Start in Observe on one route. Use the deployment URL and installed package version supplied for your workspace. Historical host examples and source capabilities do not establish a live service or published release.
Base URL
https://gate.x-lock.devBrowser-facing endpoints are served from this domain. Backend validation
endpoints on the same host require server-side credentials and must never be
called from browser JavaScript.
Endpoints
The public verification surface and the locked backend validation endpoints:
| Method | Path | Purpose |
|---|---|---|
| GET | /g.js | Serve the verification script |
| POST | /c | Request a challenge (automatic) |
| POST | /v | Submit verification (automatic) |
| POST | /validate | Locked server-to-server validation for replay-sensitive routes; requires tokens:validate API key |
| POST | /api/v1/step-up-attempts/{attempt_id} | Report the terminal outcome of a customer-owned step-up requested by hosted validation; requires tokens:validate API key |
| GET | /health | Health check |
These are the endpoints a customer integrates against. Event/usage read APIs
(GET /api/v1/events*, GET /api/v1/usage/daily, GET /api/v1/site-keys)
and the worker/Service-Worker compatibility routes are documented in the
integration guides under docs/integration and the SDK
references under docs/sdks.
Info
The /c and /v endpoints are called automatically by the gate script. You do not need to interact with them directly.
Authentication
MANDATE uses two customer-facing credentials plus a server-side authority
model:
| Credential | Visibility | Usage |
|---|---|---|
| Site Key | Public | Passed in the script tag on your frontend |
| Site Secret | Private | Used by SDK compatibility readers; not the default authority for production verification |
| API Key | Private | Required for locked /validate calls and step-up outcome reporting with tokens:validate scope |
Warning
Never expose your site secret in client-side code. It is used exclusively on your backend.
Production browser continuity uses the host-only HttpOnly Mndt-Sess cookie
issued by the gate. High-value and replay-sensitive routes are protected with
hosted POST /validate; local SDK cryptographic verification is limited to
the DEADMAN offline emergency tier and explicit legacy compatibility.
Rate Limiting
Hot-path limits are per IP by default, configurable per deployment
(MANDATE_RL_*_PER_MIN). The defaults below reflect a standard deployment:
| Endpoint | Default limit |
|---|---|
GET /g.js | 60 requests/min per IP |
POST /c | 60 requests/min per IP |
POST /v | 180 requests/min per IP |
POST /validate | 600 requests/min per IP, after API-key authorization |
POST /api/v1/step-up-attempts/{attempt_id} | 600 requests/min per IP, after API-key authorization |
Rate-limited responses return HTTP 429 with a Retry-After header.
Response Headers
All responses include:
X-Request-ID— unique request identifier for debugging (an inbound
X-Request-ID with a safe charset is preserved; otherwise one is generated)
Cache-Control— varies by endpoint (see individual docs)
Error Format
Non-2xx responses from /validate return JSON:
{
"error": "invalid_token",
"message": "Token has expired"
}