> ## Documentation Index > Fetch the complete documentation index at: https://docs.kordio.io/llms.txt > Use this file to discover all available pages before exploring further. # Verify a cosignature and spend it > Unauthenticated. Does everything `verify` does, and then marks the authority spent so the same cosignature cannot be presented twice. Use this when you are the executor and you are about to act. `verify` answers "is this good?"; `consume` answers "is this good, and it is mine now". A second call with the same cosignature reports `already_settled`. Send the token either as the body field `authorization` or as an `Authorization: Bearer ` header. ## OpenAPI ````yaml /agents/api-reference/openapi.yaml post /control/v1/cosign/consume openapi: 3.1.0 info: title: Kordio Agent Control API version: 1.0.0 description: > The control layer decides whether an agent may take an action before it takes it, and signs the answer so the executor can verify authority without trusting the agent. Two credentials reach this API and they are deliberately not interchangeable. An **agent key** (`krt_live_...` or `krt_test_...`) is what an agent carries. It reaches `/v1/agent/*` and can ask for authorization, but it can never write policy. An agent able to widen its own limits is not governed by them. An **identity token** is what a person or your backend carries. It reaches `/v1/workspaces/{workspace_slug}/*` and manages agents, policy, approvals and members. It can never authorize an action as an agent. Cosignature verification needs no credential at all. contact: name: Kordio support email: support@kordio.io license: name: Proprietary servers: - url: https://api.kordio.io description: Production security: - AgentKey: [] tags: - name: Actions description: >- The authorization call that goes in front of a spend, and the outcome reports that settle or release its reservation. Agent key. - name: Budgets description: Budget envelopes for one agent run. Agent key. - name: Spend tokens description: >- Single-use, pre-authorized ceilings an agent mints against its own session and presents later on a payment. Agent key. - name: Payment intents description: Authorize a payment. You settle it and report back. Agent key. - name: Cosignatures description: Verify a signed authorization. Unauthenticated. - name: Agents description: Scoped identities for agent workloads. Identity token. - name: Policies description: The rules attached to an agent. Identity token. - name: Policy modules description: Named, reusable rule sets a policy imports by name. Identity token. - name: Policy previews description: Evaluate a draft policy without saving it. Identity token. - name: Approvals description: >- The queue of intents a rule held for a person, and the calls that resolve them. Identity token. - name: Funds description: Committed, held and unprojected spend across a workspace. Identity token. - name: Audit events description: >- The append-only record of everything the control layer did. Identity token. - name: Webhook endpoints description: Control-layer event delivery. Identity token. - name: Workspaces description: Workspace lifecycle and export. Identity token. - name: Members description: Memberships and invitations. Identity token. - name: Billing description: >- Plan, entitlements and prepaid volume. Console-facing; agents never call these. Identity token. externalDocs: description: Control layer guides url: https://docs.kordio.io/agents paths: /control/v1/cosign/consume: post: tags: - Cosignatures summary: Verify a cosignature and spend it description: > Unauthenticated. Does everything `verify` does, and then marks the authority spent so the same cosignature cannot be presented twice. Use this when you are the executor and you are about to act. `verify` answers "is this good?"; `consume` answers "is this good, and it is mine now". A second call with the same cosignature reports `already_settled`. Send the token either as the body field `authorization` or as an `Authorization: Bearer ` header. operationId: consumeCosignature requestBody: required: false content: application/json: schema: type: object properties: authorization: type: string description: The cosignature JWT. May be sent as a bearer header instead. consumed_by: type: string description: >- Optional label for whoever spent it, recorded on the consumption. responses: '200': description: The signature was valid and the authority is now spent. content: application/json: schema: type: object required: - data properties: data: $ref: '#/components/schemas/CosignatureVerificationValid' '400': description: No cosignature was supplied. content: application/json: schema: $ref: '#/components/schemas/Error' '422': description: >- The cosignature did not verify, or the authority was already spent. `reason` says which. content: application/json: schema: type: object required: - data properties: data: $ref: '#/components/schemas/CosignatureVerificationInvalid' security: [] components: schemas: CosignatureVerificationValid: type: object properties: valid: type: boolean const: true reason: type: string nullable: true intent_id: type: string format: uuid agent_id: type: string format: uuid action_type: type: string resource: type: string nullable: true amount_cents: type: integer currency: type: string policy_version: type: string nullable: true description: >- The rules in force when this authority was granted. Pin it alongside the receipt and the decision stays replayable after the policy changes. frame_hash: type: string nullable: true description: >- The request frame this authority was signed over. Recompute it from the request you hold to confirm the receipt is for that request and no other. expires_at: type: string format: date-time Error: type: object required: - error properties: error: type: object required: - message properties: message: type: string description: For humans. Do not switch on it. code: type: string nullable: true description: >- Stable where present, `null` otherwise. Only a defined set of failures carry a code. enum: - runtime_key_required - invalid_runtime_key - identity_token_required - invalid_identity_token - budget_ceiling - parent_budget_exhausted - already_consumed - idempotency_conflict - insufficient_role - idempotency_key_required - authorization_required - rate_limited - billing_unavailable - invalid_signature - identity_unavailable - identity_not_configured - mfa_required - email_verification_required CosignatureVerificationInvalid: type: object properties: valid: type: boolean const: false reason: type: string enum: - malformed - unknown_key - expired - wrong_issuer - not_yet_valid - bad_signature - unknown_intent - already_settled - amount_mismatch securitySchemes: AgentKey: type: http scheme: bearer description: >- An agent API key, `krt_live_...` or `krt_test_...`, shown exactly once at creation. Kordio stores only a digest. This credential can ask for authorization and can never write policy. ````