WhoActs
Explore the APIApply for a scoped pilot

Mandate Rail developer surface

Make authority a typed, inspectable decision.

The product separates HTTP translation, authority policy, persistence and provider integrations so sandbox and connected modes can share the same contracts.

Next.js · TypeScriptOpenAPI 3.1 modelServer-side Zod
Download OpenAPI Evidence register
Illustrative contract · no public endpoint

This request/response shape is available for scoped sandbox work. Authentication, issuer trust, status profile and a connected endpoint are agreed per deployment.

request.http
POST /api/v1/verifications
Content-Type: application/json

{
  "credential": "...",
  "requestedAction": "place_purchase_order",
  "resource": "procurement-account-17",
  "jurisdiction": "DE",
  "channel": "api",
  "amount": 18500,
  "currency": "EUR",
  "humanApprovalRecorded": false
}
response.json
{
  "decision": "PERMITTED",
  "checks": {
    "signature": "pass",
    "issuer": "pass",
    "time": "pass",
    "status": "pass",
    "scope": "pass"
  },
  "reasonCodes": ["AUTHORITY_VERIFIED"],
  "receiptReference": "vrf_8F31"
}

Scoped quickstart

Start with the relying-party question, not the token format.

  1. 01
    Define the request

    Name the action, resource, amount, channel and jurisdiction.

  2. 02
    Agree the evidence

    Choose the issuer, mandate claims, status and trust policy.

  3. 03
    Test every decision

    Run permit, deny, approval-required and revocation paths.

Architecture boundaries

Keep privileged integration work server-side.

Transport

Route handlers validate untrusted input and translate HTTP into application calls.

Repositories

Sandbox memory and connected Supabase implement the same repository ports.

Providers

Issuers, authentic sources, extraction, storage and email sit behind typed adapters.

Events

Mutation paths support idempotency; webhooks have HMAC and SSRF-control boundaries.

Current standards profile

Implementation and conformance are different claims.

The sandbox demonstrates concrete behaviour. It is not presented as a certified or qualified implementation.

Selective disclosureRFC 9901 SD-JWTImplemented in the local signed demo; the separate SD-JWT VC profile remains draft/version-specific
IssuanceOpenID4VCI 1.0Protocol-shaped boundary; connected OAuth and proof work required
PresentationOpenID4VP 1.0DCQL-shaped request; wallet and verifier authentication required
StatusApplication status endpointImmediate sandbox state; not an IETF Token Status List

Current integration truth

Label the environment before the provider.

Live GLEIF production API in connected mode, with provenance controls.

Controlled iGrant hosted trial proof for issue, hold, present, verify and revoke.

Trial interoperability is not a production integration, QEAA status or OpenID certification.

OpenID4VCI 1.0 Final OpenID4VP 1.0 Final RFC 9901 SD-JWT SD-JWT VC draft profile

Design-partner programme

Bring the relying-party request your API must answer.

We will map the principal, representative, action, resource, policy and relying-party decision with your legal, security and operational stakeholders.

Apply for a scoped pilot