HTTP API - Inviolet

The Inviolet gateway exposes a small, stable HTTP surface. Every SDK is a thin wrapper over these endpoints — you can call them directly from any language.

Base URL + auth

Production: https://api.inviolet.ai. All endpoints require a bearer token in the Authorization header:

Authorization: Bearer <INVIOLET_API_KEY>

Endpoints

Endpoint	Purpose
`POST /v1/mandate/dispense`	Mint a mandate JWT for a (intent, actor) pair.
`POST /v1/mandate/refresh`	Extend the TTL of an unexpired mandate.
`POST /v1/mandate/revoke`	Revoke a mandate + propagate to credential broker.
`GET /v1/mandate/{cred_id}`	Inspect a dispensed mandate.
`GET /v1/mandate/jwks`	Public keys for verifying mandates.
`POST /v1/mcp-proxy/call`	Run the decision engine against a mandate + action.
`POST /v1/intent/evaluate`	Legacy policy evaluator (no mandate required).
`GET /v1/health`	Liveness probe.

Errors

Errors return JSON with code and message fields. Common codes:

mandate_invalid — JWT signature, exp, or aud check failed
mandate_org_mismatch — bearer org ≠ mandate org
intent_not_found — referenced intent card not installed for the org
scope_outside_intent — requested scope exceeds the intent card’s allowed scope
cooldown — endpoint rate-limited; Retry-After header carries seconds