---
title: "Verify Permission"
method: POST
path: "/x402/verify"
tags: ["X402 - Permissions"]
---

# Verify Permission

`POST /x402/verify`

## Request

- Base URL: `https://api.sandbox.nevermined.app/api/v1`
- URL: `https://api.sandbox.nevermined.app/api/v1/x402/verify`
- Auth: HTTP bearer

Validates a delegated permission before processing a request.

## Request body

- VerifyPermissionRequest: Body of `POST /x402/verify` (`SettlePermissionsDto`). `paymentRequired` and `x402AccessToken` are both required and the handler runs a `ValidationPipe`, so a body missing either is rejected with 400 before verification runs. `planId`, `subscriberAddress`, `agentId`, the endpoint and the HTTP verb are read out of the token — never sent alongside it. The settle-only fields `agentRequestId`, `batch` and `marginPercent` pass validation here but the verify handler does not read them: `agentRequestId` is generated by this endpoint and returned in the response, for you to pass back on settle.
  - `paymentRequired` X402PaymentRequired, required: The server's 402 PaymentRequired response (`X402PaymentRequiredDto`), echoed back to the facilitator on verify and settle. The facilitator checks that the `accepted` scheme carried inside the token matches one of `accepts`.
    - `x402Version` integer, required: x402 protocol version.
    - `error` string: Human-readable error message from the 402 response.
    - `resource` X402Resource, required: x402 protected-resource descriptor (`X402ResourceDto`). The same shape appears in the server's 402 `paymentRequired` and in the payload you mint at `POST /x402/permissions`.
      - `url` string, required: URL of the protected resource or endpoint.
      - `description` string: Human-readable description of the resource.
      - `mimeType` string: Expected response MIME type.
    - `accepts` X402Scheme[], required: Payment schemes the server accepts for this resource.
      - `scheme` 'nvm:erc4337' | 'nvm:card-delegation', required: Payment scheme identifier. Selects the settlement rail: `nvm:erc4337` settles on-chain, `nvm:card-delegation` settles against an enrolled card.
      - `network` string, required: Settlement RAIL, not the environment. Card flows send `stripe`, `braintree` or `visa`; crypto flows send `eip155:<chainId>`. An environment name such as `sandbox` or `live` is rejected by request validation.
      - `planId` string: Plan id (256-bit identifier). Required for BOTH schemes — a mint without it is refused with `BCK.X402.0030` (HTTP 402). Request validation does not enforce it for either scheme: the DTO marks it optional, so the rejection comes from the scheme handler rather than from the `ValidationPipe`.
      - `extra` X402SchemeExtra: Scheme-specific extra fields (`X402SchemeExtraDto`). Every field is optional. On `tokenVersion` 3, `agentId` and `httpVerb` are signed as the empty string when omitted — which binds the token to that value being ABSENT rather than to any value. `version` is not part of the v3 signed struct at all, so omitting it binds nothing.
        - `version` string: Scheme version.
        - `agentId` string: Agent id the token is bound to, used for endpoint validation.
        - `httpVerb` string: HTTP verb the token is bound to, used for endpoint validation.
    - `extensions` object, required: Extensions object. Empty (`{}`) for `nvm:erc4337`, but the field itself must be present — it is validated as required.
  - `x402AccessToken` string, required: The x402 payment payload, base64-encoded — the token minted by `POST /x402/permissions`.
  - `maxAmount` string: Maximum credits to verify against the payer's balance. Send it as a decimal STRING: the value is parsed with `BigInt()` and then required to be a bigint, so a JSON number is rejected with 400.

## Response `201`

Verification result

- VerifyPermissionResponse: x402 facilitator verify response. `isValid` carries the answer; everything else is contextual. Fields after `network` are Nevermined extensions to the x402 facilitator spec.
  - `isValid` boolean, required: Whether the payment authorization is valid
  - `invalidReason` string: Reason for invalidity. Only present when `isValid` is `false`.
  - `payer` string: Address of the payer's wallet
  - `network` string: Network identifier (CAIP-2 chain id, or the payment provider for fiat rails)
  - `agentRequestId` string: Agent request id for observability tracking (Nevermined extension). Pass it back on `POST /x402/settle`.
  - `urlMatching` string: URL pattern that matched the endpoint. Only present when endpoint validation is performed.
  - `agentRequest` object: Agent request context for observability (Nevermined extension)

---

[API](https://skmtc.dev/nevermined/apis/nevermined-api.md) · [All operations](https://skmtc.dev/nevermined/apis/nevermined-api/llms.txt) · [OpenAPI document](https://skmtc.dev/nevermined/apis/nevermined-api/revisions/cabbe618c80b?raw)