docs.vin

mandate

The mandate noun — identity, lifecycle, events, and every capability as an anchored section: 8 capabilities, 0 live, 8 sandbox, 0 declared.

mandate is one of the estate's 317 automotive nouns — a job a car needs done. It carries 8 capabilities: 0 live, 8 sandbox, 0 declared · doors mandate.vin · aggregator.vin.

Identity

Nounmandate
PillarCommerce (facets: 1 data · 7 commerce)
Capabilities8 — 0 live · 8 sandbox · 0 declared
EntitiesMandate
Doorsaggregator.vin · mandate.vin
SDKVin.mandate.* from apis.vin
Address/catalog/mandate#{action} — the anchor IS the wire name minus mandate.

Lifecycle

Mandate — MandateFSM: 7 states, 7 transitions — Minted · Granted · Presented · Active · Exhausted · Revoked · Expired. Each transition is a past-tense event on the record.

Events

The vocabulary this noun can append to the record — 8 past-tense, versioned event types, each linked to the capability that emits it:

Discover & read

verify

mandate.verify · GET /mandates/verify · gate key · sandbox · answers Mandate@1

No input — this capability takes no request body.

Door — mandate.vin serves this noun on its two routes: / (the landing) · /5XYP2DHC5MG106068 (the VIN lens).

Try it — sandbox: every call answers a deterministic, provenance-labeled simulated payload ({ environment, simulated } in the body). Force any documented outcome with the magic triggers. Going live is a connect, never a ballot: submit the credential at integrates.vin (dealer systems) or connects.vin (consumer accounts) — submissions enter the activation queue and rank live rollout.

the SDK — mandate.verify
import { mandate } from 'apis.vin'

// the gate law is in the type system: Answer<T> = Ok | Empty | Blocked | Offer
const answer = await mandate.verify()
GET /mandates/verify
curl 'https://apis.vin/mandates/verify'

Receipt — the sandbox wire answered the request above with this exact body at build time. Captured by the receipts runner (timestamped, provenance in the payload), never authored; it re-executes only when this descriptor changes.

receipt · executed 2026-08-16T14:50:09.924Z · HTTP 200
{
  "type": "OK",
  "answers": "Mandate@1",
  "value": {
    "principalId": "PRINCIPAL-01",
    "agentId": "AGENT-GRANTED-01",
    "action": "sign",
    "outcome": "granted",
    "grantedScopes": [
      "sign"
    ],
    "capCents": null,
    "remainingCents": null,
    "provenance": {
      "environment": "sandbox",
      "simulated": true,
      "provider": "mandate-rail-sandbox"
    }
  },
  "evidence": {
    "principalId": "PRINCIPAL-01",
    "agentId": "AGENT-GRANTED-01",
    "action": "sign",
    "outcome": "granted",
    "grantedScopes": [
      "sign"
    ],
    "capCents": null,
    "remainingCents": null,
    "provenance": {
      "environment": "sandbox",
      "simulated": true,
      "provider": "mandate-rail-sandbox"
    }
  },
  "provenance": {
    "simulated": true,
    "environment": "sandbox",
    "source": "mandate-rail-sandbox"
  },
  "events": [],
  "meter": {
    "charged": "0.00",
    "posted": false
  }
}

Authorize & resolve

revoke

mandate.revoke · POST /mandates/revoke · gate key · sandbox · answers MandateRevoke@1

No input — this capability takes no request body.

Door — mandate.vin serves this noun on its two routes: / (the landing) · /5XYP2DHC5MG106068 (the VIN lens).

Try it — sandbox: every call answers a deterministic, provenance-labeled simulated payload ({ environment, simulated } in the body). Force any documented outcome with the magic triggers. Going live is a connect, never a ballot: submit the credential at integrates.vin (dealer systems) or connects.vin (consumer accounts) — submissions enter the activation queue and rank live rollout.

Emits — Mandate.revoked@1.

the SDK — mandate.revoke
import { mandate } from 'apis.vin'

// the gate law is in the type system: Answer<T> = Ok | Empty | Blocked | Offer
const answer = await mandate.revoke()
POST /mandates/revoke
curl -X POST https://apis.vin/mandates/revoke \
  -H 'content-type: application/json' \
  -d '{}'

Receipt — the sandbox wire answered the request above with this exact body at build time. Captured by the receipts runner (timestamped, provenance in the payload), never authored; it re-executes only when this descriptor changes.

receipt · executed 2026-08-16T14:50:09.924Z · HTTP 200
{
  "type": "OK",
  "answers": "MandateRevoke@1",
  "value": {
    "mandate": "mandate_da1fd924",
    "status": "revoked",
    "revokedAt": "2026-08-10T00:00:00.000Z"
  },
  "evidence": {
    "mandate": "mandate_da1fd924",
    "status": "revoked",
    "revokedAt": "2026-08-10T00:00:00.000Z"
  },
  "provenance": {
    "simulated": true,
    "environment": "sandbox",
    "source": "governance-sandbox"
  },
  "events": [],
  "meter": {
    "charged": "0.00",
    "posted": false
  }
}

reauthorize

mandate.reauthorize · POST /mandates/reauthorize · gate human · sandbox · answers MandateReauthorize@1

No input — this capability takes no request body.

The gate is a 403 NEEDS_HUMAN — the human verb authorize (credential: principal) · demand side, routed to a named, staffed, priced terminus with a poll rail. Never a dead end. Price: not posted — see /pricing.

Door — mandate.vin serves this noun on its two routes: / (the landing) · /5XYP2DHC5MG106068 (the VIN lens).

Try it — sandbox: every call answers a deterministic, provenance-labeled simulated payload ({ environment, simulated } in the body). Force any documented outcome with the magic triggers. Going live is a connect, never a ballot: submit the credential at integrates.vin (dealer systems) or connects.vin (consumer accounts) — submissions enter the activation queue and rank live rollout.

Emits — Mandate.reauthorized@1.

the SDK — mandate.reauthorize
import { mandate } from 'apis.vin'

// the gate law is in the type system: Answer<T> = Ok | Empty | Blocked | Offer
const answer = await mandate.reauthorize()
POST /mandates/reauthorize
curl -X POST https://apis.vin/mandates/reauthorize \
  -H 'content-type: application/json' \
  -d '{}'

Receipt — the sandbox wire answered the request above with this exact body at build time. Captured by the receipts runner (timestamped, provenance in the payload), never authored; it re-executes only when this descriptor changes.

receipt · executed 2026-08-16T14:50:09.923Z · HTTP 200
{
  "type": "OK",
  "answers": "MandateReauthorize@1",
  "value": {
    "mandate": "mnd_da1fd924",
    "status": "active",
    "ceiling": {
      "amount": "500000",
      "currency": "USD"
    },
    "perAction": {
      "amount": "100000",
      "currency": "USD"
    },
    "expiresAt": "2027-08-10T00:00:00Z",
    "reauthorizedAt": "2026-08-10T00:00:00.000Z"
  },
  "evidence": {
    "mandate": "mnd_da1fd924",
    "status": "active",
    "ceiling": {
      "amount": "500000",
      "currency": "USD"
    },
    "perAction": {
      "amount": "100000",
      "currency": "USD"
    },
    "expiresAt": "2027-08-10T00:00:00Z",
    "reauthorizedAt": "2026-08-10T00:00:00.000Z"
  },
  "provenance": {
    "simulated": true,
    "environment": "sandbox",
    "source": "governance-sandbox"
  },
  "events": [],
  "meter": {
    "charged": "0.00",
    "posted": false
  }
}

Lifecycle & state

activate

mandate.activate · POST /mandates/activate · gate key · sandbox · answers Mandate@1

No input — this capability takes no request body.

Door — mandate.vin serves this noun on its two routes: / (the landing) · /5XYP2DHC5MG106068 (the VIN lens).

Try it — sandbox: every call answers a deterministic, provenance-labeled simulated payload ({ environment, simulated } in the body). Force any documented outcome with the magic triggers. Going live is a connect, never a ballot: submit the credential at integrates.vin (dealer systems) or connects.vin (consumer accounts) — submissions enter the activation queue and rank live rollout.

Emits — Mandate.activated@1.

the SDK — mandate.activate
import { mandate } from 'apis.vin'

// the gate law is in the type system: Answer<T> = Ok | Empty | Blocked | Offer
const answer = await mandate.activate()
POST /mandates/activate
curl -X POST https://apis.vin/mandates/activate \
  -H 'content-type: application/json' \
  -d '{}'

More actions

cap

mandate.cap · POST /mandates/cap · gate key · sandbox · answers MandateCap@1

No input — this capability takes no request body.

Door — aggregator.vin serves this noun on its two routes: / (the landing) · /5XYP2DHC5MG106068 (the VIN lens).

Try it — sandbox: every call answers a deterministic, provenance-labeled simulated payload ({ environment, simulated } in the body). Force any documented outcome with the magic triggers. Going live is a connect, never a ballot: submit the credential at integrates.vin (dealer systems) or connects.vin (consumer accounts) — submissions enter the activation queue and rank live rollout.

Emits — Mandate.capped@1.

the SDK — mandate.cap
import { mandate } from 'apis.vin'

// the gate law is in the type system: Answer<T> = Ok | Empty | Blocked | Offer
const answer = await mandate.cap()
POST /mandates/cap
curl -X POST https://apis.vin/mandates/cap \
  -H 'content-type: application/json' \
  -d '{}'

Receipt — the sandbox wire answered the request above with this exact body at build time. Captured by the receipts runner (timestamped, provenance in the payload), never authored; it re-executes only when this descriptor changes.

receipt · executed 2026-08-16T14:50:09.923Z · HTTP 200
{
  "type": "OK",
  "answers": "MandateCap@1",
  "value": {
    "mandate": "mandate_e527fe9d",
    "subject": "agent_vinsandbox0001",
    "scope": "act:settle",
    "status": "active",
    "ceiling": {
      "amount": "250000",
      "currency": "USD"
    },
    "perAction": {
      "amount": "50000",
      "currency": "USD"
    }
  },
  "evidence": {
    "mandate": "mandate_e527fe9d",
    "subject": "agent_vinsandbox0001",
    "scope": "act:settle",
    "status": "active",
    "ceiling": {
      "amount": "250000",
      "currency": "USD"
    },
    "perAction": {
      "amount": "50000",
      "currency": "USD"
    }
  },
  "provenance": {
    "simulated": true,
    "environment": "sandbox",
    "source": "governance-sandbox"
  },
  "events": [],
  "meter": {
    "charged": "0.00",
    "posted": false
  }
}

grant

mandate.grant · POST /mandates/grant · gate human · sandbox · answers Mandate@1

No input — this capability takes no request body.

The gate is a 403 NEEDS_HUMAN — the human verb authorize (credential: principal) · demand side, routed to a named, staffed, priced terminus with a poll rail. Never a dead end. Price: not posted — see /pricing.

Door — mandate.vin serves this noun on its two routes: / (the landing) · /5XYP2DHC5MG106068 (the VIN lens).

Try it — sandbox: every call answers a deterministic, provenance-labeled simulated payload ({ environment, simulated } in the body). Force any documented outcome with the magic triggers. Going live is a connect, never a ballot: submit the credential at integrates.vin (dealer systems) or connects.vin (consumer accounts) — submissions enter the activation queue and rank live rollout.

Emits — Mandate.granted@1.

the SDK — mandate.grant
import { mandate } from 'apis.vin'

// the gate law is in the type system: Answer<T> = Ok | Empty | Blocked | Offer
const answer = await mandate.grant()
POST /mandates/grant
curl -X POST https://apis.vin/mandates/grant \
  -H 'content-type: application/json' \
  -d '{}'

Receipt — the sandbox wire answered the request above with this exact body at build time. Captured by the receipts runner (timestamped, provenance in the payload), never authored; it re-executes only when this descriptor changes.

receipt · executed 2026-08-16T14:50:09.923Z · HTTP 200
{
  "type": "OK",
  "answers": "Mandate@1",
  "value": {
    "principalId": "PRINCIPAL-01",
    "agentId": "AGENT-GRANTED-01",
    "action": "sign",
    "outcome": "granted",
    "grantedScopes": [
      "sign"
    ],
    "capCents": null,
    "remainingCents": null,
    "provenance": {
      "environment": "sandbox",
      "simulated": true,
      "provider": "mandate-rail-sandbox"
    }
  },
  "evidence": {
    "principalId": "PRINCIPAL-01",
    "agentId": "AGENT-GRANTED-01",
    "action": "sign",
    "outcome": "granted",
    "grantedScopes": [
      "sign"
    ],
    "capCents": null,
    "remainingCents": null,
    "provenance": {
      "environment": "sandbox",
      "simulated": true,
      "provider": "mandate-rail-sandbox"
    }
  },
  "provenance": {
    "simulated": true,
    "environment": "sandbox",
    "source": "mandate-rail-sandbox"
  },
  "events": [],
  "meter": {
    "charged": "0.00",
    "posted": false
  }
}

narrow

mandate.narrow · POST /mandates/narrow · gate key · sandbox · answers MandateNarrow@1

No input — this capability takes no request body.

Door — mandate.vin serves this noun on its two routes: / (the landing) · /5XYP2DHC5MG106068 (the VIN lens).

Try it — sandbox: every call answers a deterministic, provenance-labeled simulated payload ({ environment, simulated } in the body). Force any documented outcome with the magic triggers. Going live is a connect, never a ballot: submit the credential at integrates.vin (dealer systems) or connects.vin (consumer accounts) — submissions enter the activation queue and rank live rollout.

Emits — Mandate.granted@1 · Mandate.narrowed@1 · Mandate.subDelegated@1.

the SDK — mandate.narrow
import { mandate } from 'apis.vin'

// the gate law is in the type system: Answer<T> = Ok | Empty | Blocked | Offer
const answer = await mandate.narrow()
POST /mandates/narrow
curl -X POST https://apis.vin/mandates/narrow \
  -H 'content-type: application/json' \
  -d '{}'

Receipt — the sandbox wire answered the request above with this exact body at build time. Captured by the receipts runner (timestamped, provenance in the payload), never authored; it re-executes only when this descriptor changes.

receipt · executed 2026-08-16T14:50:09.923Z · HTTP 200
{
  "type": "OK",
  "answers": "MandateNarrow@1",
  "value": {
    "mandate": "mandate_da1fd924",
    "priorScope": "act:*",
    "scope": "act:settle",
    "ceiling": {
      "amount": "100000",
      "currency": "USD"
    },
    "status": "active"
  },
  "evidence": {
    "mandate": "mandate_da1fd924",
    "priorScope": "act:*",
    "scope": "act:settle",
    "ceiling": {
      "amount": "100000",
      "currency": "USD"
    },
    "status": "active"
  },
  "provenance": {
    "simulated": true,
    "environment": "sandbox",
    "source": "governance-sandbox"
  },
  "events": [],
  "meter": {
    "charged": "0.00",
    "posted": false
  }
}

present

mandate.present · POST /mandates/present · gate key · sandbox · answers MandatePresentation@1

No input — this capability takes no request body.

Door — mandate.vin serves this noun on its two routes: / (the landing) · /5XYP2DHC5MG106068 (the VIN lens).

Try it — sandbox: every call answers a deterministic, provenance-labeled simulated payload ({ environment, simulated } in the body). Force any documented outcome with the magic triggers. Going live is a connect, never a ballot: submit the credential at integrates.vin (dealer systems) or connects.vin (consumer accounts) — submissions enter the activation queue and rank live rollout.

Emits — Mandate.presented@1.

the SDK — mandate.present
import { mandate } from 'apis.vin'

// the gate law is in the type system: Answer<T> = Ok | Empty | Blocked | Offer
const answer = await mandate.present()
POST /mandates/present
curl -X POST https://apis.vin/mandates/present \
  -H 'content-type: application/json' \
  -d '{}'

Receipt — the sandbox wire answered the request above with this exact body at build time. Captured by the receipts runner (timestamped, provenance in the payload), never authored; it re-executes only when this descriptor changes.

receipt · executed 2026-08-16T14:50:09.923Z · HTTP 200
{
  "type": "OK",
  "answers": "MandatePresentation@1",
  "value": {
    "mandate": "mandate_da1fd924",
    "presentation": "mandatepresentation_063825ae",
    "valid": true,
    "scope": "act:settle",
    "presentedAt": "2026-08-10T00:00:00.000Z"
  },
  "evidence": {
    "mandate": "mandate_da1fd924",
    "presentation": "mandatepresentation_063825ae",
    "valid": true,
    "scope": "act:settle",
    "presentedAt": "2026-08-10T00:00:00.000Z"
  },
  "provenance": {
    "simulated": true,
    "environment": "sandbox",
    "source": "governance-sandbox"
  },
  "events": [],
  "meter": {
    "charged": "0.00",
    "posted": false
  }
}

Data model

The record shape behind this noun — one entity, each property an evidence field. See the whole estate model on the data model page.

Mandate

Schema

PropertyTypeNotes
mandateIdidmnd_
principalIdref→Party—
granteeIdref→Partyagt_
ceilingdecimal—
perActiondecimal—
spentToDatedecimal—
expiresAtdatetime—
scopeCapabilityName[]—
tripwiresEventName[]—
statusMandateFSM—
parentMandateIdref→Mandatesub-delegation, narrows only

Relationships

FromToCardinalityAs
partymandate1:0..*grants (principal)
partymandate1:0..*holds (grantee)
mandatemandate1:0..1sub-delegates (narrows only)
mandatemandate1:0..1sub-delegates (narrows only)
ledgermandate*:0..1authority
ledgermandate*:1capability→mandate/connection provenance (which credential ran this leaf)

Modeled

The noun drawn out — its record shape, its lifecycle, and how it is exercised end to end. 6 diagrams, rendered from the estate model.

Mandate · Class model

Mandate · State machine

Mandate · Sequence

Mandate · Class model

Mandate · State machine

Mandate · Sequence

Generated from the catalog. Every capability, answer, gate, and entity on this page is a rendered descriptor — it cannot drift from the wire.

invoice

The invoice noun — identity, lifecycle, events, and every capability as an anchored section: 10 capabilities, 0 live, 10 sandbox, 0 declared.

payment

The payment noun — identity, lifecycle, events, and every capability as an anchored section: 18 capabilities, 0 live, 18 sandbox, 0 declared.

On this page

Identity
Lifecycle
Events
Discover & read
verify
Authorize & resolve
revoke
reauthorize
Lifecycle & state
activate
More actions
cap
grant
narrow
present
Data model
Mandate
Modeled