Skip to navigation
API ReferenceChecks

Validate an ALLOW auth token

API key required. Checks an authToken from an ALLOW response: signature, expiry (90 seconds from mint), and — when verb, target, or purpose are supplied — that the token is bound to exactly that write. Anything else is purpose drift and returns valid: false. Important: an invalid token is HTTP 200 with {"valid": false, "reason": "..."} — only a bad API key is a 401. Call this at the point of action, after the agent performs the write, to prove the write matches what Writ allowed.

Authentication

AuthorizationBearer

Bearer authentication of the form Bearer <token>, where token is your auth token.

Request

This endpoint expects an object.
tokenstringRequired

The writ_at_… auth token from an ALLOW response.

verbstringOptional
If given, the token must be bound to exactly this verb.
targetstringOptional
If given, the token must be bound to exactly this target.
purposestringOptional
If given, the token must be bound to exactly this purpose.

Response

{valid: true, claims} or {valid: false, reason}. Possible reasons: not a Writ auth token, malformed token, bad signature, malformed payload, token expired, or token not bound to this verb/target/purpose.

Errors

400
Bad Request Error
401
Unauthorized Error