Perform an operation advertised by a vault item
curl --request POST \
--url https://api.onkernel.com/vaults/{id_or_name}/items/{key}/operations \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"type": "authorize"
}
'import requests
url = "https://api.onkernel.com/vaults/{id_or_name}/items/{key}/operations"
payload = { "type": "authorize" }
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({type: 'authorize'})
};
fetch('https://api.onkernel.com/vaults/{id_or_name}/items/{key}/operations', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.onkernel.com/vaults/{id_or_name}/items/{key}/operations",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'type' => 'authorize'
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.onkernel.com/vaults/{id_or_name}/items/{key}/operations"
payload := strings.NewReader("{\n \"type\": \"authorize\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.onkernel.com/vaults/{id_or_name}/items/{key}/operations")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"type\": \"authorize\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.onkernel.com/vaults/{id_or_name}/items/{key}/operations")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"type\": \"authorize\"\n}"
response = http.request(request)
puts response.read_body{
"action": {
"name": "spend_approval",
"url": "https://example.com/spend-approval"
},
"available_expansions": [],
"available_operations": [
{
"description": "Resume this existing spend request without creating another payment.",
"type": "authorize"
}
],
"created_at": "2026-01-01T12:00:00Z",
"expires_at": "2026-01-01T13:00:00Z",
"id": "card_link_example",
"key": "link-card",
"spec": {
"amount": 2599,
"context": "Purchase one notebook for USD 25.99 including shipping and taxes. This is a new order at Example Store, not a retry of an earlier payment.",
"currency": "usd",
"merchant_name": "Example Store",
"merchant_url": "https://store.example.com",
"payment_method_id": "pm_example",
"provider": "link",
"wallet": "link-wallet"
},
"state": {
"domains": [
"store.example.com"
],
"provider": "link",
"status": "pending_authorization"
},
"type": "card",
"updated_at": "2026-01-01T12:01:00Z"
}{
"code": "bad_request",
"message": "Missing required field: app_name",
"details": [
{
"code": "invalid_input",
"message": "Provided version string is not semver compliant"
}
],
"inner_error": {
"code": "invalid_input",
"message": "Provided version string is not semver compliant"
}
}{
"code": "bad_request",
"message": "Missing required field: app_name",
"details": [
{
"code": "invalid_input",
"message": "Provided version string is not semver compliant"
}
],
"inner_error": {
"code": "invalid_input",
"message": "Provided version string is not semver compliant"
}
}{
"code": "bad_request",
"message": "Missing required field: app_name",
"details": [
{
"code": "invalid_input",
"message": "Provided version string is not semver compliant"
}
],
"inner_error": {
"code": "invalid_input",
"message": "Provided version string is not semver compliant"
}
}{
"code": "bad_request",
"message": "Missing required field: app_name",
"details": [
{
"code": "invalid_input",
"message": "Provided version string is not semver compliant"
}
],
"inner_error": {
"code": "invalid_input",
"message": "Provided version string is not semver compliant"
}
}{
"code": "bad_request",
"message": "Missing required field: app_name",
"details": [
{
"code": "invalid_input",
"message": "Provided version string is not semver compliant"
}
],
"inner_error": {
"code": "invalid_input",
"message": "Provided version string is not semver compliant"
}
}{
"code": "bad_request",
"message": "Missing required field: app_name",
"details": [
{
"code": "invalid_input",
"message": "Provided version string is not semver compliant"
}
],
"inner_error": {
"code": "invalid_input",
"message": "Provided version string is not semver compliant"
}
}Vaults
Perform an operation advertised by a vault item
Retrieve the item first and invoke only an operation listed in available_operations, following its natural-language description. Operations may call an external provider and return updated state. Link cards advertise authorize. AgentCard cards are created with PUT and request approval when their aliases are used at checkout; they do not expose this operation. If spend-request creation is rate limited, returns HTTP 429 with code spend_request_rate_limited; stop and back off before retrying.
POST
/
vaults
/
{id_or_name}
/
items
/
{key}
/
operations
Perform an operation advertised by a vault item
curl --request POST \
--url https://api.onkernel.com/vaults/{id_or_name}/items/{key}/operations \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"type": "authorize"
}
'import requests
url = "https://api.onkernel.com/vaults/{id_or_name}/items/{key}/operations"
payload = { "type": "authorize" }
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({type: 'authorize'})
};
fetch('https://api.onkernel.com/vaults/{id_or_name}/items/{key}/operations', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.onkernel.com/vaults/{id_or_name}/items/{key}/operations",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'type' => 'authorize'
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.onkernel.com/vaults/{id_or_name}/items/{key}/operations"
payload := strings.NewReader("{\n \"type\": \"authorize\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.onkernel.com/vaults/{id_or_name}/items/{key}/operations")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"type\": \"authorize\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.onkernel.com/vaults/{id_or_name}/items/{key}/operations")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"type\": \"authorize\"\n}"
response = http.request(request)
puts response.read_body{
"action": {
"name": "spend_approval",
"url": "https://example.com/spend-approval"
},
"available_expansions": [],
"available_operations": [
{
"description": "Resume this existing spend request without creating another payment.",
"type": "authorize"
}
],
"created_at": "2026-01-01T12:00:00Z",
"expires_at": "2026-01-01T13:00:00Z",
"id": "card_link_example",
"key": "link-card",
"spec": {
"amount": 2599,
"context": "Purchase one notebook for USD 25.99 including shipping and taxes. This is a new order at Example Store, not a retry of an earlier payment.",
"currency": "usd",
"merchant_name": "Example Store",
"merchant_url": "https://store.example.com",
"payment_method_id": "pm_example",
"provider": "link",
"wallet": "link-wallet"
},
"state": {
"domains": [
"store.example.com"
],
"provider": "link",
"status": "pending_authorization"
},
"type": "card",
"updated_at": "2026-01-01T12:01:00Z"
}{
"code": "bad_request",
"message": "Missing required field: app_name",
"details": [
{
"code": "invalid_input",
"message": "Provided version string is not semver compliant"
}
],
"inner_error": {
"code": "invalid_input",
"message": "Provided version string is not semver compliant"
}
}{
"code": "bad_request",
"message": "Missing required field: app_name",
"details": [
{
"code": "invalid_input",
"message": "Provided version string is not semver compliant"
}
],
"inner_error": {
"code": "invalid_input",
"message": "Provided version string is not semver compliant"
}
}{
"code": "bad_request",
"message": "Missing required field: app_name",
"details": [
{
"code": "invalid_input",
"message": "Provided version string is not semver compliant"
}
],
"inner_error": {
"code": "invalid_input",
"message": "Provided version string is not semver compliant"
}
}{
"code": "bad_request",
"message": "Missing required field: app_name",
"details": [
{
"code": "invalid_input",
"message": "Provided version string is not semver compliant"
}
],
"inner_error": {
"code": "invalid_input",
"message": "Provided version string is not semver compliant"
}
}{
"code": "bad_request",
"message": "Missing required field: app_name",
"details": [
{
"code": "invalid_input",
"message": "Provided version string is not semver compliant"
}
],
"inner_error": {
"code": "invalid_input",
"message": "Provided version string is not semver compliant"
}
}{
"code": "bad_request",
"message": "Missing required field: app_name",
"details": [
{
"code": "invalid_input",
"message": "Provided version string is not semver compliant"
}
],
"inner_error": {
"code": "invalid_input",
"message": "Provided version string is not semver compliant"
}
}Authorizations
Bearer authentication header of the form Bearer <token>, where <token> is your auth token.
Body
application/json
Available options:
authorize Response
Operation completed or resumed
- Option 1
- Option 2
Show child attributes
Show child attributes
Show child attributes
Show child attributes
Immutable item key assigned when the item is created.
- Option 1
- Option 2
Show child attributes
Show child attributes
- Option 1
- Option 2
Show child attributes
Show child attributes
Available options:
wallet - Option 1
- Option 2
- Option 3
- Option 4
- Option 5
- Option 6
- Option 7
Show child attributes
Show child attributes
Live, non-persisted data requested through the item GET expand parameter.
Show child attributes
Show child attributes