Mandate API
Mandate appMandate MapGitHub
API ReferenceKeys

ES256 public keys (JWKS) for every AP2 credential

GET
/api/ap2/jwks

Provider, agent, payment gateway, merchants and users. Look keys up by kid.

Response Body

application/json

curl -X GET "https://example.com/api/ap2/jwks"
{  "keys": [    {      "kty": "EC",      "crv": "P-256",      "x": "string",      "y": "string",      "kid": "string",      "alg": "ES256",      "use": "sig"    }  ]}

Verify a Mandate v1 credential chain you hold POST

Checks an Intent, Cart and Payment Mandate chain against the published keys.

All public keys, Mandate v1 (Ed25519 PEM) and AP2 v0.2 (JWKS) GET

The full trust bundle in one call: users' and merchants' Ed25519 keys (with each merchant's verified status), the platform key, and the AP2 JWKS. Cache it to verify payments offline.