Skip to main content
POST
Validate a permission grant and return its canonical id + owner challenge

Authorizations

pid_access
string
cookie
required

JWT access token set by /auth/google/callback or /auth/refresh

Body

application/json
kind
integer
required

1 = nonfinancial, 2 = ETH, 3 = ERC-20, 4 = ERC-721, 5 = ERC-1155

Required range: 1 <= x <= 5
target
string
required

Nonfinancial: exact allowed target (never the account/factory)

selector
string
required

Nonfinancial: exact allowed selector (0x + 8 hex chars, never denylisted)

token
string
required

Financial: token contract (zero address = native ETH)

to
string
required

Financial: explicit recipient

perTxCap
string
required

Financial: max per execution, raw units

totalLimit
string
required

Financial: lifetime cap in the same units

nftId
string
required

ERC-721/1155: token id

sessionX
string
required

Session P-256 key x (0x + 64 hex chars)

sessionY
string
required

Session P-256 key y (0x + 64 hex chars)

validAfter
integer
required

Grant start (unix seconds)

validUntil
integer
required

Grant expiry (unix seconds, ≤ 30d out)

salt
string
required

Owner-chosen uniqueness salt (0x + 64 hex chars)

deadline
integer
required

Owner-authorization deadline (unix seconds, TTL ≤ 600s)

chainId
integer
required
account
string
required
nonce
string
required

Owner nonce the grant consumes

factory
string
required

Deploying factory (blocked as a permission target)

Response

Canonical permission id + owner challenge

permissionId
string
required

Canonical permission id (0x + 64 hex chars)

grantPayload
string
required

Owner challenge — what the passkey signs (0x + 64 hex chars)