---
title: "Issue a scoped execution JWT"
method: POST
path: "/exec"
---

# Issue a scoped execution JWT

`POST /exec`

## Request

- Base URL: `https://getsanction.com/api/v1`
- URL: `https://getsanction.com/api/v1/exec`
- Auth: API key in header `x-api-key`

Mint a short-lived (default 15min) mandate: a signed JWT authorizing a child agent or counterparty to act within a credential scope and a hard spend cap. Pass it to a subprocess, a delegated agent, or another agent over A2A. Required to call /credentials/inject; verify liveness at POST /mandate/verify (no API key — the JWT is the capability).

## Request body

- ExecTokenRequest
  - `scope` string[], required: Credential labels this execution needs access to
  - `budget_usd` number, required: Maximum spend authority for this execution
  - `ttl_seconds` integer: Token lifetime in seconds. Default 900 (15 min).
  - `container_id` string: Optional identifier for the container claiming this token

## Response `200`

Execution token issued

- ExecTokenResponse
  - `jwt` string: Signed mandate JWT. Pass as Authorization: Bearer <jwt> to /credentials/inject, or as `mandate` to POST /mandate/verify.
  - `jti` string: Unique token ID for audit trail
  - `expires_at` string, date-time
  - `clearance` integer
  - `scope` string[]
  - `budget_usd` number
  - `ttl_seconds` integer

## Other responses

- `401`: Invalid API key
- `403`: Agent not authorized for requested credentials

---

[API](https://skmtc.dev/getsanction/apis/sanction-agent-governance-api.md) · [All operations](https://skmtc.dev/getsanction/apis/sanction-agent-governance-api/llms.txt) · [OpenAPI document](https://skmtc.dev/getsanction/apis/sanction-agent-governance-api/revisions/c645a9e4b72d?raw)