curl --request POST \
--url https://staging.apimonaco.xyz/api/v1/delegated-agents/sessions \
--header 'Content-Type: application/json' \
--header 'X-Monaco-Signature: <api-key>' \
--data '
{
"ownerUserId": "123e4567-e89b-12d3-a456-426614174000",
"sessionPublicKey": "<string>"
}
'import requests
url = "https://staging.apimonaco.xyz/api/v1/delegated-agents/sessions"
payload = {
"ownerUserId": "123e4567-e89b-12d3-a456-426614174000",
"sessionPublicKey": "<string>"
}
headers = {
"X-Monaco-Signature": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'X-Monaco-Signature': '<api-key>', 'Content-Type': 'application/json'},
body: JSON.stringify({
ownerUserId: '123e4567-e89b-12d3-a456-426614174000',
sessionPublicKey: '<string>'
})
};
fetch('https://staging.apimonaco.xyz/api/v1/delegated-agents/sessions', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://staging.apimonaco.xyz/api/v1/delegated-agents/sessions",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'ownerUserId' => '123e4567-e89b-12d3-a456-426614174000',
'sessionPublicKey' => '<string>'
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"X-Monaco-Signature: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://staging.apimonaco.xyz/api/v1/delegated-agents/sessions"
payload := strings.NewReader("{\n \"ownerUserId\": \"123e4567-e89b-12d3-a456-426614174000\",\n \"sessionPublicKey\": \"<string>\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("X-Monaco-Signature", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://staging.apimonaco.xyz/api/v1/delegated-agents/sessions")
.header("X-Monaco-Signature", "<api-key>")
.header("Content-Type", "application/json")
.body("{\n \"ownerUserId\": \"123e4567-e89b-12d3-a456-426614174000\",\n \"sessionPublicKey\": \"<string>\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://staging.apimonaco.xyz/api/v1/delegated-agents/sessions")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["X-Monaco-Signature"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"ownerUserId\": \"123e4567-e89b-12d3-a456-426614174000\",\n \"sessionPublicKey\": \"<string>\"\n}"
response = http.request(request)
puts response.read_body{
"expiresAt": "1735689599",
"delegationId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"ownerUserId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"agentAddress": "<string>"
}Create delegated session
Exchange the agent’s session for an owner-scoped delegated session.
The agent authenticates with its own session key, then calls this with the
owner_user_id it wants to act for (discover it via
ListDelegatedAgentOwners) and a freshly generated session public key.
The new session acts as the owner but records the agent’s address for
policy enforcement. Requires an active delegation for the (owner, agent)
pair.
curl --request POST \
--url https://staging.apimonaco.xyz/api/v1/delegated-agents/sessions \
--header 'Content-Type: application/json' \
--header 'X-Monaco-Signature: <api-key>' \
--data '
{
"ownerUserId": "123e4567-e89b-12d3-a456-426614174000",
"sessionPublicKey": "<string>"
}
'import requests
url = "https://staging.apimonaco.xyz/api/v1/delegated-agents/sessions"
payload = {
"ownerUserId": "123e4567-e89b-12d3-a456-426614174000",
"sessionPublicKey": "<string>"
}
headers = {
"X-Monaco-Signature": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'X-Monaco-Signature': '<api-key>', 'Content-Type': 'application/json'},
body: JSON.stringify({
ownerUserId: '123e4567-e89b-12d3-a456-426614174000',
sessionPublicKey: '<string>'
})
};
fetch('https://staging.apimonaco.xyz/api/v1/delegated-agents/sessions', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://staging.apimonaco.xyz/api/v1/delegated-agents/sessions",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'ownerUserId' => '123e4567-e89b-12d3-a456-426614174000',
'sessionPublicKey' => '<string>'
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"X-Monaco-Signature: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://staging.apimonaco.xyz/api/v1/delegated-agents/sessions"
payload := strings.NewReader("{\n \"ownerUserId\": \"123e4567-e89b-12d3-a456-426614174000\",\n \"sessionPublicKey\": \"<string>\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("X-Monaco-Signature", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://staging.apimonaco.xyz/api/v1/delegated-agents/sessions")
.header("X-Monaco-Signature", "<api-key>")
.header("Content-Type", "application/json")
.body("{\n \"ownerUserId\": \"123e4567-e89b-12d3-a456-426614174000\",\n \"sessionPublicKey\": \"<string>\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://staging.apimonaco.xyz/api/v1/delegated-agents/sessions")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["X-Monaco-Signature"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"ownerUserId\": \"123e4567-e89b-12d3-a456-426614174000\",\n \"sessionPublicKey\": \"<string>\"\n}"
response = http.request(request)
puts response.read_body{
"expiresAt": "1735689599",
"delegationId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"ownerUserId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"agentAddress": "<string>"
}Authorizations
Ed25519 session-key request signing. Every authenticated request carries three headers: X-Monaco-PublicKey (64-char lowercase-hex session public key), X-Monaco-Timestamp (Unix milliseconds, within 30s of server time), and X-Monaco-Signature (hex ed25519 signature). The signature is over METHOD\npath?query\ntimestamp_ms\nSHA256_hex(body), where the body hash is the SHA-256 of the empty byte string when there is no body. Obtain the session keypair from POST /api/v1/auth/challenge followed by POST /api/v1/auth/verify.
Body
Owner account UUID to act on behalf of (discover via ListDelegatedAgentOwners)
"123e4567-e89b-12d3-a456-426614174000"
Lowercase-hex (64 chars) ed25519 public key the agent generated for this delegated session. Subsequent requests acting on the owner's behalf are signed with the matching private key.
Response
OK
Session expiry as a Unix timestamp (seconds)
"1735689599"
Delegation UUID for the active (owner, agent) pair
Owner account UUID the session acts on behalf of
Agent wallet address recorded on the session for policy enforcement
Was this page helpful?

