Get startedMandates
Mandates
The limits Exchain checks before it co-signs, on every chain.
A mandate is the set of limits Exchain checks every payment against, using the wallet's history. You set it at registration, and it does not change. The same mandate model applies on every chain; only the seller rules differ.
Parameters
All six are required. Amounts are decimal strings in the asset's minor units; burstPerMinute is an integer. Limits are in the asset's own units, with no USD conversion.
| Parameter | Rule | Window | Refusal code |
|---|---|---|---|
perTxCap | Largest single payment | 60 s | per_tx_cap |
burstPerMinute | Number of payments | 60 s | velocity_burst |
daily | Total outflow | Rolling 24 h | daily_outflow |
perSeller | Total per counterparty | Rolling 24 h | per_seller_cap |
perAgent | Total per agent: the intent's agentIdentifier on Cardano, the registered agent address on EVM chains | Rolling 24 h | per_agent_cap |
envelope | Total over the wallet's life | 3,650 days | envelope_exhausted |
{
"constitution": {
"params": {
"perTxCap": "50000000",
"daily": "1000000000",
"perSeller": "200000000",
"perAgent": "500000000",
"envelope": "50000000000",
"burstPerMinute": 10
}
}
}With a 6-decimal asset, 50000000 = 50 units (50 tADA or 50 USDC). Read a wallet's mandate with GET /v1/wallets/{walletId}/mandate, and what is left of it with GET /v1/wallets/{walletId}/allowance.
A wallet may govern several assets, each with its own mandate: up to 16 on Cardano, and up to 16 of one chain's listed assets on an EVM Safe. Each payment counts only against the mandate of its own asset. See Several assets.
Rolling windows
- Windows slide; they do not reset on a calendar day.
- A
409window refusal carriesretryAfterSec.daily_outflowandper_agent_capalso carrywindowResetsAt. windowResetsAtfrees the oldest contribution in the window. That may not be enough for your next payment.- Decision time is Exchain's clock, never
context.submittedAt.
{ "purchaseId": "pur_2", "outputIndex": 1, "verdict": "denied", "denied": "daily_outflow", "reasonEnglish": "<plain-English reason>", "bound": "1000000000", "used": "990000000", "attempted": "19000000", "retryAfterSec": 5400, "windowResetsAt": "2026-11-06T11:30:00Z" }Seller rules
Seller rules are set at registration, next to the mandate.
| Rule | Cardano | EVM chains | Refusal |
|---|---|---|---|
| Allow and deny lists | sellerAllowList, sellerDenyList: sellerVkeyHash:<56 hex> or agent identifiers | sellerAllowList, sellerDenyList: the payee as eip155:<chainId>:0x…, lowercase | counterparty_blocked |
| Registry gate | registryGate: the seller is a live Masumi registry agent | — | registry_gate |
| Price gate | priceGate: no payment above the seller's published price | — | price_above_published |
| Seller binding | — | sellers: an x402 payment must match the seller's signed offer | payee_unpinned, price_above_published, body_mismatch |
| Unsigned sellers | — | unsignedSellers: "refuse", or { "allowUnder" } to cap payments without a signed offer. With seller binding on, every direct payment counts as unsigned | registry_gate |
Details: Seller gates (Cardano) and Seller binding (EVM chains).
Changing a mandate
There is no API to change a mandate. Registering the same wallet again with different limits returns 409 wallet_exists. To change limits, create and register a new wallet.
Two ceilings
The mandate is one of two limits on what an agent can spend. The second holds on chain, without Exchain.
| Mandate | Cardano on-chain ceiling | EVM chains | |
|---|---|---|---|
| Set by | Registration with Exchain | The owner, in the wallet datum | The owner, by funding the Safe |
| Enforced by | Exchain, before it co-signs | The Cardano contract | The chain: a Safe cannot pay more than it holds |
| Limits | Six limits plus seller rules | One limit per asset per period, plus a minimum balance | The Safe balance, plus any Permit2 approval and treasury allowance |
| Protects against | A misbehaving agent | A misbehaving agent and a compromised Exchain | A misbehaving agent and a compromised Exchain |
On Cardano, set the on-chain period limit at or above the mandate's daily. On EVM chains, keep in the Safe no more than the agent may spend.
GET /v1/wallets/{walletId}/bound returns both, signed and read on chain at one block or slot: honest is what the mandate still allows, and worstCase is what could leave if the agent key and every Exchain key were stolen.