---
title: "Verify a presented mandate"
method: POST
path: "/mandate/verify"
---

# Verify a presented mandate

`POST /mandate/verify`

## Request

- Base URL: `https://getsanction.com/api/v1`
- URL: `https://getsanction.com/api/v1/mandate/verify`
- Auth: none required

WALLET-1: a counterparty who was handed an execution JWT checks whether that mandate is still live — without a Sanction API key. HS256 is not locally verifiable; this is the merchant-side check. Garbage and unknown tokens return HTTP 200 `{valid:false, status:invalid}` so agents fail closed on the body. Frozen wallets, revoked tokens, and expiry are named statuses. Rate-limited per IP. Never logs the JWT.

## Request body

- object
  - `mandate` string, required: The execution JWT issued by POST /exec

## Response `200`

Mandate view — valid true only when active, unexpired, unrevoked, and the wallet is unfrozen

- object
  - `valid` boolean, required
  - `status` 'active' | 'expired' | 'revoked' | 'frozen' | 'invalid', required
  - `wallet_id` string
  - `agent_id` string
  - `clearance` integer
  - `budget_usd` number
  - `spent_usd` number
  - `remaining_usd` number
  - `scope` string[]
  - `expires_at` string, date-time
  - `issued_at` string, date-time
  - `reason` string

## Other responses

- `400`: Missing mandate field
- `429`: Rate limited

---

[API](https://skmtc.dev/getsanction/apis/sanction-agent-governance-api.md) · [All operations](https://skmtc.dev/getsanction/apis/sanction-agent-governance-api/llms.txt) · [OpenAPI document](https://skmtc.dev/getsanction/apis/sanction-agent-governance-api/revisions/c645a9e4b72d?raw)