---
title: "Verify an inbound agent request"
method: POST
path: "/api/v1/gateway/verify-request"
---

# Verify an inbound agent request

`POST /api/v1/gateway/verify-request`

## Request

- Base URL: `https://app.axiorank.com`
- URL: `https://app.axiorank.com/api/v1/gateway/verify-request`
- Auth: HTTP bearer

Verify an inbound agent request against a property's site key (bot management). The `axioGuard` middleware builds this call for you. Authenticate with an `axr_site_…` key (scope `inbound:verify`); the visiting agent's own HTTP Message Signature travels inside the body, not in this call's auth.

## Request body

- InboundVerifyRequest
  - `surfaceKind` 'website' | 'http_api' | 'mcp_server' | 'a2a_agent' | 'webhook' | 'shopify'
  - `operation` string, nullable
  - `method` string, nullable
  - `authority` string, nullable
  - `path` string, nullable
  - `query` string
  - `userAgent` string, nullable
  - `clientIp` string, nullable
  - `signatureInput` string, nullable
  - `signature` string, nullable
  - `signatureAgent` string, nullable
  - `headers` object
  - `bodySample` string, nullable
  - `agentCard` unknown
  - `agentCardUrl` string, nullable
  - `authToken` string, nullable
  - `governancePassport` unknown
  - `reputationCredential` unknown

## Response `200`

The inbound decision (`allow` | `challenge` | `block`).

- InboundVerifyResponse
  - `decision` 'allow' | 'challenge' | 'block', required
  - `reason` string, required
  - `risk` integer, required
  - `verification` object, required
    - `status` 'verified' | 'unverified' | 'spoofed' | 'unknown', required
    - `method` string, nullable, required
    - `agentSlug` string, nullable, required
    - `agentLabel` string, nullable, required
    - `confidence` integer, required: 0..100: cryptographic proof = 100, heuristic UA match = 40, etc.
  - `enforced` boolean, required: false under `monitor` posture: the verdict was computed + logged, not acted on.
  - `signals` RiskSignal[], required
    - `detector` string, required
    - `category` 'secret' | 'pii' | 'destructive' | 'injection' | 'egress' | 'bot_spoof' | 'rate_abuse' | 'supply_chain', required
    - `severity` 'low' | 'medium' | 'high' | 'critical', required
    - `label` string, required
    - `points` integer, required: Pre-diminishing-returns contribution, from severity.
    - `location` string, required
    - `evidence` string, required: Redacted evidence, safe to persist and display.
    - `critical` boolean: A live secret / key / card was detected.
  - `requestId` string, required

## Other responses

- `400`: Malformed request body.
- `401`: Missing or invalid site key.

---

[API](https://skmtc.dev/axiorank/apis/axiorank-gateway-api.md) · [All operations](https://skmtc.dev/axiorank/apis/axiorank-gateway-api/llms.txt) · [OpenAPI document](https://skmtc.dev/axiorank/apis/axiorank-gateway-api/revisions/d8a7a33656e4?raw)