---
title: "Refill short-lived signatures using a live Verify signing grant"
method: POST
path: "/api/v1/verify/web_bot_auth"
tags: ["verify"]
---

# Refill short-lived signatures using a live Verify signing grant

`POST /api/v1/verify/web_bot_auth`

## Request

- Base URL: `https://composal.com` (the document declares no server; this is the origin it was published from)
- URL: `https://composal.com/api/v1/verify/web_bot_auth`
- Auth: HTTP bearer

Accepts a lease-scoped signing capability as a Bearer token. Ordinary user API tokens cannot authorize this internal endpoint.

## Request body

- object
  - `origin` string, uri, required

## Response `200`

Distinct signatures for the authorized HTTPS origin

- object
  - `expires_at` string, date-time, required
  - `signatures` object[], required
    - `signature` string, required
    - `signature-input` string, required
    - `signature-agent` string, required

## Other responses

- `400`: Origin is missing
- `401`: Signing capability is invalid, expired or outside its saved targets

---

[API](https://skmtc.dev/composal/apis/vex-api.md) - [All operations](https://skmtc.dev/composal/apis/vex-api/llms.txt) - [OpenAPI document](https://skmtc.dev/composal/apis/vex-api/revisions/19698ba051dc?raw)