{"uid":"cap_13VjuEnURTXvBAu0Uc20f","slug":"goldkey-guard-network-authorization-endpoint-dc829961","name":"GoldKey Guard — Network Authorization Endpoint","description":"GoldKey Guard is an execution-path authorization layer for AI agents: operator-signed policy, a customer-controlled local enforcer, and signed receipts before MCP, HTTPS, or supported EVM calls run.","url":"https://goldkey-edge-storefront.noah-ing.workers.dev/v1/guard/paygo/authorize/network","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"call":{"oneOf":[{"type":"object","required":["kind","connector_id","tool","input_schema_sha256","arguments"],"properties":{"kind":{"const":"mcp_tool"},"tool":{"type":"string","pattern":"^[A-Za-z0-9._:-]{1,256}$"},"arguments":{},"connector_id":{"type":"string","pattern":"^[A-Za-z0-9._:-]{1,128}$"},"input_schema_sha256":{"type":"string","pattern":"^[0-9a-f]{64}$"}},"additionalProperties":false},{"type":"object","required":["kind","connector_id","operation_id"],"properties":{"body":{},"kind":{"const":"https"},"query":{"type":"object","maxProperties":100},"connector_id":{"type":"string","pattern":"^[A-Za-z0-9._:-]{1,128}$"},"operation_id":{"type":"string","pattern":"^[A-Za-z0-9._:-]{1,128}$"}},"additionalProperties":false}]},"schema":{"const":"goldkey.guard-request.v1"},"issued_at":{"type":"string","format":"date-time"},"signature":{"type":"string","pattern":"^[A-Za-z0-9_-]{86}$"},"idempotency_key":{"type":"string","pattern":"^[A-Za-z0-9._:-]{8,128}$"},"installation_id":{"type":"string","pattern":"^gki_[A-Za-z0-9_-]{43}$"}}},"responseSchema":{"type":"json","example":{"schema":"goldkey.guard-authorization-envelope.v1","receipt":{"decision":"ALLOW","reason_codes":[]},"evidence":{"schema":"goldkey.guard-evidence.v1","decision":"ALLOW","reason_codes":[]},"signature":"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA","receipt_sha256":"0000000000000000000000000000000000000000000000000000000000000000"}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.05","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.05/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.05","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.05","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_oJ85aRmSni53EOY1hbRa6","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.05","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Issues cryptographically signed authorization receipts for AI agent tool calls (MCP tools or HTTPS operations) before they are executed, enforcing operator-signed policy and returning an ALLOW/REVIEW/BLOCK decision.","exampleAgentPrompt":"Before my AI agent calls the 'send_email' MCP tool on connector 'email-connector-01', I need GoldKey Guard to authorize that call and return a signed receipt — use installation ID gki_abc123... and include the idempotency key 'req-20240601-001'.","exampleUseCases":[{"title":"Pre-execution MCP tool call gating","prompt":"Before my agent runs the 'web_search' tool on MCP connector 'search-connector-01', run it through GoldKey Guard with my installation ID gki_xyz789... and idempotency key 'search-req-001' — I need a signed ALLOW receipt before it can proceed."},{"title":"HTTPS API call authorization for agent","prompt":"My agent is about to call the 'create_payment' operation on HTTPS connector 'payments-api-v2' — please get a GoldKey Guard authorization for that call using installation ID gki_pay456... and idempotency key 'pay-req-20240601' so we have a signed receipt on file."},{"title":"Policy enforcement before sensitive data access","prompt":"Gate my agent's call to the 'read_customer_records' MCP tool on connector 'crm-connector-prod' using GoldKey Guard — use installation gki_crm999... with idempotency key 'crm-read-001' and give me back the decision and signed receipt before anything runs."}],"resultDescription":"Returns a signed goldkey.guard-authorization-envelope.v1 JSON object containing: the authorization decision (ALLOW, REVIEW, or BLOCK), reason_codes explaining the decision, a cryptographic signature over the receipt, the SHA-256 hash of the receipt, and a signed evidence object. This receipt must be presented to execute the gated tool call.","failureModes":["Invalid or expired installation_id returns an authorization denial","Signature verification failure on the request body returns rejection","Malformed idempotency_key pattern causes schema validation error","Unsupported call kind or missing required call fields returns 400","Policy configured by operator blocks the call, returning BLOCK decision with reason_codes","Replay of an already-used idempotency_key may return cached result or rejection","Missing or incorrect input_schema_sha256 for mcp_tool calls causes rejection"],"whenToPreferThis":"Use this endpoint when you need a cryptographically verifiable, operator-policy-backed authorization receipt before an AI agent executes an MCP tool call or HTTPS operation. It is the right choice when auditability, non-repudiation, and policy enforcement are required prior to agentic execution — especially in regulated, high-stakes, or multi-operator environments where a bare preflight check is insufficient and you need a signed artifact proving authorization was granted.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-14T06:32:02.279Z","isFirstParty":false}