Execution Intents
Verify an Execution Intent's signature
Checks an Execution Intent’s hash and signature.
POST
/
execution-intents
/
verify
cURL
# The intent, as returned in .intent by GET /execution-intents/<businessTransactionId>:
curl -X POST https://parmana-api-real.vercel.app/execution-intents/verify \
-H "Content-Type: application/json" \
--data @execution-intent.jsonimport { ParmanaClient } from "@parmana/sdk";
const client = new ParmanaClient({
endpoint: "https://parmana-api-real.vercel.app",
apiKey: process.env.PARMANA_API_KEY!,
});
const view = await client.executionIntent(
"5f0c2a7e-3d7b-4d0e-9a55-2f6d8b1c4e90",
);
const valid = await client.verifyExecutionIntent(view.intent);
console.log(valid);import os
from parmana import ParmanaClient
client = ParmanaClient(
endpoint="https://parmana-api-real.vercel.app",
api_key=os.environ["PARMANA_API_KEY"],
)
view = client.execution_intent("5f0c2a7e-3d7b-4d0e-9a55-2f6d8b1c4e90")
valid = client.verify_execution_intent(view.intent)
print(valid)const options = {
method: 'POST',
headers: {'Content-Type': 'application/json'},
body: JSON.stringify({
intentId: 'b41fe9b9-5730-4d34-aab0-4ab63ae69d3b',
businessTransactionId: '4c2eb3b2-3382-4bc2-bf22-2a072e6cf428',
decisionId: '20b4e030-09cd-4447-86fc-b73279d23121',
authorizationId: '5977535b-d887-423d-b422-01ece1fc7bf1',
policyName: 'customer-refund',
policyVersion: '1.0.0',
policyContentHash: '6a2e92fbde0f4c5dc56b4e202bf45ce24c99e565cf3ddaacaa21a11c71b7e1ea',
signalsHash: 'e22a7b9fd6e0a39e28521f9ffb726d6a57499236055fa6ff2caabd2268f4a395',
businessTransactionHash: '9df286daf38c6eba272f47153e0fb3efef5ee61d778f6baecd5a53861763763a',
action: 'paytm:refund',
target: 'DRY-ORDER-1789969223742',
submittedBy: 'sandbox-agent',
grantedCapability: 'paytm:refund',
createdAt: '2026-09-21T05:40:28.434Z',
intentHash: '13922de380518d582c6bb3e88b1d88908e71565f191119f4cadc7de4e30cf5ed',
signature: {
keyId: 'default',
value: 'UhXnkSnm5A3QU4CVrKGbP3FcTWkShnitn86psJprJpqgEBnsXWzDcZ+ktSO0FJek1X+n9DvO3SjR+WvSofS1CA==',
signedAt: '2026-09-21T05:40:28.555Z',
algorithm: 'ed25519'
}
})
};
fetch('https://parmana-api-real.vercel.app/execution-intents/verify', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://parmana-api-real.vercel.app/execution-intents/verify",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'intentId' => 'b41fe9b9-5730-4d34-aab0-4ab63ae69d3b',
'businessTransactionId' => '4c2eb3b2-3382-4bc2-bf22-2a072e6cf428',
'decisionId' => '20b4e030-09cd-4447-86fc-b73279d23121',
'authorizationId' => '5977535b-d887-423d-b422-01ece1fc7bf1',
'policyName' => 'customer-refund',
'policyVersion' => '1.0.0',
'policyContentHash' => '6a2e92fbde0f4c5dc56b4e202bf45ce24c99e565cf3ddaacaa21a11c71b7e1ea',
'signalsHash' => 'e22a7b9fd6e0a39e28521f9ffb726d6a57499236055fa6ff2caabd2268f4a395',
'businessTransactionHash' => '9df286daf38c6eba272f47153e0fb3efef5ee61d778f6baecd5a53861763763a',
'action' => 'paytm:refund',
'target' => 'DRY-ORDER-1789969223742',
'submittedBy' => 'sandbox-agent',
'grantedCapability' => 'paytm:refund',
'createdAt' => '2026-09-21T05:40:28.434Z',
'intentHash' => '13922de380518d582c6bb3e88b1d88908e71565f191119f4cadc7de4e30cf5ed',
'signature' => [
'keyId' => 'default',
'value' => 'UhXnkSnm5A3QU4CVrKGbP3FcTWkShnitn86psJprJpqgEBnsXWzDcZ+ktSO0FJek1X+n9DvO3SjR+WvSofS1CA==',
'signedAt' => '2026-09-21T05:40:28.555Z',
'algorithm' => 'ed25519'
]
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://parmana-api-real.vercel.app/execution-intents/verify"
payload := strings.NewReader("{\n \"intentId\": \"b41fe9b9-5730-4d34-aab0-4ab63ae69d3b\",\n \"businessTransactionId\": \"4c2eb3b2-3382-4bc2-bf22-2a072e6cf428\",\n \"decisionId\": \"20b4e030-09cd-4447-86fc-b73279d23121\",\n \"authorizationId\": \"5977535b-d887-423d-b422-01ece1fc7bf1\",\n \"policyName\": \"customer-refund\",\n \"policyVersion\": \"1.0.0\",\n \"policyContentHash\": \"6a2e92fbde0f4c5dc56b4e202bf45ce24c99e565cf3ddaacaa21a11c71b7e1ea\",\n \"signalsHash\": \"e22a7b9fd6e0a39e28521f9ffb726d6a57499236055fa6ff2caabd2268f4a395\",\n \"businessTransactionHash\": \"9df286daf38c6eba272f47153e0fb3efef5ee61d778f6baecd5a53861763763a\",\n \"action\": \"paytm:refund\",\n \"target\": \"DRY-ORDER-1789969223742\",\n \"submittedBy\": \"sandbox-agent\",\n \"grantedCapability\": \"paytm:refund\",\n \"createdAt\": \"2026-09-21T05:40:28.434Z\",\n \"intentHash\": \"13922de380518d582c6bb3e88b1d88908e71565f191119f4cadc7de4e30cf5ed\",\n \"signature\": {\n \"keyId\": \"default\",\n \"value\": \"UhXnkSnm5A3QU4CVrKGbP3FcTWkShnitn86psJprJpqgEBnsXWzDcZ+ktSO0FJek1X+n9DvO3SjR+WvSofS1CA==\",\n \"signedAt\": \"2026-09-21T05:40:28.555Z\",\n \"algorithm\": \"ed25519\"\n }\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://parmana-api-real.vercel.app/execution-intents/verify")
.header("Content-Type", "application/json")
.body("{\n \"intentId\": \"b41fe9b9-5730-4d34-aab0-4ab63ae69d3b\",\n \"businessTransactionId\": \"4c2eb3b2-3382-4bc2-bf22-2a072e6cf428\",\n \"decisionId\": \"20b4e030-09cd-4447-86fc-b73279d23121\",\n \"authorizationId\": \"5977535b-d887-423d-b422-01ece1fc7bf1\",\n \"policyName\": \"customer-refund\",\n \"policyVersion\": \"1.0.0\",\n \"policyContentHash\": \"6a2e92fbde0f4c5dc56b4e202bf45ce24c99e565cf3ddaacaa21a11c71b7e1ea\",\n \"signalsHash\": \"e22a7b9fd6e0a39e28521f9ffb726d6a57499236055fa6ff2caabd2268f4a395\",\n \"businessTransactionHash\": \"9df286daf38c6eba272f47153e0fb3efef5ee61d778f6baecd5a53861763763a\",\n \"action\": \"paytm:refund\",\n \"target\": \"DRY-ORDER-1789969223742\",\n \"submittedBy\": \"sandbox-agent\",\n \"grantedCapability\": \"paytm:refund\",\n \"createdAt\": \"2026-09-21T05:40:28.434Z\",\n \"intentHash\": \"13922de380518d582c6bb3e88b1d88908e71565f191119f4cadc7de4e30cf5ed\",\n \"signature\": {\n \"keyId\": \"default\",\n \"value\": \"UhXnkSnm5A3QU4CVrKGbP3FcTWkShnitn86psJprJpqgEBnsXWzDcZ+ktSO0FJek1X+n9DvO3SjR+WvSofS1CA==\",\n \"signedAt\": \"2026-09-21T05:40:28.555Z\",\n \"algorithm\": \"ed25519\"\n }\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://parmana-api-real.vercel.app/execution-intents/verify")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Content-Type"] = 'application/json'
request.body = "{\n \"intentId\": \"b41fe9b9-5730-4d34-aab0-4ab63ae69d3b\",\n \"businessTransactionId\": \"4c2eb3b2-3382-4bc2-bf22-2a072e6cf428\",\n \"decisionId\": \"20b4e030-09cd-4447-86fc-b73279d23121\",\n \"authorizationId\": \"5977535b-d887-423d-b422-01ece1fc7bf1\",\n \"policyName\": \"customer-refund\",\n \"policyVersion\": \"1.0.0\",\n \"policyContentHash\": \"6a2e92fbde0f4c5dc56b4e202bf45ce24c99e565cf3ddaacaa21a11c71b7e1ea\",\n \"signalsHash\": \"e22a7b9fd6e0a39e28521f9ffb726d6a57499236055fa6ff2caabd2268f4a395\",\n \"businessTransactionHash\": \"9df286daf38c6eba272f47153e0fb3efef5ee61d778f6baecd5a53861763763a\",\n \"action\": \"paytm:refund\",\n \"target\": \"DRY-ORDER-1789969223742\",\n \"submittedBy\": \"sandbox-agent\",\n \"grantedCapability\": \"paytm:refund\",\n \"createdAt\": \"2026-09-21T05:40:28.434Z\",\n \"intentHash\": \"13922de380518d582c6bb3e88b1d88908e71565f191119f4cadc7de4e30cf5ed\",\n \"signature\": {\n \"keyId\": \"default\",\n \"value\": \"UhXnkSnm5A3QU4CVrKGbP3FcTWkShnitn86psJprJpqgEBnsXWzDcZ+ktSO0FJek1X+n9DvO3SjR+WvSofS1CA==\",\n \"signedAt\": \"2026-09-21T05:40:28.555Z\",\n \"algorithm\": \"ed25519\"\n }\n}"
response = http.request(request)
puts response.read_body{
"valid": true
}
Body
application/json
Request body for POST /execution-intents/verify: the Execution Intent itself (the intent field of GET /execution-intents/{businessTransactionId}), not a lookup by ID. Checked structurally on the server (intentId, businessTransactionId, authorizationId, intentHash, signature required) before signature verification runs.
Unique Execution Intent identifier.
The Business Transaction this intent belongs to.
The Decision that approved the action.
The signed execution authorization this intent refers to. Matches authorization.payload.authorizationId in the Execution Trust Record.
Hash of the executable content (action, target and parameters), copied from the signed authorization. It binds the intent to the exact parameters that were authorized without repeating them here.
The capability about to be released, for example paytm:refund.
The target of the action, for example the order being refunded. Together with action and businessTransactionId it is what an operator searches for at the connector.
UTC timestamp when the intent was created, before the action was released.
Canonical hash of the intent, same convention as ExecutionTrustRecord.trustRecordHash.
Signature over the canonical Execution Intent, made with the deployment's signing key (local or AWS KMS), the same root of trust as the Execution Trust Record.
Show child attributes
Show child attributes
Hash of the exact policy content in force, copied from the signed authorization. Absent when the authorization carries none.
Hash of the signals that were evaluated, copied from the signed authorization. Absent when the authorization carries none.
Authenticated caller who submitted the request. Absent when caller authentication is disabled.
The capability the caller was granted, when one was recorded.
Response
The check ran. Read valid. A 200 alone does not mean the signature verified.
Response shared by POST /refusal/verify and POST /audit/verify: a bare signature-validity result, no wrapper, no partial-failure detail. Both routes verify a signature over bytes with no database lookup, so there is nothing more specific to report than valid or not.
Whether the signature verifies against Parmana's public key for the stated algorithm and key ID.
⌘I
cURL
# The intent, as returned in .intent by GET /execution-intents/<businessTransactionId>:
curl -X POST https://parmana-api-real.vercel.app/execution-intents/verify \
-H "Content-Type: application/json" \
--data @execution-intent.jsonimport { ParmanaClient } from "@parmana/sdk";
const client = new ParmanaClient({
endpoint: "https://parmana-api-real.vercel.app",
apiKey: process.env.PARMANA_API_KEY!,
});
const view = await client.executionIntent(
"5f0c2a7e-3d7b-4d0e-9a55-2f6d8b1c4e90",
);
const valid = await client.verifyExecutionIntent(view.intent);
console.log(valid);import os
from parmana import ParmanaClient
client = ParmanaClient(
endpoint="https://parmana-api-real.vercel.app",
api_key=os.environ["PARMANA_API_KEY"],
)
view = client.execution_intent("5f0c2a7e-3d7b-4d0e-9a55-2f6d8b1c4e90")
valid = client.verify_execution_intent(view.intent)
print(valid)const options = {
method: 'POST',
headers: {'Content-Type': 'application/json'},
body: JSON.stringify({
intentId: 'b41fe9b9-5730-4d34-aab0-4ab63ae69d3b',
businessTransactionId: '4c2eb3b2-3382-4bc2-bf22-2a072e6cf428',
decisionId: '20b4e030-09cd-4447-86fc-b73279d23121',
authorizationId: '5977535b-d887-423d-b422-01ece1fc7bf1',
policyName: 'customer-refund',
policyVersion: '1.0.0',
policyContentHash: '6a2e92fbde0f4c5dc56b4e202bf45ce24c99e565cf3ddaacaa21a11c71b7e1ea',
signalsHash: 'e22a7b9fd6e0a39e28521f9ffb726d6a57499236055fa6ff2caabd2268f4a395',
businessTransactionHash: '9df286daf38c6eba272f47153e0fb3efef5ee61d778f6baecd5a53861763763a',
action: 'paytm:refund',
target: 'DRY-ORDER-1789969223742',
submittedBy: 'sandbox-agent',
grantedCapability: 'paytm:refund',
createdAt: '2026-09-21T05:40:28.434Z',
intentHash: '13922de380518d582c6bb3e88b1d88908e71565f191119f4cadc7de4e30cf5ed',
signature: {
keyId: 'default',
value: 'UhXnkSnm5A3QU4CVrKGbP3FcTWkShnitn86psJprJpqgEBnsXWzDcZ+ktSO0FJek1X+n9DvO3SjR+WvSofS1CA==',
signedAt: '2026-09-21T05:40:28.555Z',
algorithm: 'ed25519'
}
})
};
fetch('https://parmana-api-real.vercel.app/execution-intents/verify', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://parmana-api-real.vercel.app/execution-intents/verify",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'intentId' => 'b41fe9b9-5730-4d34-aab0-4ab63ae69d3b',
'businessTransactionId' => '4c2eb3b2-3382-4bc2-bf22-2a072e6cf428',
'decisionId' => '20b4e030-09cd-4447-86fc-b73279d23121',
'authorizationId' => '5977535b-d887-423d-b422-01ece1fc7bf1',
'policyName' => 'customer-refund',
'policyVersion' => '1.0.0',
'policyContentHash' => '6a2e92fbde0f4c5dc56b4e202bf45ce24c99e565cf3ddaacaa21a11c71b7e1ea',
'signalsHash' => 'e22a7b9fd6e0a39e28521f9ffb726d6a57499236055fa6ff2caabd2268f4a395',
'businessTransactionHash' => '9df286daf38c6eba272f47153e0fb3efef5ee61d778f6baecd5a53861763763a',
'action' => 'paytm:refund',
'target' => 'DRY-ORDER-1789969223742',
'submittedBy' => 'sandbox-agent',
'grantedCapability' => 'paytm:refund',
'createdAt' => '2026-09-21T05:40:28.434Z',
'intentHash' => '13922de380518d582c6bb3e88b1d88908e71565f191119f4cadc7de4e30cf5ed',
'signature' => [
'keyId' => 'default',
'value' => 'UhXnkSnm5A3QU4CVrKGbP3FcTWkShnitn86psJprJpqgEBnsXWzDcZ+ktSO0FJek1X+n9DvO3SjR+WvSofS1CA==',
'signedAt' => '2026-09-21T05:40:28.555Z',
'algorithm' => 'ed25519'
]
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://parmana-api-real.vercel.app/execution-intents/verify"
payload := strings.NewReader("{\n \"intentId\": \"b41fe9b9-5730-4d34-aab0-4ab63ae69d3b\",\n \"businessTransactionId\": \"4c2eb3b2-3382-4bc2-bf22-2a072e6cf428\",\n \"decisionId\": \"20b4e030-09cd-4447-86fc-b73279d23121\",\n \"authorizationId\": \"5977535b-d887-423d-b422-01ece1fc7bf1\",\n \"policyName\": \"customer-refund\",\n \"policyVersion\": \"1.0.0\",\n \"policyContentHash\": \"6a2e92fbde0f4c5dc56b4e202bf45ce24c99e565cf3ddaacaa21a11c71b7e1ea\",\n \"signalsHash\": \"e22a7b9fd6e0a39e28521f9ffb726d6a57499236055fa6ff2caabd2268f4a395\",\n \"businessTransactionHash\": \"9df286daf38c6eba272f47153e0fb3efef5ee61d778f6baecd5a53861763763a\",\n \"action\": \"paytm:refund\",\n \"target\": \"DRY-ORDER-1789969223742\",\n \"submittedBy\": \"sandbox-agent\",\n \"grantedCapability\": \"paytm:refund\",\n \"createdAt\": \"2026-09-21T05:40:28.434Z\",\n \"intentHash\": \"13922de380518d582c6bb3e88b1d88908e71565f191119f4cadc7de4e30cf5ed\",\n \"signature\": {\n \"keyId\": \"default\",\n \"value\": \"UhXnkSnm5A3QU4CVrKGbP3FcTWkShnitn86psJprJpqgEBnsXWzDcZ+ktSO0FJek1X+n9DvO3SjR+WvSofS1CA==\",\n \"signedAt\": \"2026-09-21T05:40:28.555Z\",\n \"algorithm\": \"ed25519\"\n }\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://parmana-api-real.vercel.app/execution-intents/verify")
.header("Content-Type", "application/json")
.body("{\n \"intentId\": \"b41fe9b9-5730-4d34-aab0-4ab63ae69d3b\",\n \"businessTransactionId\": \"4c2eb3b2-3382-4bc2-bf22-2a072e6cf428\",\n \"decisionId\": \"20b4e030-09cd-4447-86fc-b73279d23121\",\n \"authorizationId\": \"5977535b-d887-423d-b422-01ece1fc7bf1\",\n \"policyName\": \"customer-refund\",\n \"policyVersion\": \"1.0.0\",\n \"policyContentHash\": \"6a2e92fbde0f4c5dc56b4e202bf45ce24c99e565cf3ddaacaa21a11c71b7e1ea\",\n \"signalsHash\": \"e22a7b9fd6e0a39e28521f9ffb726d6a57499236055fa6ff2caabd2268f4a395\",\n \"businessTransactionHash\": \"9df286daf38c6eba272f47153e0fb3efef5ee61d778f6baecd5a53861763763a\",\n \"action\": \"paytm:refund\",\n \"target\": \"DRY-ORDER-1789969223742\",\n \"submittedBy\": \"sandbox-agent\",\n \"grantedCapability\": \"paytm:refund\",\n \"createdAt\": \"2026-09-21T05:40:28.434Z\",\n \"intentHash\": \"13922de380518d582c6bb3e88b1d88908e71565f191119f4cadc7de4e30cf5ed\",\n \"signature\": {\n \"keyId\": \"default\",\n \"value\": \"UhXnkSnm5A3QU4CVrKGbP3FcTWkShnitn86psJprJpqgEBnsXWzDcZ+ktSO0FJek1X+n9DvO3SjR+WvSofS1CA==\",\n \"signedAt\": \"2026-09-21T05:40:28.555Z\",\n \"algorithm\": \"ed25519\"\n }\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://parmana-api-real.vercel.app/execution-intents/verify")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Content-Type"] = 'application/json'
request.body = "{\n \"intentId\": \"b41fe9b9-5730-4d34-aab0-4ab63ae69d3b\",\n \"businessTransactionId\": \"4c2eb3b2-3382-4bc2-bf22-2a072e6cf428\",\n \"decisionId\": \"20b4e030-09cd-4447-86fc-b73279d23121\",\n \"authorizationId\": \"5977535b-d887-423d-b422-01ece1fc7bf1\",\n \"policyName\": \"customer-refund\",\n \"policyVersion\": \"1.0.0\",\n \"policyContentHash\": \"6a2e92fbde0f4c5dc56b4e202bf45ce24c99e565cf3ddaacaa21a11c71b7e1ea\",\n \"signalsHash\": \"e22a7b9fd6e0a39e28521f9ffb726d6a57499236055fa6ff2caabd2268f4a395\",\n \"businessTransactionHash\": \"9df286daf38c6eba272f47153e0fb3efef5ee61d778f6baecd5a53861763763a\",\n \"action\": \"paytm:refund\",\n \"target\": \"DRY-ORDER-1789969223742\",\n \"submittedBy\": \"sandbox-agent\",\n \"grantedCapability\": \"paytm:refund\",\n \"createdAt\": \"2026-09-21T05:40:28.434Z\",\n \"intentHash\": \"13922de380518d582c6bb3e88b1d88908e71565f191119f4cadc7de4e30cf5ed\",\n \"signature\": {\n \"keyId\": \"default\",\n \"value\": \"UhXnkSnm5A3QU4CVrKGbP3FcTWkShnitn86psJprJpqgEBnsXWzDcZ+ktSO0FJek1X+n9DvO3SjR+WvSofS1CA==\",\n \"signedAt\": \"2026-09-21T05:40:28.555Z\",\n \"algorithm\": \"ed25519\"\n }\n}"
response = http.request(request)
puts response.read_body{
"valid": true
}