Skip to main content
A verifier is anyone an agent presents a Stamped Mandate to: a merchant, a service, a site, or another agent. A mandate identifier on its own proves nothing, and a mandate can be revoked at any moment after it was signed. So a verifier checks it before acting on it.

​
How an agent presents a mandate

An agent presents a Stamped Mandate to a site as a token issued by Sumvin, in the x-sumvin-pint-token request header:
The token is addressed to the site’s hostname. The site checks it on its own server, offline, against Sumvin’s published keys, and accepts only a token addressed to itself. How to run that check is in the verifier quickstart. The site then asks Sumvin whether the mandate still stands, with the token’s identifier and no account; that also catches a mandate revoked since it was signed. See the website token check. A mandate can also be looked up by its identifier, such as sr:us:pint:3f9c2a7e5b1d4c8e9a6f0b2d7e4c1a58. How to run that check is in Check a mandate.

​
What the check answers

​
Stands, not status

A mandate stands only when all of these are true:
  • its status is active;
  • it has not passed its expiry;
  • every larger mandate it was narrowed from is itself still intact.
A mandate can read active while a larger mandate above it has been revoked. It no longer permits anything. Only stands accounts for that.

​
Ceiling

The ceiling is stated the way a person reads it: 12.50, never 1250. If the ceiling can no longer be read back out of the mandate’s scopes, it is reported as missing. Treat a missing ceiling as unverifiable, never as unlimited.

​
States

Only active can permit anything, and none of the last three ever becomes active again.

​
What a verifier never learns

  • Who the person is. No name, email or other contact details.
  • Anything above the mandate it was shown, from this check. The narrowing depth is a count, not a list: the larger mandates each permit more than the one presented, so this check never returns their identifiers. A narrowed mandate’s own token names them, and their signed requests are served only to a party that also holds the narrowed mandate’s signed request. See Verify a narrowed mandate.
Checking a mandate grants nothing and changes nothing. It is a read.

​
Next

Check a mandate

Run the check.

Examples

What a verifier sees for each use case.