curl --request GET \
--url https://api.sandbox.nevermined.app/api/v1/x402/permissions/{permissionHash} \
--header 'Authorization: Bearer <token>'import requests
url = "https://api.sandbox.nevermined.app/api/v1/x402/permissions/{permissionHash}"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.sandbox.nevermined.app/api/v1/x402/permissions/{permissionHash}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.sandbox.nevermined.app/api/v1/x402/permissions/{permissionHash}",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.sandbox.nevermined.app/api/v1/x402/permissions/{permissionHash}"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.sandbox.nevermined.app/api/v1/x402/permissions/{permissionHash}")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.sandbox.nevermined.app/api/v1/x402/permissions/{permissionHash}")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body{
"permissionHash": "0x1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef",
"scheme": "nvm:erc4337",
"planName": "",
"status": "Active",
"createdAt": "2025-05-09T12:00:00Z",
"lastUsedAt": "2025-05-09T14:00:00Z",
"expiresAt": "2025-12-20T00:00:00Z",
"redemptionLimit": 10,
"planId": "<string>",
"delegationId": "a1b2c3d4-e5f6-4a90-8bcd-ef1234567890",
"spendingLimitCents": "10000",
"currency": "usd",
"remainingBudgetCents": "9000"
}Get Permission
Retrieves complete information about a specific permission.
curl --request GET \
--url https://api.sandbox.nevermined.app/api/v1/x402/permissions/{permissionHash} \
--header 'Authorization: Bearer <token>'import requests
url = "https://api.sandbox.nevermined.app/api/v1/x402/permissions/{permissionHash}"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.sandbox.nevermined.app/api/v1/x402/permissions/{permissionHash}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.sandbox.nevermined.app/api/v1/x402/permissions/{permissionHash}",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.sandbox.nevermined.app/api/v1/x402/permissions/{permissionHash}"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.sandbox.nevermined.app/api/v1/x402/permissions/{permissionHash}")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.sandbox.nevermined.app/api/v1/x402/permissions/{permissionHash}")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body{
"permissionHash": "0x1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef",
"scheme": "nvm:erc4337",
"planName": "",
"status": "Active",
"createdAt": "2025-05-09T12:00:00Z",
"lastUsedAt": "2025-05-09T14:00:00Z",
"expiresAt": "2025-12-20T00:00:00Z",
"redemptionLimit": 10,
"planId": "<string>",
"delegationId": "a1b2c3d4-e5f6-4a90-8bcd-ef1234567890",
"spendingLimitCents": "10000",
"currency": "usd",
"remainingBudgetCents": "9000"
}Authorizations
Your Nevermined API Key (starts with 'nvm:'). Get one at nevermined.app under Settings > API Keys.
Path Parameters
Unique permission identifier
Response
Permission details
Full details of one permission, as returned by GET /x402/permissions/{permissionHash}. The four delegation budget fields are present whenever the permission is linked to a delegation — on BOTH schemes, not nvm:card-delegation only: PermissionEntity.createErc4337Delegation sets delegationId, spendingLimitCents and currency alongside the nvm:erc4337 scheme, and the builder gates them on delegationId, never on scheme.
Unique identifier of the permission (hash)
"0x1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef"
Payment scheme identifier
nvm:erc4337, nvm:card-delegation "nvm:erc4337"
Name of the payment plan. Always the empty string on permissions the API creates today — the write path hardcodes planName to it. The key is always emitted, which is why it stays in required.
""
Current status of the permission
Active, Revoked, Expired, Exhausted "Active"
Date when the permission was created
"2025-05-09T12:00:00Z"
Date when the permission was last used, or null if never used
"2025-05-09T14:00:00Z"
Date when the permission expires, or null if it does not expire
"2025-12-20T00:00:00Z"
Maximum number of redemptions allowed, or null for unlimited
10
No permission the API creates today carries one: the single write path (delegation.service.ts — permissionRepository.save) hardcodes planId = null as plan-agnostic, and the response builder maps planId ?? undefined, which JSON.stringify drops — so the key is ALWAYS absent, on both schemes. Retained because the column exists and older rows may carry a value.
Linked delegation id. Present on any delegation-linked permission, on both schemes
"a1b2c3d4-e5f6-4a90-8bcd-ef1234567890"
Spending limit in cents. Present on any delegation-linked permission, on both schemes
"10000"
Currency code. Present on any delegation-linked permission, on both schemes
"usd"
Remaining budget in cents. Present on any delegation-linked permission, on both schemes
"9000"
Was this page helpful?