> For the complete documentation index, see [llms.txt](https://docs.securepass.me/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.securepass.me/documentation/api-reference/rest-api-support/agent-authorisation-api.md).

# Agent authorisation API

A non-human caller — a script, a workload, an AI agent — uses this endpoint to ask whether it may perform an action.

```
POST /api/v1/authorize
{
  "spiffeId": "spiffe://securepass/payment-processor-agent",
  "requestedAction": "invoice:Read",
  "tenantId": "1"
}
```

| Field             | What it carries                                                                   |
| ----------------- | --------------------------------------------------------------------------------- |
| `spiffeId`        | The agent's identity, formed from its trust domain and agent ID                   |
| `requestedAction` | The action being attempted, matching a permission defined in the service's policy |
| `tenantId`        | The tenant the request belongs to                                                 |

SECUREpass evaluates the agent's identity, the requested action and the tenant against the policies defined for the Agentic Service, and answers allow or deny. The calling resource enforces that answer — SECUREpass decides, it does not block.

A request that cannot be resolved to a decision, such as a malformed call or an unrecognised agent, is denied. Every outcome is recorded, including the indeterminate ones, and is visible under **Agentic Identity → Agent Logs**.

`requestedAction` has to match a permission name exactly as it was defined on the Agentic Service's policy. A mismatch in spelling or case is denied the same way an unauthorised action is, so the two failures look identical from outside — check the permission names first when an agent is being refused unexpectedly.

Registering the agents and services this endpoint evaluates against is covered in *Agentic Identity*.