---
title: "Authorize an x402 payment challenge before the wallet signs"
method: POST
path: "/authorize/quote"
tags: ["Authorization"]
---

# Authorize an x402 payment challenge before the wallet signs

`POST /authorize/quote`

## Request

- Base URL: `https://getsanction.com/api/v1`
- URL: `https://getsanction.com/api/v1/authorize/quote`
- Auth: `AgentKey` (a scheme the document does not define)

Post the 402 body a resource server just returned. Sanction prices the quote (USD-pegged stablecoins with known decimals only — never a guessed rate) and runs it through the same spend ladder as POST /authorize, so budgets, escalation, grants, evidence and the decision meter all apply, with STABLE-0 settlement metadata derived from the quote. When a challenge offers several ways to pay, the WORST case is authorized: the client chooses, and Sanction cannot know which. Category defaults to "api" — a policy that uses an allowed-category list must include it or pass `category` explicitly, otherwise the quote denies with CATEGORY_NOT_ALLOWED.

## Request body

- object
  - `challenge` object, required: The parsed 402 response body: {x402Version, accepts: [...]}
  - `category` string: Spend category for the ladder (default "api")
  - `description` string
  - `grant_id` string: Redeem an approval granted after an escalation

## Response `200`

Decision (approved or escalated), plus the priced quote and its settlement metadata

## Other responses

- `400`: Body is not an x402 payment-required response (code NOT_X402)
- `401`: Invalid agent key
- `403`: Denied by policy, or the quote could not be priced (code QUOTE_NOT_PRICEABLE)

---

[API](https://skmtc.dev/getsanction/apis/sanction-agent-governance-api.md) · [All operations](https://skmtc.dev/getsanction/apis/sanction-agent-governance-api/llms.txt) · [OpenAPI document](https://skmtc.dev/getsanction/apis/sanction-agent-governance-api/revisions/c645a9e4b72d?raw)