Create scoped spending authorizations that control how much agents can charge, how many transactions they can make, and when the authorization expires.
A delegation is a scoped spending authorization tied to an enrolled payment card. It defines the boundaries of what an agent can charge: the maximum amount over the delegation’s lifetime, how many transactions are allowed, and when the authorization expires.Think of it as a controlled allowance: you’re giving an agent permission to spend within strict limits, rather than handing over your card.
The Visa Agentic Tokens rollout retired the previous separate “Visa mandate” object. Visa is now one of three networks (stripe, braintree, visa) on the unified nvm:card-delegation scheme, with a single create endpoint and a single record shape. Visa delegations differ only in that they require a per-delegation device-binding ceremony at create time.
Set the spending limit, duration, and (optionally) max transactions
Select the plan this delegation binds to (Visa requires a planId)
Optionally link an NVM API key
Click Continue to approval — the embedded Visa VTS iframe starts the WebAuthn ceremony
Complete the passkey approval (or fall back to the email OTP that VTS sends)
The webapp captures the resulting assuranceData and submits the delegation
Visa device binding is single-use and tied to the spending limit + duration + merchant context shown in the approval prompt. Changing any of those values invalidates the captured assuranceData — restart the approval step.
Visa delegation creation is webapp-only. The backend rejects POST /api/v1/delegation/create with provider: 'visa' (BCK.VISA.0014) unless both consumerPrompt and assuranceData are present, and both can only be produced by the VTS-embedded ceremony running in a real browser.
POST /api/v1/delegation/createAuthorization: Bearer <NVM_API_KEY>Content-Type: application/json
{ "provider": "visa", "providerPaymentMethodId": "vat_01HXYZABCDEF", "spendingLimitCents": 5000, "durationSecs": 86400, "maxTransactions": 5, "currency": "usd", "planId": "80918427023170428029540261117198154464497879145267720259488529685089104529015", "consumerPrompt": "Allow up to USD 50.00 over 5 transactions at example.com", "assuranceData": [ { "methodResults": { "id": "…" }, "verificationType": "DEVICE" } ]}
The assuranceData blob is the value returned by the VGS Agentic Auth browser SDK after the WebAuthn ceremony completes. It is opaque to Nevermined and forwarded verbatim to VGS POST /intents.
Calling this endpoint with provider: 'visa' from a non-browser context will fail with BCK.VISA.0014 because assuranceData can only be produced by the in-browser ceremony. Trying to forge or replay one yields BCK.VISA.0003 from upstream.
spendingLimitCents caps the cumulative amount charged over the delegation’s lifetime, not per-transaction. Once amountSpentCents >= spendingLimitCents, the delegation transitions to Exhausted.
Each card has a cumulative spending ceiling (default $10.00). The sum of spendingLimitCents across all active delegations on a card can’t exceed this ceiling.Example:
Card Ceiling
Delegation A
Delegation B
Remaining
$10.00
$5.00
$3.00
$2.00
If you try to create a third delegation for 3.00,itwillberejectedbecauseonly2.00 of ceiling remains.
Delegations are not updated in place. To change the limit, duration, or any other parameter, revoke the existing one and create a new one. For Visa, this requires a fresh device-binding ceremony.
# 1. Revoke existing delegationDELETE /api/v1/delegation/{delegationId}# 2. Create new delegation with updated paramsPOST /api/v1/delegation/create
Revoking and recreating a delegation means any unspent budget from the old delegation does not carry over.
No additional authentication is required beyond your API credentials. Revocation is immediate: in-flight verify/settle calls against the delegation fail with DELEGATION_INACTIVE.
Active -> Exhausted (spending limit or transaction count reached) | |-> Expired (past createdAt + durationSecs) | |-> Revoked (manually removed via DELETE)
Only Active delegations can be used for payments. NVM Pay checks status, usage, and expiration on every verify and settle request. Each delegation tracks amountSpentCents, remainingBudgetCents, and transactionCount.
You can optionally link a delegation to a specific NVM API key. This tells NVM Pay “when this API key is used, charge this delegation.”This is especially useful when you have multiple active delegations and want deterministic routing. Instead of the agent guessing which one to use, the API key determines it automatically. All three networks support API key linking through the same apiKeyId field.See Delegation Selection for the full resolution algorithm.
