Agents

Verify key binding

Checks whether a given API key hash matches the key currently bound to this agent. The raw key is hashed client-side — only the hash is transmitted.

Named agents: hash as SHA256(key + '|' + agentName) before submitting.

Public anti-impersonation check (anon-allowed). A relying party that holds an agent's id + key can confirm the binding without being a member of the agent's org. Anonymous / cross-org callers receive only bound (the boolean leaks nothing they didn't already supply). key_prefix is returned only to callers who are members of the agent's org.

post/agents/{agent_id}/verify-binding

Request

  • Base URL: https://api.mnemom.ai/v1
  • URL: https://api.mnemom.ai/v1/agents/{agent_id}/verify-binding
  • Auth: one of:
    • none
    • HTTP bearer
    • API key in header X-Mnemom-Api-Key

Path parameters

agent_idstring required

Agent identifier (e.g. smolt-abc123)

Request body

key_hashstring required

First 16 hex chars of SHA256(apiKey) or SHA256(apiKey + '|' + agentName) for named agents.

Example request

{
  "key_hash": "a3f8c1d9e7b2045f"
}

Response

Binding check result.

boundboolean required

True if the submitted hash matches the registered key.

caller'anonymous' | 'authenticated' | 'org_member' required

Self-describing caller context. key_prefix is present iff caller is org_member; anonymous and authenticated (non-member) callers receive { bound, caller } only. This is BY DESIGN, not a partial or leaky response — read caller instead of treating an absent key_prefix as a leak. The boolean bound is an anti-impersonation confirmation that reveals nothing the caller did not already supply.

key_prefixstring nullable

First 16 chars of the registered key (or null if not yet captured). Returned ONLY to callers who are members of the agent's org (caller === org_member); omitted for anonymous / cross-org callers.

Example response

{
  "key_prefix": "sk-ant-api03-xx"
}

Changes

No recorded changes to this operation across all 1 revision of this API.