MandateShield

MandateShield Production authority API

Challenge, strict verification, and processor transitions. The documented eight-field invariant establishes only a RESERVED, consumable authorization; a trusted gateway must obtain the single winning PROCESSOR-scoped CONSUME transition and fresh permit claim before attempting an idempotent provider request. MandateShield does not guarantee exactly-once provider delivery.

Documentation GitHub OpenAPI

Operations 4

Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay

POST /api/v2/challenges Issue a one-time challenge for a mandate · Issue a one-time challenge for a registered mandate #

Ask an LLM

“How do I get a fresh one-time nonce before signing purchase authority for a mandate?”

“How long does a verification challenge last, and can it be reused?”

Tell an agent

Issue a verification challenge for mandate {mandate_id} over {protocol} using key thumbprint {key_thumbprint}.

Create a one-time nonce for mandate {mandate_id} bound to pinned key {key_thumbprint}.

POST /api/v2/verify Verify signed purchase authority and get a receipt · Verify signed purchase authority and issue a signed receipt #

Ask an LLM

“How do I verify that an agent's signed purchase is authorized under a registered mandate?”

“Which evidence formats are accepted, like JWS, AP2 SD-JWT or TAP-style signatures?”

Tell an agent

Verify purchase envelope {envelope} with signed evidence {evidence} and issue a receipt.

Run strict v2 authority verification on {evidence} for this single purchase {envelope}.

POST /api/v2/execution-authorizations Consume, commit, release or expire an authorization · Atomically transition one reserved execution authorization #

Ask an LLM

“How does my processor consume a reserved authorization and get an execution permit?”

“Can I still commit or release an authorization while account execution is paused?”

Tell an agent

{action} the reserved authorization {compact} for audience {expected_audience} and envelope {expected_envelope}, idempotency key {idempotency_key}.

Consume authorization {compact} with provider binding {provider_binding} to obtain an execution permit.

POST /api/v2/batch Verify up to 25 purchase authorities at once · Verify 1–25 distinct strict authority inputs #

Ask an LLM

“Can I run strict signed-authority verification on many purchases in one call?”

“Does each item in a strict verification batch need its own challenge and idempotency key?”

Tell an agent

Verify this batch of signed purchase authorities with the strict v2 verifier.

Run strict authority verification for up to 25 distinct purchases together.

MandateShield Production authority API

Operations 4

Documentation

Specifications

Schemas & Data

Other Resources

Work with this as data

MCP server

Tools for apis

Call it yourself

Get an API key

OpenAPI Specification