Start in Observe on one route. Use the deployment URL and installed package version supplied for your workspace. Historical host examples and source capabilities do not establish a live service or published release.
Endpoint
POST https://gate.x-lock.dev/vDescription
Called automatically by the gate script to complete the verification flow. On
success, an opaque encrypted credential is established and automatically
presented on subsequent same-origin requests to protected routes (in
production this is the HttpOnly Mndt-Sess cookie path; browser-readable
X-Mndt header modes exist only for non-production compatibility).
Warning
This endpoint is internal to the MANDATE verification process. The request and response formats are not publicly documented. The gate script handles all communication with this endpoint automatically.
Status Codes
| Status | Meaning |
|---|---|
| 200 | Verification complete — credential established |
| 400 | Malformed request or invalid submission |
| 403 | Session expired or invalid |
| 429 | Rate limited |
What Happens Next
After a valid verification:
- The gate script holds the credential in memory and presents it on
subsequent same-origin requests (in production this is the HttpOnly
Mndt-Sess cookie path; browser-readable header modes exist only for
non-production compatibility).
- Your backend protects high-value, replay-sensitive, and mutating routes
with hosted POST /validate (see POST /validate).
- Local SDK cryptographic verification is not the default product path; it
exists for the DEADMAN offline emergency tier and explicit legacy
compatibility, and high-value helpers fail closed without hosted
/validate authority.