---
title: "Issue signed mandates and operator-approved action grants, then let credentialed agents consume them to create immutable work-order records. Records do not perform work, deliver results or authorize payment."
method: POST
path: "/api/delegated-authority"
---

# Issue signed mandates and operator-approved action grants, then let credentialed agents consume them to create immutable work-order records. Records do not perform work, deliver results or authorize payment.

`POST /api/delegated-authority`

## Request

- Base URL: `https://weverlabs.com`
- URL: `https://weverlabs.com/api/delegated-authority`
- Auth: none declared

Only issue_mandate has an x402 fee per mandate. All other modes retain existing authorization requirements and have no x402 fee. Payment does not replace credentials or grants.

## Request body

- union: Exact delegated-authority v2 request shapes. Credentials and issuance idempotency keys are HTTP headers, never tool arguments. The backend additionally enforces signed cross-field bindings, active time windows, credential-bound usage, exact approved action digests and durable allowance state.
  - object: Read the public contract. This performs no authority issuance or downstream write.
    - `mode` 'read_control_plane', required
  - object: Validate a public unsigned_dev draft. It is not signed, persisted or executable. Expiry must follow not_before by no more than 30 days.
    - `mode` 'draft_mandate', required
    - `mandate` MandateInput, required (unresolved $ref)
  - object: Requires X-Wever-Operator-Key and Idempotency-Key. Issue one durable signed mandate for a configured agent. The active time window is limited to 30 days from issuance.
    - `mode` 'issue_mandate', required
    - `mandate` MandateInput, required (unresolved $ref)
  - object: Requires the issuing operator X-Wever-Operator-Key and Idempotency-Key. Reserve one work_order unit and approve this exact action for at most 300 seconds. An agent cannot issue its own grant.
    - `mode` 'issue_action_grant', required
    - `signed_mandate` SignedMandate, required (unresolved $ref)
    - `request` GrantRequest, required (unresolved $ref)
  - object: Requires the target agent X-Wever-Agent-Key. Consume the signed grant once to create its immutable work-order record. This does not execute the recorded work, deliver results or authorize payment. A pending or unknown result is not success; retry the same grant or inspect it, never substitute new authority.
    - `mode` 'execute_delegated_action', required
    - `signed_action_grant` SignedActionGrant, required (unresolved $ref)
    - `action` WorkOrderAction, required (unresolved $ref)
  - object: Requires the bound agent X-Wever-Agent-Key. Read durable grant state and any finalized result.
    - `mode` 'inspect_action_grant', required
    - `grant_id` string, required
  - object: Requires the issuing operator X-Wever-Operator-Key. Revoke future authority. Revocation does not undo a committed work-order record or release an uncertain in-flight effect.
    - `mode` 'revoke_mandate', required
    - `mandate_id` string, required
  - object: Requires the bound agent X-Wever-Agent-Key. Read this mandate audit after the supplied cursor, default 0, with a default limit of 50.
    - `mode` 'read_audit', required
    - `mandate_id` string, required
    - `after` integer
    - `limit` integer
  - object
    - `mode` 'issue_mandate', required
    - `mandate` object, required
      - `profile` 'com.weverlabs.ap2.direct-checkout.1', required
      - `challenge_token` string, required
      - `holder_jwk` object, required
        - `kty` 'EC', required
        - `crv` 'secp256k1', required
        - `x` string, required
        - `y` string, required
      - `consent_digest` string, required
      - `expires_at` integer, required

## Response `200`

Validated draft, authorized state or operation result

## Other responses

- `201`: New mandate or action grant; mandate issuance is the only paid mode
- `202`: Operation pending; no success implied
- `400`: Invalid or unsupported input
- `401`: Missing or invalid existing authority credential
- `402`: issue_mandate requires x402 v2 payment or verified-wallet free allowance; PAYMENT-REQUIRED advertises Base USDC terms
- `403`: Authority scope or credential denied
- `409`: Idempotency conflict or unresolved operation; retry the same request
- `503`: Authority or payment configuration or dependency unavailable

---

[API](https://skmtc.dev/weverlabs/apis/wever-labs-agent-api.md) · [All operations](https://skmtc.dev/weverlabs/apis/wever-labs-agent-api/llms.txt) · [OpenAPI document](https://skmtc.dev/weverlabs/apis/wever-labs-agent-api/revisions/e4eed0d1f6e3?raw)