risk` integer, required
  - `protocol` string, required: Resolved protocol of the card (a2a, mcp, oauth, …).
  - `identity` object, required
    - `name` string, nullable, required
    - `provider` string, nullable, required
    - `signed` boolean, required
    - `signatureValid` boolean, nullable, required: true = verified · false = forged · null = unsigned / key unresolvable.
    - `keySource` 'embedded' | 'jwks' | 'none', required
    - `keyDomainBound` boolean, required
    - `keyId` string, nullable, required
    - `sourceUrl` string, required
  - `capabilities` object, required
    - `count` integer, required
    - `sample` object[], required
      - `kind` string, required
      - `name` string, required
  - `auth` object, required
    - `schemes` string[], required
    - `protectedResource` boolean, required
  - `warnings` string[], required
  - `signals` RiskSignal[], required
    - `detector` string, required
    - `category` 'secret' | 'pii' | 'destructive' | 'injection' | 'egress' | 'bot_spoof' | 'rate_abuse' | 'supply_chain', required
    - `severity` 'low' | 'medium' | 'high' | 'critical', required
    - `label` string, required
    - `points` integer, required: Pre-diminishing-returns contribution, from severity.
    - `location` string, required
    - `evidence` string, required: Redacted evidence, safe to persist and display.
    - `critical` boolean: A live secret / key / card was detected.
  - `cardId` string, required

## Other responses

- `400`: Malformed body, or neither `url` nor `document` supplied.
- `401`: Missing or invalid API key.
- `402`: Workspace monthly usage quota exceeded.
- `409`: A request with this Idempotency-Key is already in progress.
- `422`: Idempotency-Key was reused with a different request body.
- `429`: Rate limited.

---

[API](https://skmtc.dev/axiorank/apis/axiorank-gateway-api.md) · [All operations](https://skmtc.dev/axiorank/apis/axiorank-gateway-api/llms.txt) · [OpenAPI document](https://skmtc.dev/axiorank/apis/axiorank-gateway-api/revisions/d8a7a33656e4?raw)