Verify an inbound agent request

Verify an inbound agent request against a property's site key (bot management). The axioGuard middleware builds this call for you. Authenticate with an axr_site_… key (scope inbound:verify); the visiting agent's own HTTP Message Signature travels inside the body, not in this call's auth.

post/api/v1/gateway/verify-request

Request

  • Base URL: https://app.axiorank.com
  • URL: https://app.axiorank.com/api/v1/gateway/verify-request
  • Auth: HTTP bearer

Request body

surfaceKind'website' | 'http_api' | 'mcp_server' | 'a2a_agent' | 'webhook' | 'shopify'
operationstring nullable
methodstring nullable
authoritystring nullable
pathstring nullable
querystring
userAgentstring nullable
clientIpstring nullable
signatureInputstring nullable
signaturestring nullable
signatureAgentstring nullable
headersobject
bodySamplestring nullable
agentCardunknown
agentCardUrlstring nullable
authTokenstring nullable
governancePassportunknown
reputationCredentialunknown

Response

The inbound decision (allow | challenge | block).

decision'allow' | 'challenge' | 'block' required
reasonstring required
riskinteger required
enforcedboolean required

false under monitor posture: the verdict was computed + logged, not acted on.

requestIdstring required

Example response

{
  "signals": [
    {
      "detector": "secret.aws_access_key",
      "location": "body.env.AWS_SECRET"
    }
  ]
}

Changes

No recorded changes to this operation across all 1 revision of this API.