AP2
Verify an AP2 mandate
Paste a Trustvice AP2 mandate (SD-JWT VC) plus the action id and presenting agent DID. No Trustvice account required. A failed check is never shown as a pass. Revocation lookup is fail-closed.
Required. The verifier will not invent an action. A mandate that does not allow this action is an honest fail, not a pass.
Required. Must equal the mandate's granted agent. A mismatch is subject-key-binding failed, not a pass.
What this proves
- The SD-JWT verifies under the issuer's assertion key, the presenter is the granted agent, the action is in scope, and the mandate is inside its validity window.
- Revocation was looked up fail-closed against the live BitstringStatusList store. A revoked or unreadable status is a deny.
- Anyone can repeat this check with no Trustvice account.
What this does not prove
- A live spend or invocation ledger beyond the numbers in the paste. Empty optional cap fields mean this check used zero prior usage.
- The offline revocation-bit tool. That page only tests one status-list bit in your browser; this closer is the full mandate verifier.
- Anything about Privacy receipts, C2PA manifests, or Notarian bundles — those are separate public verbs.
Check only the revocation bit in your browser (not a full mandate verify)