POST /policy/check - VoiceMark

Checks whether a verify token authorises a specific named action. Use this before any privileged operation (payment, DB write, step-up auth).

Request

POST /v1/policy/check Content-Type: application/json

Field	Type	Required	Notes
`token`	string	Yes	Full JWT from `/v1/verify`
`action`	string	Yes	Namespaced action identifier

Response

{ "permitted": true, "reason": null }

{ "permitted": false, "reason": "Token expired" }

Action naming

Use dot-namespaced strings to identify actions:

payment.authorise
account.update
document.sign
admin.access

Example

const result = await vm.policy(verify.token, "payment.authorise");
if (!result.permitted) {
  return res.status(403).json({ error: result.reason });
}

⌘I