API reference

The container health check. Lists log ids so a probe can also confirm the store is readable.

The plane describes itself, to anyone. There is nothing here a key protects.

Consumes one unit from a per-caller bucket and a shared global bucket, both persisted in the store so a restart does not hand a caller a fresh allowance. Used by the marketing site's chat. Admin only. The bounds you pass are clamped — a caller that could name its own ceiling could name a useless one.

Seals each event onto its log — assigning seq, prevHash and eventHash under the per-log write lock — and returns the new head. The whole batch is one transaction: all of it lands or none of it does. Every event names its own logId, and a tenant key may only write its own; the scope check runs before anything chains, because an append is permanent. An event the schema rejects is a 400 naming the field, and nothing in the batch is written.

One route per adapter kind rather than per vendor: the mapping differs, the schema does not. voice maps a finished call (lifecycle, per-turn decisions, tool calls, and a first-class disclosure event recording whether the AI disclosure was played); code maps a coding-agent session, with the commit as the effect-plane evidence; cloud maps a provider audit event (CloudTrail, GCP audit log, Kubernetes) as an effect. The vendor segment is recorded as surface.adapter and may be omitted, in which case it is the kind.

Authenticates with EITHER the bearer key OR the write-only webhook secret (x-auditant-webhook-secret, or x-vapi-secret because Vapi cannot be told otherwise). The secret can write events and do nothing else, so a vendor's webhook configuration screen never holds the key.

Synchronous, on the request path by design, and judged in microseconds. The caller states what it is trying to do — that is genuinely its own knowledge. Everything the decision is checked against (spend inside the budget window, burn rate, session iterations, the halt flag, any real human approval) is derived from the chain and stored configuration, and overwrites anything the caller sent. evaluatedAgainst echoes those derived values so a caller can see what it was judged on.

An admin key is judged against the operator's custom rules; a tenant key against the built-in rules only — one tenant's policy must never govern another's agents. Without a budget store the route returns 501 rather than deciding on caller-supplied limits.

Everything needed to verify the record independently, in one file: the events in range, every checkpoint up to the head, the public keys, a plain README, and the standalone verifier itself as source — so checking the evidence needs Node and nothing else. Served as an attachment; it is meant to be handed to a person.

Events in sequence order, a page at a time. Ascending is the default for export-style walks; order=desc starts at the live head for console views. In either direction, pass a page's nextCursor back as cursor to continue without offsets, repeats, or gaps. A page can never exceed the maximum whatever is asked for, and nextCursor is null on the last page.

Aggregates the database computes: counts, spend, and how many model calls the upstream did not price — read from the attributionComplete flag, never inferred from a zero. Plus the head and the checkpoint count.

A hash chain proves what is on it was never altered; it cannot prove nothing was left off. This reading makes omission visible: which capture planes are live, which agents have gone quiet, whether traces are corroborated on a second plane, how fresh the anchors are — and one blunt score a buyer can watch go up. Computed over the newest window.cap events, and says so; events is the exact total from the head.

The newest checkpoints on the log — up to window.cap of them, oldest first within that window, and window.total says how many there are. Each carries the tree size at signing; because event sequences are zero-based, it covers through sequence treeSize - 1. It also says when it was signed and which further assurances it has reached — an RFC 3161 countersignature and a copy in write-once storage. The signatures and tokens themselves travel in the evidence bundle.

Every regime's obligations with a status each — satisfied, open, watching (a rule armed in monitor mode: recorded, deliberately not enforced) or outside (the record cannot answer it, and says so rather than implying otherwise) — and the open ones collapsed to the distinct actions that close them.

The drill-in: one regime's obligations with the sequence numbers that answer each. Separate from the overview so a console that draws five summaries does not have to fetch every obligation of every regime to do it.

Every pending_approval event with no later human_override in the same session naming the same action. Found by two indexed queries — never a scan of the log — newest first, capped at window.cap requests and saying so.

Appends a human_override event under the approver's name. Approval records outcome ok — the exact shape /v1/decide looks for, so the agent's next check walks through. Rejection records outcome blocked with a policy record naming the human, which the decision reader ignores — so the agent stays held, and the refusal is itself on the chain. An anonymous approval is exactly the record this product exists to prevent, so approver is required.

The one route that serves markup and sits before the bearer gate: the clicker is a human in a browser, and the signed, expiring token in t IS the credential. Records the answer exactly as POST /v1/approvals would, under the configured approver label, and renders a sentence. Everything interpolated into the page is escaped — the action name is authored by the agents this product audits. 404 when one-click links are not configured (no link secret); 403 for an invalid or expired token; 200 "Already answered" when someone got there first.

Cost per agent, customer, model and run, and cost per clean run — the one that completed with no block and no human. Administration (sign-ins, rule and budget changes) is in the chain and excluded from spend. Unpriced calls are counted, never folded in as $0. Computed over the newest window.cap events in range; narrow from/to when window.truncated is true.

One row per session: calls, cost, whether policy stopped anything, whether a human had to step in. Bounded like the summary.

Spend since since, burn rate, and whether it exceeded ceiling. The spend is one aggregate the database computes over an indexed column — exact whatever the log size. Note this is a calculator against a ceiling you pass; the ceilings a decision is actually judged against live in /v1/budgets.

An admin sees every budget scope. A tenant sees its own halt state and an empty budgets list — ceilings are the operator's configuration.

Upserts the budget for a scope — an agent id, or * for the fleet default — and records the change on the chain under author. "Who raised the ceiling the day before the overspend" is a question that gets asked.

Sets the halt flag for a log. While halted, every decision for that log is refused. A tenant may pull its own switch — that is the control, not a privilege — but only its own. Recorded on the chain with a name attached; it is the most consequential button in the product and the one most likely to be pressed in a hurry.

Every rule the engine evaluates, described. An admin sees the built-ins plus the operator's custom rules and whether custom rules are configured at all; a tenant sees the built-ins that actually govern its decisions and customRulesEnabled: false.

Validates the spec, retires whatever version of that rule id was live, and stores this one. The version is the content hash, so saving the same spec twice is a no-op that returns the existing version. Every change is itself an event on the chain, carrying both sides in plain English. A validation failure names the path — condition.all[1]: gt needs a number, got string.

Newest first. Nothing is ever deleted: a rule that governed a real decision is part of that decision's evidence.

The lookup the whole rule store exists for: turns the policyId and policyVersion on a nine-month-old decision back into the rule that made it, in the words it was written in.

Stops the rule being evaluated. Its history stays. 404 when nothing by that id is live — retiring twice would record two retirements and report the second one's answer.

Every checkpoint-signing key this plane has published, so anyone holding a bundle can verify it without asking us. Key ids are content-addressed: two different keys cannot collide on one id, and a rotation never overwrites the key that signed older checkpoints.

The same verifier an auditor runs from the CLI and the same one embedded in every bundle, reached over HTTP so the operator console does not carry a second copy. Read-only and stateless: nothing is stored, nothing is appended. Admin only, purely because it is an unbounded parse of caller-supplied JSON. A malformed bundle is a 400, not a verification failure — "that is not a bundle" and "this record was altered" are different findings, and reporting the first as the second would be an accusation.

Idempotent. The log id is derived from the email (t_<12 hex>/prod) — deterministic so a re-provision lands on the same log, opaque so it reveals nothing about the address. Never returns a key: creating the tenant and minting a credential are different acts with different audiences.