AP2 Mandate Authorization Gate

Use this endpoint when an agent needs to programmatically verify an AP2 cryptographically signed payment mandate before committing to settlement. It is the right choice when you need explicit gate-by-gate rejection reasons rather than a simple binary check, when delegation chains are involved (multi-agent payment hierarchies), or when you need to confirm nonce uniqueness to prevent replay attacks. Prefer this over generic signature validators because it is purpose-built for AP2 mandate semantics including scope-vs-amount comparison, session freshness, and agent authority chain validation.

• Signature invalid — mandate was tampered with or signed with wrong key
• Nonce already seen — replay attack detected, returns FAIL with nonce rejection reason
• Mandate scope insufficient for requested amount — amount exceeds authorized limit
• Mandate expired or session no longer fresh — timestamp gate fails
• Delegation chain too deep — exceeds allowed depth, parent authority unverifiable
• Parent agent lacks authority to issue mandate — chain of trust broken
• Malformed input — missing required fields returns schema validation error
• Payment required but not provided — returns 402 if not a meta=1 free metadata call