> ## Documentation Index
> Fetch the complete documentation index at: https://docs.inviolet.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# HTTP API

> The stable HTTP surface behind every Inviolet SDK — base URL, auth, endpoints, and error codes.

The Inviolet gateway exposes a small, stable HTTP surface. Every SDK is a
thin wrapper over these endpoints — you can call them directly from any
language.

## Base URL + auth

Production: `https://api.inviolet.ai`. All endpoints require a bearer token
in the `Authorization` header:

```
Authorization: Bearer <INVIOLET_API_KEY>
```

## Endpoints

| Endpoint                                               | Purpose                                             |
| ------------------------------------------------------ | --------------------------------------------------- |
| [`POST /v1/mandate/dispense`](/api-reference/dispense) | Mint a mandate JWT for a (intent, actor) pair.      |
| `POST /v1/mandate/refresh`                             | Extend the TTL of an unexpired mandate.             |
| `POST /v1/mandate/revoke`                              | Revoke a mandate + propagate to credential broker.  |
| `GET /v1/mandate/{cred_id}`                            | Inspect a dispensed mandate.                        |
| [`GET /v1/mandate/jwks`](/api-reference/jwks)          | Public keys for verifying mandates.                 |
| [`POST /v1/mcp-proxy/call`](/api-reference/decide)     | Run the decision engine against a mandate + action. |
| [`POST /v1/intent/evaluate`](/api-reference/evaluate)  | Legacy policy evaluator (no mandate required).      |
| `GET /v1/health`                                       | Liveness probe.                                     |

## Errors

Errors return JSON with `code` and `message` fields. Common codes:

* `mandate_invalid` — JWT signature, exp, or aud check failed
* `mandate_org_mismatch` — bearer org ≠ mandate org
* `intent_not_found` — referenced intent card not installed for the org
* `scope_outside_intent` — requested scope exceeds the intent card's allowed scope
* `cooldown` — endpoint rate-limited; `Retry-After` header carries seconds