Submit the owner's signature and persist the grant

Recomputes the grant from the echoed prepare fields, verifies the signature recovers to the authenticated owner, re-checks the entity allocation inside the write, and stores the policy as pending. The install itself rides the first workflow operation on this wallet — nothing reaches the chain here.

Request body

chainIdinteger required

Numeric chain ID (e.g. 11155111 for Sepolia, 8453 for Base). On chain-aware trigger/node configs this is required and must be a configured chain; on query/filter params it is optional.

policyIdstring required

ULID identifier (26-char Crockford base32).

entityIdinteger required

deadlineinteger required

validUntilinteger required

The ABSOLUTE expiry from prepare. It is baked into the signed calldata; recomputing it would change the digest.

agentLabelstring required

justificationstring

signaturestring required

The owner's 65-byte signature over the prepared digest.

Example request

{
  "chainId": 11155111,
  "policyId": "01JG2FE5MDVKBPHEG0PEYSDKAC",
  "allowedActions": [
    {
      "target": "0x82F2Dd9a552a69f2ceD7Ff2D05c43aB8430158FB"
    }
  ],
  "erc20SpendCap": {
    "token": "0x82F2Dd9a552a69f2ceD7Ff2D05c43aB8430158FB",
    "amount": "500000000"
  }
}

Response

Grant stored; the gateway may now execute within it.

idstring required

ULID identifier (26-char Crockford base32).

runnerstring required

Lowercase or checksummed hex EOA / contract address.

chainIdinteger required

Numeric chain ID (e.g. 11155111 for Sepolia, 8453 for Base). On chain-aware trigger/node configs this is required and must be a configured chain; on query/filter params it is optional.

status'pending' | 'active' | 'revoked' required

pending = signed and stored, install not yet on-chain (revocable for free). active = install applied. revoked = grants nothing.