X402 - Permissions

Create Permission

Creates a delegated permission and generates an x402 access token.

post/x402/permissions

Request

  • Base URL: https://api.sandbox.nevermined.app/api/v1
  • URL: https://api.sandbox.nevermined.app/api/v1/x402/permissions
  • Auth: HTTP bearer

Request body

tokenVersion2 | 3

EIP-712 struct version to sign. A version 3 signature carries a one-time nonce, so the token is SINGLE-USE — it is consumed by its first settle and a second settle is refused with BCK.X402.0059; mint one token per paid request. A version 3 token is also bound to whichever of accepted.extra.agentId, resource.url and accepted.extra.httpVerb you send on this request, since each is signed as the empty string when omitted. Version 2 is the legacy shape: reusable and unbound, so a captured token replays until the permission or delegation is revoked — ask for it only if you cannot mint per request. When this field is omitted the server signs version 3, except for clients whose pinned API version is below 1.34 — that pin comes from the Nevermined-Version header, or, when no header is sent, from the version stamped on the API key when it was minted — which keep receiving version 2.

Example request

{
  "resource": {
    "url": "https://myagent.ai/api/v1/tasks",
    "description": "AI agent task execution",
    "mimeType": "application/json"
  },
  "accepted": {
    "scheme": "nvm:erc4337",
    "network": "eip155:84532",
    "planId": "44742763076047497640080230236781474129970992727896593861997347135613135571071",
    "extra": {
      "version": "1",
      "agentId": "80918427023170428029540261117198154464497879145267720259488529685089104529015",
      "httpVerb": "POST"
    }
  },
  "delegationConfig": {
    "delegationId": "a1b2c3d4-e5f6-4a90-8bcd-ef1234567890",
    "apiKeyId": "sk-abc123",
    "providerPaymentMethodId": "pm_1Abc2Def3Ghi4Jkl",
    "cardId": "a1b2c3d4-e5f6-4a90-8bcd-ef1234567890",
    "spendingLimitCents": 10000,
    "durationSecs": 604800,
    "currency": "usd",
    "maxTransactions": 50
  },
  "tokenVersion": 3
}

Response

Permission created

accessTokenstring required

x402 access token (JWT) for permission-based access. Used by the subscriber to call agent endpoints without exposing their private keys. The permission details (plan id, agent id, subscriber address, expiry, limits) are embedded in the token.

Example response

{
  "accessToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJwbGFuSWQiOiI0MzI5ODQzMjk4NDMyOSIsImFnZW50SWQiOiIxMjM0NTY3ODkwMTIzNDU2Nzg5MCJ9.x402_signature_hash"
}

Changes

No recorded changes to this operation across all 1 revision of this API.