Mandaitor Delegation Mandate Registry API (1.0.0)

Lists onboarding access requests. Supports optional status filtering (PENDING, APPROVED, REJECTED) and cursor-based pagination. Requires Cognito JWT with mandaitor-admins group membership.

Processes an admin action on an onboarding request. Supported values for {action}: approve, reject.

EMERGENCY OPERATION — Immediately revokes all ACTIVE and SUSPENDED mandates for a tenant. This is an irreversible bulk operation intended for security incidents, compliance breaches, or contract terminations.

Requires Cognito JWT with mandaitor-admins group membership. A MANDATE_REVOKED audit event is emitted per mandate with details.kill_switch_triggered = true.

Returns the current system mode (growth, sustain, maintenance, frozen) and associated metadata. Requires Cognito JWT with mandaitor-admins group membership.

Changes the system operational mode. This immediately affects all API endpoints:

• growth — Normal operation. All features active.
• sustain — Normal operation. No new features (policy only).
• maintenance — All authenticated endpoints return 503.
• frozen — Write endpoints return 503. Reads still work.

Mode changes propagate within ~10 seconds via in-memory cache TTL. Requires Cognito JWT with mandaitor-admins group membership.

Creates a new OpenID4VP session for EUDI Wallet identity verification. Returns a QR code URI (cross-device) and deep link URI (same-device) that the user scans/opens with their EUDI Wallet.

Polls the status of an EUDI Wallet verification session. Returns the resolved identity when the session is completed.

Receives the VP Token from the EUDI Wallet via direct_post response mode. This endpoint is called by the wallet after user consent. No authentication required as the wallet POSTs directly.

Serves the signed JWT Authorization Request Object that the EUDI Wallet fetches after scanning the QR code. Returns the JWT directly with content type application/oauth-authz-req+jwt.

Returns a paginated list of audit events for a specific mandate. Events form an immutable, hash-chained audit trail.

Queries all audit events for the authenticated tenant, filtered by mandate_id. Supports optional event_type filtering and cursor-based pagination.

Retrieves a single audit event by its ID. Requires the mandate_id query parameter to locate the event in the partition.

Exports a comprehensive, court-ready evidence pack for a mandate containing:

• Mandate snapshot at export time
• Hash-chained audit event log
• SD-JWT proof tokens from verification events
• Case log hash (SHA-256 fingerprint over canonical event chain)
• Issuer DID document reference for independent verification

The case_log_hash is a deterministic SHA-256 digest computed over the canonical JSON representation of the event chain, enabling tamper detection.

The schema_version field allows forward-compatible evolution of the pack format.

Exchange a user's access token for a scoped delegation token. Implements RFC 8693 Token Exchange for On-Behalf-Of (OBO) flows where AI agents act on behalf of authenticated users.

Creates a new delegation mandate between a principal and a delegate. The mandate defines the scope of delegated authority, optional constraints, and an expiration date. A KMS-signed audit event is emitted on success.

Returns a paginated list of mandates for the authenticated tenant. Supports optional filtering by status and cursor-based pagination.

Retrieves a single mandate by its ID. Returns the full mandate record including principal, delegate, scope, constraints, and proof metadata.

Permanently revokes a mandate. Only active or suspended mandates can be revoked. An optional reason can be provided. A KMS-signed audit event is emitted.

Temporarily suspends an active mandate. Suspended mandates can be reactivated later. An optional reason can be provided.

Reactivates a previously suspended mandate, returning it to ACTIVE status. Only mandates in SUSPENDED state can be reactivated.

Approves a mandate that is in PENDING_APPROVAL state, transitioning it to ACTIVE. Only mandates created with require_approval: true enter this state. An audit event (MANDATE_APPROVED) is emitted.

Rejects a mandate that is in PENDING_APPROVAL state, transitioning it to REVOKED. An audit event (MANDATE_REJECTED) is emitted.

Submits a new tenant access request. No authentication required. The request enters PENDING state and must be approved by an admin.

Generates a new API key for a tenant. The raw key is returned only once in the response and cannot be retrieved again. Requires Cognito JWT.

Returns service health status. No sensitive data is exposed. Suitable for monitoring, load balancers, and Trust Center embedding.

Returns the W3C DID Document for the Mandaitor issuer DID (did:web:api.mandaitor.io). Contains the public key used to verify Proof-of-Mandate SD-JWT VCs.

Returns machine-readable trust metadata including region, partition, issuer DID, data residency claims, and supported open standards. Unauthenticated and cache-friendly (5-minute client, 10-minute CDN).

Submits a new tenant access request. No authentication required. The request enters PENDING state and must be approved by an admin.

Returns the public-safe widget configuration for embedding. No authentication required. Sensitive fields (secrets, internal IDs) are stripped from the response.