Verify a fresh human proof

EndpointCopy Anchor Link

POST /tool-result-human-proof/verify

Verify a signed password proof no older than five minutes against the authenticated session subject. The verified subject must equal subject. The owner is derived from the verified IdP proof; it is not accepted from the body.

ParametersCopy Anchor Link

No operation parameters.

Request bodyCopy Anchor Link

The request uses the schema below.

Required: yes.

Content type: application/json.

{
  "type": "object",
  "properties": {
    "idpToken": {
      "type": "string",
      "minLength": 1
    },
    "subject": {
      "type": "string",
      "minLength": 1
    }
  },
  "required": [
    "idpToken",
    "subject"
  ],
  "additionalProperties": false
}

ResponsesCopy Anchor Link

HTTP 200Copy Anchor Link

The host decision completed.

Content type: application/json.

{
  "type": "object",
  "properties": {
    "authorized": {
      "const": true
    },
    "owner": {
      "type": "string",
      "pattern": "^u_[a-z2-7]{26}$"
    },
    "sub": {
      "type": "string"
    },
    "exp": {
      "type": "integer"
    },
    "authTime": {
      "type": "integer"
    }
  },
  "required": [
    "authorized",
    "owner",
    "sub",
    "exp",
    "authTime"
  ]
}

HTTP 400Copy Anchor Link

Malformed JSON or invalid request fields.

Content type: application/json.

{
  "$ref": "#/components/schemas/Error"
}

HTTP 401Copy Anchor Link

Missing or invalid loopback capability.

Content type: application/json.

{
  "$ref": "#/components/schemas/Error"
}

HTTP 403Copy Anchor Link

An Origin header or failed authority/proof check is refused.

Content type: application/json.

{
  "$ref": "#/components/schemas/Error"
}

HTTP 405Copy Anchor Link

Only POST is accepted.

Content type: application/json.

{
  "$ref": "#/components/schemas/Error"
}

HTTP 413Copy Anchor Link

Request exceeds the 65536-byte body limit.

Content type: application/json.

{
  "$ref": "#/components/schemas/Error"
}

HTTP 415Copy Anchor Link

Content-Type must be application/json.

Content type: application/json.

{
  "$ref": "#/components/schemas/Error"
}

HTTP 429Copy Anchor Link

Invalid-capability attempts exceeded the rolling-minute limit.

Content type: application/json.

{
  "$ref": "#/components/schemas/Error"
}

Authentication and access: Host-only HTTP operations of the stock auth service. These six routes exist only on the loopback listener and return 404 on the public listener. The owner-private auth-service discovery record supplies its port and exchange capability. Every operation requires the exact Authorization bearer capability, application/json and no Origin header. Requests match the exact target, so query strings and trailing slashes return 404. Bodies default to 65536 bytes. More than 30 invalid capability attempts in a rolling minute receive 429.

The loopback listener also serves /health, /jwks, /exchange, /manager-service-authority, /manager-instances, /service-endpoint-authority, /service-endpoint-host and /chat-session/open, /chat-session/bearer, /chat-session/retire. Their public request and response shapes are in the Auth HTTP API. Proof operations additionally require the loopback capability. The loopback /health handler also accepts other methods. Elevated exchange views and operator host operations are loopback-only. Mesh discovery is public-listener-only. This implementation reference does not establish a stable cloud API.

OpenAPI specification contains the referenced response schemas. Complete Markdown reference.