The open tier requires no authentication. It is the governance surface, evidence, intelligence, identity, registry, control-center and signals, plus the legacy validation and Sentinel endpoints. Every endpoint below is verified against api/routes.py.
Audit
POST /api/v1/audit/conversation no auth
Audit a conversation through the Evidence Engine. Resolves a provider (mock by default), invokes it safely, and returns the verdict plus the evidence envelope, receipt and provenance. Never 5xx on provider trouble, failure is reported as data.
json request
{ "task": "audit_ai_response", "instructions": [], "input": "The capital of Australia is Sydney." }200 response
{ "risk": "LOW", "drift": false, "inconsistency": false, "hallucination_risk": false,
"explanation": "…", "confidence": 0.5, "evidence": [],
"provider": "mock", "mode": "mock", "status": "ok", "latency_ms": 0.0,
"routing": { … }, "envelope": { "id": "ev_…" }, "receipt": { … }, "provenance": { … } }Intelligence, compliance · risk · quality · trust
Each takes an evidence object (a serialized EvidenceEnvelope) and returns a full assessment. Malformed/partial evidence degrades safely to unknown/incomplete: never an error.
POST /api/v1/compliance/assess no auth
Assess evidence against a compliance pack. pack_id ∈ {eu_ai_act, nist_ai_rmf, iso_42001}, an unknown pack is rejected with 422.
json request
{ "pack_id": "eu_ai_act", "evidence": { /* EvidenceEnvelope.to_dict() */ } }POST /api/v1/risk/assess no auth
Operational risk assessment → risk_score (0–100) + risk_level (low/medium/high/critical/unknown).
POST /api/v1/quality/assess no auth
Operational quality assessment → quality_score + quality_level (excellent/good/fair/poor/unknown).
POST /api/v1/trust/assess no auth
Unified trust, aggregates compliance + risk + quality → trust_score + trust_level. See trust lifecycle.
Identity, passport · reputation
POST /api/v1/passport/issue no auth
Issue an Agent Passport. Supply evidence to derive the whole stack, or pass identity/trust_profile explicitly (they take precedence).
json request
{ "evidence": { /* … */ } } // or { "identity": {…}, "trust_profile": {…} }POST /api/v1/reputation/assess no auth
Longitudinal reputation. Supply evidence (composes the full chain) or explicit identity/trust_profile/passport.
Registry API path
The registry indexes agents across operations. observe composes and records whichever layers are present; the GETs read them back.
POST /api/v1/registry/observe no auth
Observe an agent into the in-memory registry. Idempotent per agent (upsert). Accepts evidence and/or explicit identity/trust_profile/passport/reputation.
GET /api/v1/registry/agents no auth
List all registry entries → { "agents": [...], "count": n }. No pagination, returns the full set.
GET /api/v1/registry/agents/{agent_id} no auth
Fetch one entry, or 404 if the agent is unknown.
Control Center API path
GET /api/v1/control-center/overview no auth
Fleet-wide aggregate over the in-memory registry, totals, active agents, average trust/reputation, and level counts. Read-only; safe on an empty registry. See Control Center ↔ Runtime.
/api/v1/control-center/overview is the open fleet overview over the trust registry. The authenticated Control Center data plane (sessions, receipts, evidence bundles, members) lives under /api/control/* and needs an API key, see authenticated APIs.Signals export API path
POST /api/v1/signals/export no auth
Generate a deterministic SignalExport. Supply evidence to compose the chain, or any explicit layer (takes precedence). GENERATION ONLY, no networking, no WIW communication. See signal lifecycle.
Legacy validation & Sentinel (open)
| Method · Path | Purpose | Status |
|---|---|---|
GET /health | liveness + version | 200 |
POST /validate | single-text validation | 201 · 502 on engine error |
POST /pipeline | full validation pipeline (rules, invariants, schema) | 201 |
GET /validations · /validations/{id} | list / fetch validations (limit,offset) | 200 · 404 |
GET /pipeline/runs · /pipeline/runs/{id} | list / fetch pipeline runs (limit,offset) | 200 · 404 |
POST /dev/audit | audit AI-generated code (intent vs. reality) | 201 · 502 |
POST /sentinel/verify | browser-extension hallucination check → ACCEPT/REVIEW/REJECT | 200 · 502 |
First audit API path
The canonical first integration: audit once, then compose everything from the returned evidence. Keep the full EvidenceEnvelope (the audit response returns identifiers plus the receipt/provenance; the complete envelope that drives assessments is the sample-evidence.json shape).
sequenceDiagram
autonumber
participant C as Client
participant API as VerifAIer
C->>API: POST /api/v1/audit/conversation {input}
API-->>C: 200 verdict + envelope + receipt + provenance
Note over C: keep the FULL EvidenceEnvelope (sample-evidence.json)
C->>API: POST /api/v1/trust/assess {evidence}
API-->>C: 200 trust_score + trust_level
C->>API: POST /api/v1/passport/issue {evidence}
API-->>C: 200 passport (status active)
C->>API: POST /api/v1/registry/observe {evidence}
API-->>C: 200 registry entry
C->>API: GET /api/v1/control-center/overview
API-->>C: 200 fleet overview
First-audit API path, audit then compose assessments from the envelope. Grounded in api/routes.py.Runnable end-to-end examples (curl / Python / TypeScript) are on the examples page, and a downloadable sample project ships with First audit.
Dashboard API path
The enterprise dashboard is a static client of these same open endpoints (its base URL resolves to http://localhost:8000 when opened from a file). It calls only the open /api/v1 surface, no credentials, via dashboard/js/api.js:
| Dashboard action | Endpoint |
|---|---|
| Fleet overview | GET /api/v1/control-center/overview |
| Agents list / detail | GET /api/v1/registry/agents · /agents/{id} |
| Assess panels | POST /api/v1/{trust,risk,quality,compliance}/assess |
| Passport / reputation | POST /api/v1/passport/issue · /reputation/assess |
| Signals | POST /api/v1/signals/export |
See Dashboard ↔ APIs for the base-URL resolution logic.