Capabilities

Atomically redeem one exact action capability

Verify the compact JWS locally first with the pinned public key, then authenticate with a distinct executor credential. Agent API keys are rejected. Tenant, environment, executor principal, tool and target come from the signed claims plus the server-owned registration, never caller JSON.

post/v1/capabilities/redeem

Request

  • Base URL: https://api.thrd.email
  • URL: https://api.thrd.email/v1/capabilities/redeem
  • Auth: HTTP bearer

Request body

capability_tokenstring required

Compact single-use thrd-cap+jwt JWS.

Response

The capability transitioned from issued to redeemed exactly once.

redemption_idstring uuid required
capability_idstring uuid required
status'redeemed' required
decision_idstring uuid required
receipt_idstring uuid required
redeemed_atstring date-time required

Changes

No recorded changes to this operation across all 1 revision of this API.