Delegate an attenuated sub-agent mandate

curl --request POST \
  --url https://api.orbit.devotel.io/api/v1/agents/agent-authorization-mandate/delegate \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "parent": {
    "id": "<string>",
    "agentId": "<string>",
    "principalId": "<string>",
    "allowedActions": [
      "<string>"
    ],
    "allowedTools": [
      "<string>"
    ],
    "allowedDataCategories": [
      "<string>"
    ],
    "maxInvocations": 123,
    "invocationCount": 123,
    "consentDigest": "<string>",
    "expiresAt": 123,
    "createdAt": 123,
    "updatedAt": 123,
    "revokedAt": 123,
    "parentMandateId": "<string>",
    "parentDigest": "<string>"
  },
  "id": "<string>",
  "agentId": "<string>",
  "allowedActions": [
    "<string>"
  ],
  "allowedTools": [
    "<string>"
  ],
  "allowedDataCategories": [
    "<string>"
  ],
  "maxInvocations": 2,
  "expiresAt": 123
}
'

import requests

url = "https://api.orbit.devotel.io/api/v1/agents/agent-authorization-mandate/delegate"

payload = {
    "parent": {
        "id": "<string>",
        "agentId": "<string>",
        "principalId": "<string>",
        "allowedActions": ["<string>"],
        "allowedTools": ["<string>"],
        "allowedDataCategories": ["<string>"],
        "maxInvocations": 123,
        "invocationCount": 123,
        "consentDigest": "<string>",
        "expiresAt": 123,
        "createdAt": 123,
        "updatedAt": 123,
        "revokedAt": 123,
        "parentMandateId": "<string>",
        "parentDigest": "<string>"
    },
    "id": "<string>",
    "agentId": "<string>",
    "allowedActions": ["<string>"],
    "allowedTools": ["<string>"],
    "allowedDataCategories": ["<string>"],
    "maxInvocations": 2,
    "expiresAt": 123
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    parent: {
      id: '<string>',
      agentId: '<string>',
      principalId: '<string>',
      allowedActions: ['<string>'],
      allowedTools: ['<string>'],
      allowedDataCategories: ['<string>'],
      maxInvocations: 123,
      invocationCount: 123,
      consentDigest: '<string>',
      expiresAt: 123,
      createdAt: 123,
      updatedAt: 123,
      revokedAt: 123,
      parentMandateId: '<string>',
      parentDigest: '<string>'
    },
    id: '<string>',
    agentId: '<string>',
    allowedActions: ['<string>'],
    allowedTools: ['<string>'],
    allowedDataCategories: ['<string>'],
    maxInvocations: 2,
    expiresAt: 123
  })
};

fetch('https://api.orbit.devotel.io/api/v1/agents/agent-authorization-mandate/delegate', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.orbit.devotel.io/api/v1/agents/agent-authorization-mandate/delegate",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'parent' => [
        'id' => '<string>',
        'agentId' => '<string>',
        'principalId' => '<string>',
        'allowedActions' => [
                '<string>'
        ],
        'allowedTools' => [
                '<string>'
        ],
        'allowedDataCategories' => [
                '<string>'
        ],
        'maxInvocations' => 123,
        'invocationCount' => 123,
        'consentDigest' => '<string>',
        'expiresAt' => 123,
        'createdAt' => 123,
        'updatedAt' => 123,
        'revokedAt' => 123,
        'parentMandateId' => '<string>',
        'parentDigest' => '<string>'
    ],
    'id' => '<string>',
    'agentId' => '<string>',
    'allowedActions' => [
        '<string>'
    ],
    'allowedTools' => [
        '<string>'
    ],
    'allowedDataCategories' => [
        '<string>'
    ],
    'maxInvocations' => 2,
    'expiresAt' => 123
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.orbit.devotel.io/api/v1/agents/agent-authorization-mandate/delegate"

	payload := strings.NewReader("{\n  \"parent\": {\n    \"id\": \"<string>\",\n    \"agentId\": \"<string>\",\n    \"principalId\": \"<string>\",\n    \"allowedActions\": [\n      \"<string>\"\n    ],\n    \"allowedTools\": [\n      \"<string>\"\n    ],\n    \"allowedDataCategories\": [\n      \"<string>\"\n    ],\n    \"maxInvocations\": 123,\n    \"invocationCount\": 123,\n    \"consentDigest\": \"<string>\",\n    \"expiresAt\": 123,\n    \"createdAt\": 123,\n    \"updatedAt\": 123,\n    \"revokedAt\": 123,\n    \"parentMandateId\": \"<string>\",\n    \"parentDigest\": \"<string>\"\n  },\n  \"id\": \"<string>\",\n  \"agentId\": \"<string>\",\n  \"allowedActions\": [\n    \"<string>\"\n  ],\n  \"allowedTools\": [\n    \"<string>\"\n  ],\n  \"allowedDataCategories\": [\n    \"<string>\"\n  ],\n  \"maxInvocations\": 2,\n  \"expiresAt\": 123\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.orbit.devotel.io/api/v1/agents/agent-authorization-mandate/delegate")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"parent\": {\n    \"id\": \"<string>\",\n    \"agentId\": \"<string>\",\n    \"principalId\": \"<string>\",\n    \"allowedActions\": [\n      \"<string>\"\n    ],\n    \"allowedTools\": [\n      \"<string>\"\n    ],\n    \"allowedDataCategories\": [\n      \"<string>\"\n    ],\n    \"maxInvocations\": 123,\n    \"invocationCount\": 123,\n    \"consentDigest\": \"<string>\",\n    \"expiresAt\": 123,\n    \"createdAt\": 123,\n    \"updatedAt\": 123,\n    \"revokedAt\": 123,\n    \"parentMandateId\": \"<string>\",\n    \"parentDigest\": \"<string>\"\n  },\n  \"id\": \"<string>\",\n  \"agentId\": \"<string>\",\n  \"allowedActions\": [\n    \"<string>\"\n  ],\n  \"allowedTools\": [\n    \"<string>\"\n  ],\n  \"allowedDataCategories\": [\n    \"<string>\"\n  ],\n  \"maxInvocations\": 2,\n  \"expiresAt\": 123\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.orbit.devotel.io/api/v1/agents/agent-authorization-mandate/delegate")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"parent\": {\n    \"id\": \"<string>\",\n    \"agentId\": \"<string>\",\n    \"principalId\": \"<string>\",\n    \"allowedActions\": [\n      \"<string>\"\n    ],\n    \"allowedTools\": [\n      \"<string>\"\n    ],\n    \"allowedDataCategories\": [\n      \"<string>\"\n    ],\n    \"maxInvocations\": 123,\n    \"invocationCount\": 123,\n    \"consentDigest\": \"<string>\",\n    \"expiresAt\": 123,\n    \"createdAt\": 123,\n    \"updatedAt\": 123,\n    \"revokedAt\": 123,\n    \"parentMandateId\": \"<string>\",\n    \"parentDigest\": \"<string>\"\n  },\n  \"id\": \"<string>\",\n  \"agentId\": \"<string>\",\n  \"allowedActions\": [\n    \"<string>\"\n  ],\n  \"allowedTools\": [\n    \"<string>\"\n  ],\n  \"allowedDataCategories\": [\n    \"<string>\"\n  ],\n  \"maxInvocations\": 2,\n  \"expiresAt\": 123\n}"

response = http.request(request)
puts response.read_body

{
  "data": {
    "id": "<string>",
    "agentId": "<string>",
    "principalId": "<string>",
    "allowedActions": [
      "<string>"
    ],
    "allowedTools": [
      "<string>"
    ],
    "allowedDataCategories": [
      "<string>"
    ],
    "maxInvocations": 123,
    "invocationCount": 123,
    "status": "active",
    "consentDigest": "<string>",
    "expiresAt": 123,
    "createdAt": 123,
    "updatedAt": 123,
    "revokedAt": 123,
    "parentMandateId": "<string>",
    "parentDigest": "<string>"
  },
  "meta": {
    "request_id": "<string>",
    "timestamp": "2023-11-07T05:31:56Z",
    "docs_url": "<string>"
  }
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "status": 123,
    "details": {}
  },
  "meta": {
    "request_id": "<string>",
    "timestamp": "2023-11-07T05:31:56Z",
    "docs_url": "<string>"
  }
}

Agents

Delegate an attenuated sub-agent mandate

Mint an attenuated CHILD mandate from a live parent for an agent-as-tool / A2A re-delegation hop (orchestrator → sub-agent, or transitively sub-agent → sub-sub-agent). The child’s allowlists, invocation cap, and expiry are each narrowed to a subset of the parent’s — a delegated mandate can never end up with more authority than it was given — and it carries a parentMandateId + parentDigest pointer baked into its own consent digest so the ancestry link cannot be forged or repointed. Delegation is refused from a parent that is revoked, expired, exhausted, or fails its own integrity check. Requires the agents:write scope and an owner, admin, or developer role. Audit-logged.

POST

api

agents

agent-authorization-mandate

delegate

Delegate an attenuated sub-agent mandate

curl --request POST \
  --url https://api.orbit.devotel.io/api/v1/agents/agent-authorization-mandate/delegate \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "parent": {
    "id": "<string>",
    "agentId": "<string>",
    "principalId": "<string>",
    "allowedActions": [
      "<string>"
    ],
    "allowedTools": [
      "<string>"
    ],
    "allowedDataCategories": [
      "<string>"
    ],
    "maxInvocations": 123,
    "invocationCount": 123,
    "consentDigest": "<string>",
    "expiresAt": 123,
    "createdAt": 123,
    "updatedAt": 123,
    "revokedAt": 123,
    "parentMandateId": "<string>",
    "parentDigest": "<string>"
  },
  "id": "<string>",
  "agentId": "<string>",
  "allowedActions": [
    "<string>"
  ],
  "allowedTools": [
    "<string>"
  ],
  "allowedDataCategories": [
    "<string>"
  ],
  "maxInvocations": 2,
  "expiresAt": 123
}
'

import requests

url = "https://api.orbit.devotel.io/api/v1/agents/agent-authorization-mandate/delegate"

payload = {
    "parent": {
        "id": "<string>",
        "agentId": "<string>",
        "principalId": "<string>",
        "allowedActions": ["<string>"],
        "allowedTools": ["<string>"],
        "allowedDataCategories": ["<string>"],
        "maxInvocations": 123,
        "invocationCount": 123,
        "consentDigest": "<string>",
        "expiresAt": 123,
        "createdAt": 123,
        "updatedAt": 123,
        "revokedAt": 123,
        "parentMandateId": "<string>",
        "parentDigest": "<string>"
    },
    "id": "<string>",
    "agentId": "<string>",
    "allowedActions": ["<string>"],
    "allowedTools": ["<string>"],
    "allowedDataCategories": ["<string>"],
    "maxInvocations": 2,
    "expiresAt": 123
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    parent: {
      id: '<string>',
      agentId: '<string>',
      principalId: '<string>',
      allowedActions: ['<string>'],
      allowedTools: ['<string>'],
      allowedDataCategories: ['<string>'],
      maxInvocations: 123,
      invocationCount: 123,
      consentDigest: '<string>',
      expiresAt: 123,
      createdAt: 123,
      updatedAt: 123,
      revokedAt: 123,
      parentMandateId: '<string>',
      parentDigest: '<string>'
    },
    id: '<string>',
    agentId: '<string>',
    allowedActions: ['<string>'],
    allowedTools: ['<string>'],
    allowedDataCategories: ['<string>'],
    maxInvocations: 2,
    expiresAt: 123
  })
};

fetch('https://api.orbit.devotel.io/api/v1/agents/agent-authorization-mandate/delegate', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.orbit.devotel.io/api/v1/agents/agent-authorization-mandate/delegate",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'parent' => [
        'id' => '<string>',
        'agentId' => '<string>',
        'principalId' => '<string>',
        'allowedActions' => [
                '<string>'
        ],
        'allowedTools' => [
                '<string>'
        ],
        'allowedDataCategories' => [
                '<string>'
        ],
        'maxInvocations' => 123,
        'invocationCount' => 123,
        'consentDigest' => '<string>',
        'expiresAt' => 123,
        'createdAt' => 123,
        'updatedAt' => 123,
        'revokedAt' => 123,
        'parentMandateId' => '<string>',
        'parentDigest' => '<string>'
    ],
    'id' => '<string>',
    'agentId' => '<string>',
    'allowedActions' => [
        '<string>'
    ],
    'allowedTools' => [
        '<string>'
    ],
    'allowedDataCategories' => [
        '<string>'
    ],
    'maxInvocations' => 2,
    'expiresAt' => 123
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.orbit.devotel.io/api/v1/agents/agent-authorization-mandate/delegate"

	payload := strings.NewReader("{\n  \"parent\": {\n    \"id\": \"<string>\",\n    \"agentId\": \"<string>\",\n    \"principalId\": \"<string>\",\n    \"allowedActions\": [\n      \"<string>\"\n    ],\n    \"allowedTools\": [\n      \"<string>\"\n    ],\n    \"allowedDataCategories\": [\n      \"<string>\"\n    ],\n    \"maxInvocations\": 123,\n    \"invocationCount\": 123,\n    \"consentDigest\": \"<string>\",\n    \"expiresAt\": 123,\n    \"createdAt\": 123,\n    \"updatedAt\": 123,\n    \"revokedAt\": 123,\n    \"parentMandateId\": \"<string>\",\n    \"parentDigest\": \"<string>\"\n  },\n  \"id\": \"<string>\",\n  \"agentId\": \"<string>\",\n  \"allowedActions\": [\n    \"<string>\"\n  ],\n  \"allowedTools\": [\n    \"<string>\"\n  ],\n  \"allowedDataCategories\": [\n    \"<string>\"\n  ],\n  \"maxInvocations\": 2,\n  \"expiresAt\": 123\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.orbit.devotel.io/api/v1/agents/agent-authorization-mandate/delegate")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"parent\": {\n    \"id\": \"<string>\",\n    \"agentId\": \"<string>\",\n    \"principalId\": \"<string>\",\n    \"allowedActions\": [\n      \"<string>\"\n    ],\n    \"allowedTools\": [\n      \"<string>\"\n    ],\n    \"allowedDataCategories\": [\n      \"<string>\"\n    ],\n    \"maxInvocations\": 123,\n    \"invocationCount\": 123,\n    \"consentDigest\": \"<string>\",\n    \"expiresAt\": 123,\n    \"createdAt\": 123,\n    \"updatedAt\": 123,\n    \"revokedAt\": 123,\n    \"parentMandateId\": \"<string>\",\n    \"parentDigest\": \"<string>\"\n  },\n  \"id\": \"<string>\",\n  \"agentId\": \"<string>\",\n  \"allowedActions\": [\n    \"<string>\"\n  ],\n  \"allowedTools\": [\n    \"<string>\"\n  ],\n  \"allowedDataCategories\": [\n    \"<string>\"\n  ],\n  \"maxInvocations\": 2,\n  \"expiresAt\": 123\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.orbit.devotel.io/api/v1/agents/agent-authorization-mandate/delegate")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"parent\": {\n    \"id\": \"<string>\",\n    \"agentId\": \"<string>\",\n    \"principalId\": \"<string>\",\n    \"allowedActions\": [\n      \"<string>\"\n    ],\n    \"allowedTools\": [\n      \"<string>\"\n    ],\n    \"allowedDataCategories\": [\n      \"<string>\"\n    ],\n    \"maxInvocations\": 123,\n    \"invocationCount\": 123,\n    \"consentDigest\": \"<string>\",\n    \"expiresAt\": 123,\n    \"createdAt\": 123,\n    \"updatedAt\": 123,\n    \"revokedAt\": 123,\n    \"parentMandateId\": \"<string>\",\n    \"parentDigest\": \"<string>\"\n  },\n  \"id\": \"<string>\",\n  \"agentId\": \"<string>\",\n  \"allowedActions\": [\n    \"<string>\"\n  ],\n  \"allowedTools\": [\n    \"<string>\"\n  ],\n  \"allowedDataCategories\": [\n    \"<string>\"\n  ],\n  \"maxInvocations\": 2,\n  \"expiresAt\": 123\n}"

response = http.request(request)
puts response.read_body

{
  "data": {
    "id": "<string>",
    "agentId": "<string>",
    "principalId": "<string>",
    "allowedActions": [
      "<string>"
    ],
    "allowedTools": [
      "<string>"
    ],
    "allowedDataCategories": [
      "<string>"
    ],
    "maxInvocations": 123,
    "invocationCount": 123,
    "status": "active",
    "consentDigest": "<string>",
    "expiresAt": 123,
    "createdAt": 123,
    "updatedAt": 123,
    "revokedAt": 123,
    "parentMandateId": "<string>",
    "parentDigest": "<string>"
  },
  "meta": {
    "request_id": "<string>",
    "timestamp": "2023-11-07T05:31:56Z",
    "docs_url": "<string>"
  }
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "status": 123,
    "details": {}
  },
  "meta": {
    "request_id": "<string>",
    "timestamp": "2023-11-07T05:31:56Z",
    "docs_url": "<string>"
  }
}

Authorizations

Authorization

string

header

required

Dashboard JWT token from Clerk

Body

application/json

parent

object

required

A scoped, revocable, action-capped authorization an AI agent acts under — a serializable snapshot the caller stores and round-trips in each request body. The scope fields (principal, agent, allowlists, invocation cap, expiry, ancestry) are immutable after issue and bound by consentDigest; only status, invocationCount, updatedAt, and revokedAt advance over the mandate's life. A delegated (child) mandate additionally carries a parentMandateId + parentDigest pointer to the parent it was attenuated from.

Show child attributes

string

required

Opaque, caller-supplied id for the new child mandate.

Required string length: 1 - 128

agentId

string

required

The sub-agent receiving the delegated authority.

Required string length: 1 - 128

allowedActions

null | string[]

Action allowlist to further narrow to. Omit or send empty to inherit the parent's unchanged.

Maximum array length: 256

Required string length: 1 - 256

allowedTools

null | string[]

Tool allowlist to further narrow to. Omit or send empty to inherit the parent's unchanged.

Maximum array length: 256

Required string length: 1 - 256

allowedDataCategories

null | string[]

Data-category allowlist to further narrow to. Omit or send empty to inherit the parent's unchanged.

Maximum array length: 256

Required string length: 1 - 256

maxInvocations

null | integer

Invocation cap to further narrow to. Omit to inherit the parent's cap; the effective cap is the minimum of this and the parent's, never higher.

Required range: x >= 1

expiresAt

null | integer

Expiry to further narrow to. Omit to inherit the parent's expiry; the effective expiry is the earlier of this and the parent's, never later.

Response

The minted, attenuated child mandate snapshot.

data

object

Show child attributes

API Reference

All Endpoints

Delegate an attenuated sub-agent mandate

Authorizations

Body

Response