# Verify a fresh human proof

## Endpoint

```http
POST /tool-result-human-proof/verify
```

Verify a signed password proof no older than five minutes against the authenticated session subject. The verified subject must equal subject. The owner is derived from the verified IdP proof; it is not accepted from the body.

### Parameters

No operation parameters.

### Request body

The request uses the schema below.

Required: yes.

Content type: `application/json`.

```json
{
  "type": "object",
  "properties": {
    "idpToken": {
      "type": "string",
      "minLength": 1
    },
    "subject": {
      "type": "string",
      "minLength": 1
    }
  },
  "required": [
    "idpToken",
    "subject"
  ],
  "additionalProperties": false
}
```


### Responses

#### HTTP 200

The host decision completed.

Content type: `application/json`.

```json
{
  "type": "object",
  "properties": {
    "authorized": {
      "const": true
    },
    "owner": {
      "type": "string",
      "pattern": "^u_[a-z2-7]{26}$"
    },
    "sub": {
      "type": "string"
    },
    "exp": {
      "type": "integer"
    },
    "authTime": {
      "type": "integer"
    }
  },
  "required": [
    "authorized",
    "owner",
    "sub",
    "exp",
    "authTime"
  ]
}
```

#### HTTP 400

Malformed JSON or invalid request fields.

Content type: `application/json`.

```json
{
  "$ref": "#/components/schemas/Error"
}
```

#### HTTP 401

Missing or invalid loopback capability.

Content type: `application/json`.

```json
{
  "$ref": "#/components/schemas/Error"
}
```

#### HTTP 403

An Origin header or failed authority/proof check is refused.

Content type: `application/json`.

```json
{
  "$ref": "#/components/schemas/Error"
}
```

#### HTTP 405

Only POST is accepted.

Content type: `application/json`.

```json
{
  "$ref": "#/components/schemas/Error"
}
```

#### HTTP 413

Request exceeds the 65536-byte body limit.

Content type: `application/json`.

```json
{
  "$ref": "#/components/schemas/Error"
}
```

#### HTTP 415

Content-Type must be application/json.

Content type: `application/json`.

```json
{
  "$ref": "#/components/schemas/Error"
}
```

#### HTTP 429

Invalid-capability attempts exceeded the rolling-minute limit.

Content type: `application/json`.

```json
{
  "$ref": "#/components/schemas/Error"
}
```

Authentication and access: Host-only HTTP operations of the stock auth service. These six routes exist only on the loopback listener and return 404 on the public listener. The owner-private auth-service discovery record supplies its port and exchange capability. Every operation requires the exact Authorization bearer capability, application/json and no Origin header. Requests match the exact target, so query strings and trailing slashes return 404. Bodies default to 65536 bytes. More than 30 invalid capability attempts in a rolling minute receive 429.

The loopback listener also serves /health, /jwks, /exchange, /manager-service-authority, /manager-instances, /service-endpoint-authority, /service-endpoint-host and /chat-session/open, /chat-session/bearer, /chat-session/retire. Their public request and response shapes are in the [Auth HTTP API](https://docs.cotal.ai/api/auth/). Proof operations additionally require the loopback capability. The loopback /health handler also accepts other methods. Elevated exchange views and operator host operations are loopback-only. Mesh discovery is public-listener-only. This implementation reference does not establish a stable cloud API.

[OpenAPI specification](https://docs.cotal.ai/auth-host.openapi.json) contains the referenced response schemas. [Complete Markdown reference](/api/auth-host.md).