Skip to main content
POST
Create delegated session

Authorizations

X-Monaco-Signature
string
header
required

Ed25519 session-key request signing. Every authenticated request carries three headers: X-Monaco-PublicKey (64-char lowercase-hex session public key), X-Monaco-Timestamp (Unix milliseconds, within 30s of server time), and X-Monaco-Signature (hex ed25519 signature). The signature is over METHOD\npath?query\ntimestamp_ms\nSHA256_hex(body), where the body hash is the SHA-256 of the empty byte string when there is no body. Obtain the session keypair from POST /api/v1/auth/challenge followed by POST /api/v1/auth/verify.

Body

application/json
ownerUserId
string<uuid> | null

Owner account UUID to act on behalf of (discover via ListDelegatedAgentOwners)

Example:

"123e4567-e89b-12d3-a456-426614174000"

sessionPublicKey
string | null

Lowercase-hex (64 chars) ed25519 public key the agent generated for this delegated session. Subsequent requests acting on the owner's behalf are signed with the matching private key.

Response

OK

expiresAt
string | null

Session expiry as a Unix timestamp (seconds)

Example:

"1735689599"

delegationId
string<uuid> | null

Delegation UUID for the active (owner, agent) pair

ownerUserId
string<uuid> | null

Owner account UUID the session acts on behalf of

agentAddress
string | null

Agent wallet address recorded on the session for policy enforcement