Mandate API
Mandate appMandate MapGitHub
API ReferenceDemo

Approve or decline a purchase

POST
/api/approvals/{id}

If the user has a passkey, approving needs a WebAuthn assertion over this exact cart (challenge from GET /api/approvals/{id}/passkey). Hard rules (category, seller, injected instructions) can never be approved through.

Path Parameters

id*string

The approval ID from listApprovals or the agent run.

Request Body

application/json

choice*string

Value in

  • "approve"
  • "decline"
passkey?

A WebAuthn assertion over the approval's challenge (base64url fields).

Response Body

application/json

application/json

application/json

application/json

application/json

curl -X POST "https://example.com/api/approvals/string" \  -H "Content-Type: application/json" \  -d '{    "choice": "approve"  }'
{  "status": "paid",  "decision": {    "outcome": "allow",    "rule": "string",    "reason": "string"  },  "paypalOrderId": "string",  "amountMinor": 0,  "paymentMandateId": "string",  "approvalId": "string",  "approveUrl": "string",  "error": "string"}

Purchases waiting for the user GET

Purchases the gate sent to the user (over a soft limit), with when each request expires.

Verdict for an agent payment GET

Is this PayPal order backed by a mandate the buyer signed? Returns the Mandate v1 checks (Intent, Cart and Payment Mandates, Ed25519), the `paypal_order_record` check (PayPal's own order record, read with the PayPal Server SDK, shows the signed amount captured), and the AP2 v0.2 verdict in `ap2`. Fulfil only when `ok` and `ap2.ok` are both true.