---
title: "Verify a write-intent assertion and mint the write approval"
method: POST
path: "/agent/v1/control-plane/write-approval/verify"
tags: ["ControlPlane"]
---

# Verify a write-intent assertion and mint the write approval

`POST /agent/v1/control-plane/write-approval/verify`

## Request

- Base URL: `https://api.run402.com`
- URL: `https://api.run402.com/agent/v1/control-plane/write-approval/verify`
- Auth: none declared

The proof IS the WebAuthn assertion (UV required) over the single-use server-issued challenge — no bearer needed. Returns the opaque write approval token ONCE; send it as `X-Run402-Write-Approval: Bearer <token>` alongside the control-plane session bearer on the write routes it covers.

## Request body

- object
  - `challenge_id` string, required
  - `response` object, required: WebAuthn authentication response JSON

## Response `201`

write_approval_token (returned once) + session metadata

- object

## Other responses

- `401`: Challenge unknown/expired/replayed, assertion failed, or issuing session dead

---

[API](https://skmtc.dev/run402/apis/run402-api.md) · [All operations](https://skmtc.dev/run402/apis/run402-api/llms.txt) · [OpenAPI document](https://skmtc.dev/run402/apis/run402-api/revisions/893607557f50?raw)