Verify a presented mandate

WALLET-1: a counterparty who was handed an execution JWT checks whether that mandate is still live — without a Sanction API key. HS256 is not locally verifiable; this is the merchant-side check. Garbage and unknown tokens return HTTP 200 {valid:false, status:invalid} so agents fail closed on the body. Frozen wallets, revoked tokens, and expiry are named statuses. Rate-limited per IP. Never logs the JWT.

post/mandate/verify

Request

  • Base URL: https://getsanction.com/api/v1
  • URL: https://getsanction.com/api/v1/mandate/verify
  • Auth: none required

Request body

mandatestring required

The execution JWT issued by POST /exec

Response

Mandate view — valid true only when active, unexpired, unrevoked, and the wallet is unfrozen

validboolean required
status'active' | 'expired' | 'revoked' | 'frozen' | 'invalid' required
wallet_idstring
agent_idstring
clearanceinteger
budget_usdnumber
spent_usdnumber
remaining_usdnumber
scopestring[]
expires_atstring date-time
issued_atstring date-time
reasonstring

Changes

No recorded changes to this operation across all 1 revision of this API.