> ## Documentation Index
> Fetch the complete documentation index at: https://docs.inviolet.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# POST /v1/mandate/dispense

> Mint a mandate JWT bound to a specific actor + intent card + scope.

Mint a mandate JWT bound to a specific actor + intent card + scope.

## Request

```http theme={"dark"}
POST /v1/mandate/dispense
Authorization: Bearer <INVIOLET_API_KEY>
Content-Type: application/json

{
  "actor": "alice@example.com",
  "intent_id": "intents:customer_support_lookup",
  "prompt_id": "p_01J9X...",
  "requested_scope": {
    "operations": ["postgres.select"],
    "resources": ["contacts.first_name", "contacts.last_name"],
    "forbidden_operations": ["postgres.delete"]
  },
  "ttl_seconds": 300,
  "audience": "postgres-prod",
  "context": { "on_call": true, "geo": "us-west" },

  "broker_dispense": { "kind": "vault", "vault_role": "postgres-readonly" },

  "classification_evidence": {
    "intent_id": "intents:customer_support_lookup",
    "confidence": 0.92,
    "classification_method": "llm",
    "evaluation_layers_consulted": ["lexical", "embedding", "llm"],
    "schema_version": 1
  }
}
```

## Response (200 OK)

```json theme={"dark"}
{
  "credential": "eyJhbGciOiJSUzI1NiIs...",
  "cred_id": "01J9X3...",
  "expires_at": "2026-05-04T20:42:01Z",
  "ttl_seconds": 300,
  "broker_dispense": {
    "kind": "vault",
    "result": {
      "kind": "minted",
      "vault_token": "hvs.CAESI...",
      "lease_duration": 300
    }
  }
}
```

## Notable fields

* `broker_dispense` — optional. When present, the gateway forwards the freshly-signed mandate to the named credential broker (`vault` or `conjur`) and includes the broker's response in the result.
* `classification_evidence` — optional. When you've run the cascade locally, pass it through so the dispense row carries the reasoning trail.
* `ttl_seconds` — optional. Defaults to 300; max 3600 (clamped at dispense).

## Errors

* `400 invalid_request` — body schema failed validation
* `403 mandate_violation` — requested scope exceeds the intent card's allowed scope; response includes a `suggested_scope` field with the narrowest allowed subset
* `404 intent_not_found` — intent card not installed for the bearer org
* `500 signing_failed` — JWKS / signing-key infra issue