§ 08 · Under The Hood
Payload trace
Full payload
The structured record for this walk-through.
A single JSON document describing every step. Open your downstream tooling
against the real endpoints and you will receive documents with the same
shape — hash-chained, signed, and repeatable.
{
"delegation_id": "d00f27a4-9c1a-41d3-b33e-2f6c4df5e2b1",
"credential_kid": "rsa-2026-04-rotation-01",
"principal_email": "alex@example.com",
"relying_party_name": "Demo Merchant",
"steps": [
{
"index": 1,
"slug": "grant",
"status": "ok",
"title": "Grant weekly cap",
"subtitle": "Principal approves a scoped \u00a325/week delegation.",
"at": "2026-05-14T09:43:13.312048+00:00",
"description": "The wallet holder taps Approve on a structured grant card. Paphwey writes an AgentDelegation and packs a Verifiable Credential JWT. The credential carries the exact caps that will be re-checked on every downstream challenge.",
"payload": {
"delegation_id": "d00f27a4-9c1a-41d3-b33e-2f6c4df5e2b1",
"principal": "alex@example.com",
"provider": "openai",
"agent_id": "assistant-demo",
"allowed_scopes": [
"payments:approve"
],
"spend_cap": {
"amount_minor": 2500,
"currency": "GBP",
"window": "weekly"
},
"credential_kid": "rsa-2026-04-rotation-01",
"credential_jwt_preview": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6InJzYS0yMDI2LTA0LXJvdGF0aW9uLTAxIn0.eyJzdWIiOiJwYXBod2V5OmRlbGVnYXRpb246ZDAwZjI3YTQiLCJ2YyI6eyJAY29udGV4dCI6WyJodHRwczovL3d3dy53My5vcmcvbnMvY3JlZGVudGlhbHMvdjIiXSwidHlwZSI6WyJWZXJpZmlhYmxlQ3JlZGVudGlhbCIsIlBhcGh3ZXlEZWxlZ2F0aW9uQ3JlZGVudGlhbCJdfX0.T3RLPNDiO4..."
}
},
{
"index": 2,
"slug": "buy-pass",
"status": "ok",
"title": "Buy \u00a315 passes",
"subtitle": "Challenge approved inside cap.",
"at": "2026-05-14T09:48:13.312048+00:00",
"description": "The agent presents a \u00a315.00 purchase. Policy evaluation checks the delegation cap first, then the relying-party policy. Both pass. An attestation is issued and the RP is told why.",
"payload": {
"challenge_type": "PAYMENT_STEPUP_REQUIRED",
"amount_minor": 1500,
"currency": "GBP",
"decision": "APPROVED",
"cap_check": {
"spent_this_window_minor": 1500,
"remaining_minor": 1000,
"currency": "GBP"
}
}
},
{
"index": 3,
"slug": "buy-denied",
"status": "denied",
"title": "Buy \u00a340 denied",
"subtitle": "SPEND_CAP_EXCEEDED \u2014 the cap blocks the action before the wallet is ever shown.",
"at": "2026-05-14T09:51:13.312048+00:00",
"description": "The agent attempts a \u00a340.00 purchase. Cap evaluation sees the request exceeds the weekly allowance and stops the flow with a structured reason. Nothing reaches the relying party.",
"payload": {
"challenge_type": "PAYMENT_STEPUP_REQUIRED",
"amount_minor": 4000,
"currency": "GBP",
"decision": "DENIED",
"reasons": [
"SPEND_CAP_EXCEEDED"
],
"cap_check": {
"requested_minor": 4000,
"remaining_minor": 1000,
"currency": "GBP"
}
}
},
{
"index": 4,
"slug": "pause",
"status": "paused",
"title": "Pause delegation",
"subtitle": "Mid-lifecycle control \u2014 the user hits pause from the wallet.",
"at": "2026-05-14T09:54:13.312048+00:00",
"description": "Pause is a soft halt. The delegation row stamps paused_at and the status endpoint begins returning status=\"paused\". Unpause later restores the same credential without reissuing.",
"payload": {
"delegation_id": "d00f27a4-9c1a-41d3-b33e-2f6c4df5e2b1",
"status": "paused",
"paused_at": "2026-05-14T09:54:13.312048+00:00",
"unpause_available": true
}
},
{
"index": 5,
"slug": "revoke",
"status": "revoked",
"title": "Revoke delegation",
"subtitle": "Hard stop \u2014 the credential is invalidated and surfaced on the revocation list.",
"at": "2026-05-14T09:56:13.312048+00:00",
"description": "Revocation stamps revoked_at and invalidates the credential. The signed GET /api/v1/delegations/revocations.json snapshot now lists this delegation. Any relying party can self-serve the check.",
"payload": {
"delegation_id": "d00f27a4-9c1a-41d3-b33e-2f6c4df5e2b1",
"status": "revoked",
"revoked_at": "2026-05-14T09:56:13.312048+00:00",
"status_endpoint": "/api/v1/delegations/status/d00f27a4-9c1a-41d3-b33e-2f6c4df5e2b1",
"revocations_snapshot": "/api/v1/delegations/revocations.json"
}
},
{
"index": 6,
"slug": "anchor",
"status": "anchored",
"title": "Verify audit anchor",
"subtitle": "All five steps land on the signed daily Merkle root.",
"at": "2026-05-14T09:57:13.312048+00:00",
"description": "Every audit event above was hash-chained at write time. The daily anchor Merkle-roots the day's chain and signs it with the active key. External auditors poll the anchor endpoint; any tampering breaks both the chain and the root.",
"payload": {
"date": "2026-05-14",
"merkle_root": "2b9e1c9f3a0d7e5b6f8c9d5a74e1b3c6d08f2a4b6c7d8e9f0a1b2c3d4e5f6071",
"event_count": 17,
"kid": "rsa-2026-04-rotation-01",
"signature_preview": "MEUCIQDh2V7r...truncated...dK8c=",
"published_at": "2026-05-14T09:57:13.312048+00:00",
"endpoint": "/.well-known/paphwey-audit-anchor"
}
}
]
}
