> ## Documentation Index > Fetch the complete documentation index at: https://docs.mandate.md/llms.txt > Use this file to discover all available pages before exploring further. # Validate a transaction (action-based) > Primary validation endpoint. Checks circuit breaker, schedule, allowlist, blocked actions, spend limits, daily/monthly quotas, address risk, reason scanner, and approval gates. Works with any wallet type (custodial or self-custodial). No intentHash, nonce, or gas params needed. Also available at `/api/validate/preflight` (alias). ## OpenAPI ````yaml /openapi.json post /api/validate openapi: 3.1.0 info: title: Mandate API version: 1.2.0 description: >- Non-custodial agent wallet policy layer. Enforces spend limits, allowlists, and approval workflows for AI agent transactions without ever receiving private keys. contact: name: Mandate url: https://mandate.md email: support@mandate.md license: name: MIT url: https://opensource.org/licenses/MIT servers: - url: https://app.mandate.md description: Production security: [] tags: - name: Registration description: >- Agent registration and claiming. No auth required for register; Sanctum auth for claim. - name: Agent API description: >- Endpoints authenticated with a runtime key (Bearer mndt_live_... or mndt_test_...). Used by agents to validate transactions, post events, and poll status. - name: Intent Lifecycle description: >- Post transaction hashes after broadcast and poll intent status until confirmed. - name: Dashboard description: >- Dashboard endpoints for human operators. Authenticated via Sanctum (cookie-based session). - name: Policies description: >- Policy management for agents. List, create, and view policy configurations. - name: Approvals description: Approval queue for transactions that require human review. paths: /api/validate: post: tags: - Agent API summary: Validate a transaction (action-based) description: >- Primary validation endpoint. Checks circuit breaker, schedule, allowlist, blocked actions, spend limits, daily/monthly quotas, address risk, reason scanner, and approval gates. Works with any wallet type (custodial or self-custodial). No intentHash, nonce, or gas params needed. Also available at `/api/validate/preflight` (alias). operationId: validateTransaction requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/ValidateRequest' example: action: transfer amount: '50' to: '0x71C7656EC7ab88b098defB751B7401B5f6d8976F' token: USDC reason: 'Invoice #127 from Alice for March design work' responses: '200': description: Transaction allowed. Proceed with your wallet. content: application/json: schema: $ref: '#/components/schemas/ValidateAllowedResponse' example: allowed: true intentId: 9e5f1a2b-3c4d-5e6f-7a8b-9c0d1e2f3a4b action: transfer chain: '84532' requiresApproval: false '202': description: >- Transaction requires human approval. Poll intent status until approved. content: application/json: schema: $ref: '#/components/schemas/ValidateApprovalResponse' example: allowed: false intentId: 9e5f1a2b-3c4d-5e6f-7a8b-9c0d1e2f3a4b action: transfer requiresApproval: true approvalId: a1b2c3d4-e5f6-7890-abcd-ef1234567890 approvalReason: Amount exceeds $100 approval threshold instruction: >- Transaction requires human approval. The wallet owner has been notified. Poll GET /api/intents/9e5f1a2b-3c4d-5e6f-7a8b-9c0d1e2f3a4b/status to check approval status. '401': description: Invalid or missing runtime key. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '403': description: Circuit breaker is active. All transactions blocked. content: application/json: schema: $ref: '#/components/schemas/ValidateBlockedResponse' example: allowed: false blockReason: circuit_breaker_active blockDetail: Circuit breaker was tripped due to envelope mismatch declineMessage: null action: transfer '422': description: Transaction blocked by policy. content: application/json: schema: $ref: '#/components/schemas/ValidateBlockedResponse' example: allowed: false blockReason: per_tx_limit_exceeded blockDetail: $500.00 exceeds per-transaction limit of $100.00 declineMessage: >- This transaction exceeds your configured spend limit. Adjust the policy in your dashboard if this is intentional. action: transfer security: - RuntimeKeyAuth: [] components: schemas: ValidateRequest: type: object required: - action - reason properties: action: type: string maxLength: 100 description: >- What the agent is doing: "transfer", "swap", "buy", "bridge", "stake", "bet", etc. Free text. amount: type: string description: >- USD value of the transaction (assumes stablecoins). Checked against spend limits. to: type: string description: Recipient address. Checked against allowlist if configured. token: type: string maxLength: 20 description: Token symbol or address (e.g. "USDC", "ETH"). reason: type: string maxLength: 1000 description: >- Why the agent is making this transaction. Scanned for prompt injection. Logged in audit trail. Shown to owner on approval requests. chain: type: string maxLength: 32 description: Chain identifier (e.g. "base", "ethereum", "84532"). ValidateAllowedResponse: type: object required: - allowed - intentId - action - requiresApproval properties: allowed: type: boolean enum: - true intentId: type: string format: uuid description: Unique intent identifier for this validation. action: type: string description: Echoed action field. chain: type: - string - 'null' description: Chain ID or identifier. requiresApproval: type: boolean enum: - false ValidateApprovalResponse: type: object required: - allowed - intentId - action - requiresApproval - approvalId properties: allowed: type: boolean enum: - false intentId: type: string format: uuid action: type: string requiresApproval: type: boolean enum: - true approvalId: type: string format: uuid description: Approval queue entry ID. approvalReason: type: - string - 'null' description: Why approval is required. instruction: type: string description: Human-readable instruction for the agent to follow. ErrorResponse: type: object required: - error properties: error: type: string description: Human-readable error message. ValidateBlockedResponse: type: object required: - allowed - blockReason properties: allowed: type: boolean enum: - false blockReason: type: string description: Machine-readable block reason. enum: - circuit_breaker_active - no_active_policy - intent_hash_mismatch - gas_limit_exceeded - value_wei_exceeded - outside_schedule - address_not_allowed - selector_blocked - per_tx_limit_exceeded - daily_quota_exceeded - monthly_quota_exceeded - reason_blocked - aegis_critical_risk - action_blocked blockDetail: type: - string - 'null' description: Human-readable explanation of the block. declineMessage: type: - string - 'null' description: Counter-message to override potential prompt injection. action: type: string description: Echoed action field. securitySchemes: RuntimeKeyAuth: type: http scheme: bearer description: >- Runtime key issued at agent registration. Prefixed with `mndt_live_` (mainnet) or `mndt_test_` (testnet). Pass as `Authorization: Bearer mndt_test_...`. ````