API reference · OpenAPI 3.1.0 · version 1.0.0

92 endpoints. Not one accepts a price.

The whole interface of the Mirror operator, rendered from the same openapi.json the SDKs are built against. 58 endpoints answer with a signed record you can verify offline, 46 need no credential at all, and every request body refuses the raw trade fields - value, unit, band, salt - with 400 raw_leaked.

92 endpoints12 groups58 signed answers46 open3 webhook events

Download openapi.json · 226 KB The SDKs

Health and keys 9 endpoints

GET/healthLiveness and posture: leg-authentication mode, join-key posture, every route, how this host delivers webhooks.Open

Credential: None - open to anyone
Answers: 200OK
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
503The operator cannot sign, or its store is unavailable.

GET/jwksThe operator's public ES256 signing keys. Everything the operator signs verifies against this, offline.Open

Credential: None - open to anyone
Answers: 200OK
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
503The operator cannot sign, or its store is unavailable.

GET/registryThe governance registry as folded from quorum-ratified events: members, witnesses, corridors.Open

Credential: None - open to anyone
Answers: 200OK
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
503The operator cannot sign, or its store is unavailable.

GET/public/registryThe public transparency registry: table hashes, member keys and the log head. Leak-checked before it serves; signed.SignedOpen

Credential: None - open to anyone
Answers: 200A signed record: verify offline against /jwks.
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
503The operator cannot sign, or its store is unavailable.

GET/keysThe key registry folded from signed key.register / rotate / revoke events.Open

Credential: None - open to anyone
Answers: 200OK
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
503The operator cannot sign, or its store is unavailable.

GET/roadmapThe roadmap's Refused list, binding under change control, with the published page pinned by hash. Signed.SignedOpen

Credential: None - open to anyone
Answers: 200A signed record: verify offline against /jwks.
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
503The operator cannot sign, or its store is unavailable.

GET/cannotThe refusal list as a contract: every refusal, its code, what enforces it. Change-controlled and signed.SignedOpen

Credential: None - open to anyone
Answers: 200A signed record: verify offline against /jwks.
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
503The operator cannot sign, or its store is unavailable.

GET/residencyWhere this operator processes and stores what it receives: a jurisdiction per fact, whether it is observed at runtime or only declared, and what the statement does not cover. Check it with mirror-residency meets(). Signed.SignedOpen

Credential: None - open to anyone
Answers: 200A signed record: verify offline against /jwks.
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
503The operator cannot sign, or its store is unavailable.

POST/timeThe operator's clock, signed and bound to your nonce. Bound the offset from your own round trip (mirror-clock assess).SignedOpen

Credential: None - open to anyone
Body: TimeRequest · requires nonce
Refused: All 25 raw trade fields, at any depth - the list · 400 raw_leaked
Answers: 200A signed record: verify offline against /jwks.
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
503The operator cannot sign, or its store is unavailable.

Perpetual KYC 4 endpoints

GET/pkyc/basesThe legal bases under which a cross-institution trigger may be shared.Open

Credential: None - open to anyone
Answers: 200OK
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
503The operator cannot sign, or its store is unavailable.

POST/pkyc/triggerPropagate a trigger about an entity commitment (opaque; never a name or a reason).Credential

Credential: member session or pilot token
Body: Object
Refused: All 25 raw trade fields, at any depth - the list · 400 raw_leaked
Answers: 200OK
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
401Missing or wrong credential.
403A delegated desk key without the scope this route needs (`scope`; `needs` names it).
503The operator cannot sign, or its store is unavailable.

POST/pkyc/scoreFold your view of an entity commitment against the network triggers.Credential

Credential: member session or pilot token
Body: Object
Refused: All 25 raw trade fields, at any depth - the list · 400 raw_leaked
Answers: 200OK
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
401Missing or wrong credential.
403A delegated desk key without the scope this route needs (`scope`; `needs` names it).
503The operator cannot sign, or its store is unavailable.

POST/pkyc/corroborateWhich parties did two independent institutions flag?SignedCredential

Credential: member session or pilot token
Body: Object
Refused: All 25 raw trade fields, at any depth - the list · 400 raw_leaked
Answers: 200A signed record: verify offline against /jwks.
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
401Missing or wrong credential.
403A delegated desk key without the scope this route needs (`scope`; `needs` names it).
503The operator cannot sign, or its store is unavailable.

Evidence and conformance 14 endpoints

GET/conformance/challengeA conformance challenge (inputs only). Compute the commitments with your own code and POST them to /conformance/attest.Open

Credential: None - open to anyone
Query: seed string · n integer
Answers: 200OK
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
503The operator cannot sign, or its store is unavailable.

POST/packThe examiner pack: evidence that checks out with the operator switched off.Open

Credential: None - open to anyone
Body: Object
Refused: All 25 raw trade fields, at any depth - the list · 400 raw_leaked
Answers: 200OK
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
503The operator cannot sign, or its store is unavailable.

POST/digestThe completeness digest: a signed anti-cherry-pick commitment over a period.SignedOpen

Credential: None - open to anyone
Body: Object
Refused: All 25 raw trade fields, at any depth - the list · 400 raw_leaked
Answers: 200A signed record: verify offline against /jwks.
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
503The operator cannot sign, or its store is unavailable.

POST/dossierThe model-validation dossier.SignedOpen

Credential: None - open to anyone
Body: Object
Refused: All 25 raw trade fields, at any depth - the list · 400 raw_leaked
Answers: 200A signed record: verify offline against /jwks.
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
503The operator cannot sign, or its store is unavailable.

POST/cbomThe cryptographic bill of materials.SignedOpen

Credential: None - open to anyone
Body: Object
Refused: All 25 raw trade fields, at any depth - the list · 400 raw_leaked
Answers: 200A signed record: verify offline against /jwks.
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
503The operator cannot sign, or its store is unavailable.

POST/conformance/attestSubmit your implementation's answers to a challenge; all must match for a signed certificate.SignedOpen

Credential: None - open to anyone
Body: Object
Refused: All 25 raw trade fields, at any depth - the list · 400 raw_leaked
Answers: 200A signed record: verify offline against /jwks.
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
503The operator cannot sign, or its store is unavailable.

POST/conformance/directoryThe public directory of certified implementations, each re-verified.SignedOpen

Credential: None - open to anyone
Body: Object
Refused: All 25 raw trade fields, at any depth - the list · 400 raw_leaked
Answers: 200A signed record: verify offline against /jwks.
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
503The operator cannot sign, or its store is unavailable.

POST/cosignCombine independently signed verdicts from several operators (k-of-n).Open

Credential: None - open to anyone
Body: Object
Refused: All 25 raw trade fields, at any depth - the list · 400 raw_leaked
Answers: 200OK
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
503The operator cannot sign, or its store is unavailable.

POST/release/timingWas the money released before screening finished?Open

Credential: None - open to anyone
Body: Object
Refused: All 25 raw trade fields, at any depth - the list · 400 raw_leaked
Answers: 200OK
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
503The operator cannot sign, or its store is unavailable.

POST/provenance/verifyWho chose these band edges, and from what?Open

Credential: None - open to anyone
Body: Object
Refused: All 25 raw trade fields, at any depth - the list · 400 raw_leaked
Answers: 200OK
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
503The operator cannot sign, or its store is unavailable.

POST/succession/verifyVerify an operator succession handover.Open

Credential: None - open to anyone
Body: Object
Refused: All 25 raw trade fields, at any depth - the list · 400 raw_leaked
Answers: 200OK
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
503The operator cannot sign, or its store is unavailable.

POST/billing/statementA billing statement from governance facts and your rate card. No per-verdict or volume line exists.SignedCredential

Credential: member session or pilot token
Body: Object
Refused: All 25 raw trade fields, at any depth - the list · 400 raw_leaked
Answers: 200A signed record: verify offline against /jwks.
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
401Missing or wrong credential.
403A delegated desk key without the scope this route needs (`scope`; `needs` names it).
503The operator cannot sign, or its store is unavailable.

POST/escrow/sealStore an opaque, member-sealed salt-continuity blob the operator cannot open.Credential

Credential: member session or pilot token
Body: Object
Refused: All 25 raw trade fields, at any depth - the list · 400 raw_leaked
Answers: 200OK
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
401Missing or wrong credential.
403A delegated desk key without the scope this route needs (`scope`; `needs` names it).
503The operator cannot sign, or its store is unavailable.

POST/escrow/proveProve an escrow envelope is held.Open

Credential: None - open to anyone
Body: Object
Refused: All 25 raw trade fields, at any depth - the list · 400 raw_leaked
Answers: 200OK
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
503The operator cannot sign, or its store is unavailable.

Reconciliation 14 endpoints

GET/corridor/certificateThe geometry certificate of a ratified corridor: the widest mispricing that still reconciles, as a ratio and per unit. Query: product, version.SignedOpen

Credential: None - open to anyone
Query: product string · version integer
Answers: 200A signed record: verify offline against /jwks.
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
503The operator cannot sign, or its store is unavailable.

POST/reconcileReconcile one shipment's committed legs. Signed verdict: reconciled, divergent or undetermined - never a score. Pushes verdict.signed to the proven parties.SignedCredential

Credential: member session or pilot token
Body: ReconcileRequest · requires legs · also shipment_ref, policy, physical_measurements, cargo
Refused: All 25 raw trade fields, at any depth - the list · 400 raw_leaked
Answers: 200A signed record: verify offline against /jwks.
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
401Missing or wrong credential.
403A delegated desk key without the scope this route needs (`scope`; `needs` names it).
503The operator cannot sign, or its store is unavailable.

POST/reconcile/dimensionsReconcile quantity and unit price separately; clears only if both agree.SignedCredential

Credential: member session or pilot token
Body: ReconcileDimensionsRequest · requires legs · also shipment_ref, locator, policy
Refused: All 25 raw trade fields, at any depth - the list · 400 raw_leaked
Answers: 200A signed record: verify offline against /jwks.
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
401Missing or wrong credential.
403A delegated desk key without the scope this route needs (`scope`; `needs` names it).
503The operator cannot sign, or its store is unavailable.

POST/verifyVerify a signed record against the operator JWKS and the refusal list.Open

Credential: None - open to anyone
Body: SignedRecord · requires record, proof
Answers: 200OK
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
503The operator cannot sign, or its store is unavailable.

POST/verify-atWas the signing key valid at the moment the record was signed?Open

Credential: None - open to anyone
Body: Object
Refused: All 25 raw trade fields, at any depth - the list · 400 raw_leaked
Answers: 200OK
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
503The operator cannot sign, or its store is unavailable.

POST/undeterminedThe undetermined burn-down: why verdicts could not be reached, by reason, in counts.SignedCredential

Credential: member session or pilot token
Body: Object
Refused: All 25 raw trade fields, at any depth - the list · 400 raw_leaked
Answers: 200A signed record: verify offline against /jwks.
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
401Missing or wrong credential.
403A delegated desk key without the scope this route needs (`scope`; `needs` names it).
503The operator cannot sign, or its store is unavailable.

POST/independenceWhat a clear actually rests on: which parties, by ratified class.Open

Credential: None - open to anyone
Body: Object
Refused: All 25 raw trade fields, at any depth - the list · 400 raw_leaked
Answers: 200OK
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
503The operator cannot sign, or its store is unavailable.

POST/autopsyThe synthetic autopsy: the operator measuring its own blind spot on planted cases.SignedOpen

Credential: None - open to anyone
Body: Object
Refused: All 25 raw trade fields, at any depth - the list · 400 raw_leaked
Answers: 200A signed record: verify offline against /jwks.
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
503The operator cannot sign, or its store is unavailable.

POST/certificateA reconciliation track record as a portable, offline-checkable certificate.SignedCredential

Credential: member session or pilot token
Body: Object
Refused: All 25 raw trade fields, at any depth - the list · 400 raw_leaked
Answers: 200A signed record: verify offline against /jwks.
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
401Missing or wrong credential.
403A delegated desk key without the scope this route needs (`scope`; `needs` names it).
503The operator cannot sign, or its store is unavailable.

POST/bookThe corridor book: the full ratified lineage of a corridor, signed.SignedCredential

Credential: member session or pilot token
Body: Object
Refused: All 25 raw trade fields, at any depth - the list · 400 raw_leaked
Answers: 200A signed record: verify offline against /jwks.
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
401Missing or wrong credential.
403A delegated desk key without the scope this route needs (`scope`; `needs` names it).
503The operator cannot sign, or its store is unavailable.

POST/corridor/driftHas a ratified price table fallen behind the market? Measured from the operator's own signed verdicts.SignedCredential

Credential: member session or pilot token
Body: Object
Refused: All 25 raw trade fields, at any depth - the list · 400 raw_leaked
Answers: 200A signed record: verify offline against /jwks.
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
401Missing or wrong credential.
403A delegated desk key without the scope this route needs (`scope`; `needs` names it).
503The operator cannot sign, or its store is unavailable.

POST/corridor/geometryHow much mispricing an agreed table cannot see, per band. Pure arithmetic on the table you send.Open

Credential: None - open to anyone
Body: Object
Refused: All 25 raw trade fields, at any depth - the list · 400 raw_leaked
Answers: 200OK
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
503The operator cannot sign, or its store is unavailable.

POST/bander/agreementDid every leg come from a bander both parties recognise? Standalone agreement and attestation check.Open

Credential: None - open to anyone
Body: Object
Refused: All 25 raw trade fields, at any depth - the list · 400 raw_leaked
Answers: 200OK
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
503The operator cannot sign, or its store is unavailable.

POST/replayA period of history as one bound, signed report.SignedOpen

Credential: None - open to anyone
Body: Object
Refused: All 25 raw trade fields, at any depth - the list · 400 raw_leaked
Answers: 200A signed record: verify offline against /jwks.
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
503The operator cannot sign, or its store is unavailable.

Sign-in 3 endpoints

POST/auth/challengeAsk for a single-use challenge for a ratified member key.Open

Credential: None - open to anyone
Body: AuthChallengeRequest · requires kid · also delegation
Refused: All 25 raw trade fields, at any depth - the list · 400 raw_leaked
Answers: 200OK
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
503The operator cannot sign, or its store is unavailable.

POST/auth/sessionPresent the signed challenge; receive a short-lived member session.Open

Credential: None - open to anyone
Body: AuthSessionRequest · requires challenge, signature · also kid, delegation
Refused: All 25 raw trade fields, at any depth - the list · 400 raw_leaked
Answers: 200OK
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
503The operator cannot sign, or its store is unavailable.

POST/auth/whoamiWhich member (if any) this credential identifies - and, for a delegated desk key, its scopes.Open

Credential: None - open to anyone
Body: Empty
Refused: All 25 raw trade fields, at any depth - the list · 400 raw_leaked
Answers: 200OK
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
503The operator cannot sign, or its store is unavailable.

Governance 6 endpoints

POST/registry/eventSubmit a member-signed governance event (propose, ratify, suspend...). Folded by quorum. A witness suspended at quorum pushes recall.notice.Credential

Credential: member session or pilot token
Body: RegistryEventRequest · requires event
Refused: All 25 raw trade fields, at any depth - the list · 400 raw_leaked
Answers: 200OK
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
401Missing or wrong credential.
403A delegated desk key without the scope this route needs (`scope`; `needs` names it).
503The operator cannot sign, or its store is unavailable.

POST/charter/buildBuild a corridor charter: make the next corridor a countersignature, not a committee.SignedCredential

Credential: member session or pilot token
Body: Object
Refused: All 25 raw trade fields, at any depth - the list · 400 raw_leaked
Answers: 200A signed record: verify offline against /jwks.
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
401Missing or wrong credential.
403A delegated desk key without the scope this route needs (`scope`; `needs` names it).
503The operator cannot sign, or its store is unavailable.

POST/charter/statusWhere a corridor charter stands.SignedCredential

Credential: member session or pilot token
Body: Object
Refused: All 25 raw trade fields, at any depth - the list · 400 raw_leaked
Answers: 200A signed record: verify offline against /jwks.
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
401Missing or wrong credential.
403A delegated desk key without the scope this route needs (`scope`; `needs` names it).
503The operator cannot sign, or its store is unavailable.

POST/ceremony/confirmConfirm the corridor setup ceremony: proof of possession of the shared corridor key.SignedCredential

Credential: member session or pilot token
Body: Object
Refused: All 25 raw trade fields, at any depth - the list · 400 raw_leaked
Answers: 200A signed record: verify offline against /jwks.
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
401Missing or wrong credential.
403A delegated desk key without the scope this route needs (`scope`; `needs` names it).
503The operator cannot sign, or its store is unavailable.

POST/ceremony/assessAssess whether a corridor's setup ceremony is complete.SignedCredential

Credential: member session or pilot token
Body: Object
Refused: All 25 raw trade fields, at any depth - the list · 400 raw_leaked
Answers: 200A signed record: verify offline against /jwks.
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
401Missing or wrong credential.
403A delegated desk key without the scope this route needs (`scope`; `needs` names it).
503The operator cannot sign, or its store is unavailable.

POST/demo/genesisDEMO ONLY: mint a member identity in the browser. 404 unless the operator runs in demo mode.Open

Credential: None - open to anyone
Body: Object
Refused: All 25 raw trade fields, at any depth - the list · 400 raw_leaked
Answers: 200OK
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
503The operator cannot sign, or its store is unavailable.

Witnesses and recall 6 endpoints

POST/recall/noticeWhich of MY clears rested on a witness that has fallen? Per member, signed. Never a re-judgement.SignedCredential

Credential: member session
Body: RecallRequest · requires witness_kid · also k_min
Refused: All 25 raw trade fields, at any depth - the list · 400 raw_leaked
Answers: 200A signed record: verify offline against /jwks.
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
401Missing or wrong credential - a member session is required; the shared pilot token names no institution.
403A delegated desk key without the scope this route needs (`scope`; `needs` names it).
503The operator cannot sign, or its store is unavailable.

POST/recall/summaryCross-member recall totals, withheld below k.SignedCredential

Credential: member session
Body: RecallRequest · requires witness_kid · also k_min
Refused: All 25 raw trade fields, at any depth - the list · 400 raw_leaked
Answers: 200A signed record: verify offline against /jwks.
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
401Missing or wrong credential - a member session is required; the shared pilot token names no institution.
403A delegated desk key without the scope this route needs (`scope`; `needs` names it).
503The operator cannot sign, or its store is unavailable.

POST/witness/forksDid a witness key sign two histories? Folds the bulletin heads in the ledger plus any you bring.SignedCredential

Credential: member session or pilot token
Body: WitnessForksRequest · also heads, links
Refused: All 25 raw trade fields, at any depth - the list · 400 raw_leaked
Answers: 200A signed record: verify offline against /jwks.
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
401Missing or wrong credential.
403A delegated desk key without the scope this route needs (`scope`; `needs` names it).
503The operator cannot sign, or its store is unavailable.

POST/coverage/ghostThe ghost-corridor coverage certificate: where a required leg is structurally absent, in counts.SignedCredential

Credential: member session or pilot token
Body: Object
Refused: All 25 raw trade fields, at any depth - the list · 400 raw_leaked
Answers: 200A signed record: verify offline against /jwks.
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
401Missing or wrong credential.
403A delegated desk key without the scope this route needs (`scope`; `needs` names it).
503The operator cannot sign, or its store is unavailable.

POST/path/certificateThe cargo path: one certificate per cargo, in counts, with inclusion proofs.SignedCredential

Credential: member session or pilot token
Body: Object
Refused: All 25 raw trade fields, at any depth - the list · 400 raw_leaked
Answers: 200A signed record: verify offline against /jwks.
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
401Missing or wrong credential.
403A delegated desk key without the scope this route needs (`scope`; `needs` names it).
503The operator cannot sign, or its store is unavailable.

POST/audit/exportYour own signed records as SIEM lines (application/x-ndjson in `ndjson`), with a cursor to pull on a schedule. Every line names a signed record; the batch is signed.SignedCredential

Credential: member session
Body: AuditExportRequest · also cursor, since_ms, limit, include_records
Refused: All 25 raw trade fields, at any depth - the list · 400 raw_leaked
Answers: 200A signed record: verify offline against /jwks.
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
401Missing or wrong credential - a member session is required; the shared pilot token names no institution.
403A delegated desk key without the scope this route needs (`scope`; `needs` names it).
503The operator cannot sign, or its store is unavailable.

Webhooks 5 endpoints

POST/webhooks/subscribeRegister an https endpoint for signed pushes. Idempotent per (member, url, events). Returns a signed receipt.SignedCredential

Credential: member session
Body: WebhookSubscribeRequest · requires url · also events
Refused: All 25 raw trade fields, at any depth - the list · 400 raw_leaked
Answers: 200A signed record: verify offline against /jwks.
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
401Missing or wrong credential - a member session is required; the shared pilot token names no institution.
403A delegated desk key without the scope this route needs (`scope`; `needs` names it).
503The operator cannot sign, or its store is unavailable.

POST/webhooks/listYour subscriptions and your recent deliveries (state, attempts, next attempt).Credential

Credential: member session
Body: Empty
Refused: All 25 raw trade fields, at any depth - the list · 400 raw_leaked
Answers: 200OK
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
401Missing or wrong credential - a member session is required; the shared pilot token names no institution.
403A delegated desk key without the scope this route needs (`scope`; `needs` names it).
503The operator cannot sign, or its store is unavailable.

POST/webhooks/unsubscribeRemove one of your subscriptions.Credential

Credential: member session
Body: WebhookIdRequest · requires id
Refused: All 25 raw trade fields, at any depth - the list · 400 raw_leaked
Answers: 200OK
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
401Missing or wrong credential - a member session is required; the shared pilot token names no institution.
403A delegated desk key without the scope this route needs (`scope`; `needs` names it).
503The operator cannot sign, or its store is unavailable.

POST/webhooks/pingQueue a signed test delivery to one of your subscriptions.Credential

Credential: member session
Body: WebhookIdRequest · requires id
Refused: All 25 raw trade fields, at any depth - the list · 400 raw_leaked
Answers: 200OK
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
401Missing or wrong credential - a member session is required; the shared pilot token names no institution.
403A delegated desk key without the scope this route needs (`scope`; `needs` names it).
503The operator cannot sign, or its store is unavailable.

POST/webhooks/redeliverRequeue one of your dead or gone deliveries.Credential

Credential: member session
Body: WebhookRedeliverRequest · requires delivery_id
Refused: All 25 raw trade fields, at any depth - the list · 400 raw_leaked
Answers: 200OK
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
401Missing or wrong credential - a member session is required; the shared pilot token names no institution.
403A delegated desk key without the scope this route needs (`scope`; `needs` names it).
503The operator cannot sign, or its store is unavailable.

Transparency log 9 endpoints

POST/anchor/headThe signed tree head over the verdict ledger (Certificate-Transparency shaped).SignedOpen

Credential: None - open to anyone
Body: Object
Refused: All 25 raw trade fields, at any depth - the list · 400 raw_leaked
Answers: 200A signed record: verify offline against /jwks.
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
503The operator cannot sign, or its store is unavailable.

POST/anchor/consistencyProve a later head extends an earlier one.SignedOpen

Credential: None - open to anyone
Body: Object
Refused: All 25 raw trade fields, at any depth - the list · 400 raw_leaked
Answers: 200A signed record: verify offline against /jwks.
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
503The operator cannot sign, or its store is unavailable.

POST/anchor/orderProve one entry was logged before another existed.SignedOpen

Credential: None - open to anyone
Body: Object
Refused: All 25 raw trade fields, at any depth - the list · 400 raw_leaked
Answers: 200A signed record: verify offline against /jwks.
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
503The operator cannot sign, or its store is unavailable.

POST/anchor/witnessWitness cosignatures over a head.SignedOpen

Credential: None - open to anyone
Body: Object
Refused: All 25 raw trade fields, at any depth - the list · 400 raw_leaked
Answers: 200A signed record: verify offline against /jwks.
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
503The operator cannot sign, or its store is unavailable.

POST/anchor/gossipMembers compare the signed heads they were shown; a split view is evidence.SignedOpen

Credential: None - open to anyone
Body: Object
Refused: All 25 raw trade fields, at any depth - the list · 400 raw_leaked
Answers: 200A signed record: verify offline against /jwks.
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
503The operator cannot sign, or its store is unavailable.

POST/absence/headThe head of the absence log.SignedOpen

Credential: None - open to anyone
Body: Object
Refused: All 25 raw trade fields, at any depth - the list · 400 raw_leaked
Answers: 200A signed record: verify offline against /jwks.
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
503The operator cannot sign, or its store is unavailable.

POST/absence/proveProve you never cleared a given reference.SignedOpen

Credential: None - open to anyone
Body: Object
Refused: All 25 raw trade fields, at any depth - the list · 400 raw_leaked
Answers: 200A signed record: verify offline against /jwks.
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
503The operator cannot sign, or its store is unavailable.

POST/archiveThe sealed verification bundle a regulator keeps.SignedOpen

Credential: None - open to anyone
Body: Object
Refused: All 25 raw trade fields, at any depth - the list · 400 raw_leaked
Answers: 200A signed record: verify offline against /jwks.
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
503The operator cannot sign, or its store is unavailable.

POST/escrow/bundleAlias of /archive: the sealed verification bundle.SignedCredential

Credential: member session or pilot token
Body: Object
Refused: All 25 raw trade fields, at any depth - the list · 400 raw_leaked
Answers: 200A signed record: verify offline against /jwks.
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
401Missing or wrong credential.
403A delegated desk key without the scope this route needs (`scope`; `needs` names it).
503The operator cannot sign, or its store is unavailable.

Disputes and resolution 5 endpoints

POST/dispute/openOpen a dispute on a divergence.SignedCredential

Credential: member session or pilot token
Body: Object
Refused: All 25 raw trade fields, at any depth - the list · 400 raw_leaked
Answers: 200A signed record: verify offline against /jwks.
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
401Missing or wrong credential.
403A delegated desk key without the scope this route needs (`scope`; `needs` names it).
503The operator cannot sign, or its store is unavailable.

POST/dispute/respondRespond to a dispute.SignedCredential

Credential: member session or pilot token
Body: Object
Refused: All 25 raw trade fields, at any depth - the list · 400 raw_leaked
Answers: 200A signed record: verify offline against /jwks.
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
401Missing or wrong credential.
403A delegated desk key without the scope this route needs (`scope`; `needs` names it).
503The operator cannot sign, or its store is unavailable.

POST/dispute/closeClose a dispute.SignedCredential

Credential: member session or pilot token
Body: Object
Refused: All 25 raw trade fields, at any depth - the list · 400 raw_leaked
Answers: 200A signed record: verify offline against /jwks.
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
401Missing or wrong credential.
403A delegated desk key without the scope this route needs (`scope`; `needs` names it).
503The operator cannot sign, or its store is unavailable.

POST/resolution/recordRecord how a divergence resolved, in a closed vocabulary (never a filing decision).Credential

Credential: member session or pilot token
Body: Object
Refused: All 25 raw trade fields, at any depth - the list · 400 raw_leaked
Answers: 200OK
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
401Missing or wrong credential.
403A delegated desk key without the scope this route needs (`scope`; `needs` names it).
503The operator cannot sign, or its store is unavailable.

POST/resolution/ledgerThe resolution ledger, in counts.SignedCredential

Credential: member session or pilot token
Body: Object
Refused: All 25 raw trade fields, at any depth - the list · 400 raw_leaked
Answers: 200A signed record: verify offline against /jwks.
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
401Missing or wrong credential.
403A delegated desk key without the scope this route needs (`scope`; `needs` names it).
503The operator cannot sign, or its store is unavailable.

Disclosure and supervision 9 endpoints

POST/disclosure/requestRequest a disclosure under a stated basis.SignedCredential

Credential: member session or pilot token
Body: Object
Refused: All 25 raw trade fields, at any depth - the list · 400 raw_leaked
Answers: 200A signed record: verify offline against /jwks.
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
401Missing or wrong credential.
403A delegated desk key without the scope this route needs (`scope`; `needs` names it).
503The operator cannot sign, or its store is unavailable.

POST/disclosure/grantGrant a disclosure request.SignedCredential

Credential: member session or pilot token
Body: Object
Refused: All 25 raw trade fields, at any depth - the list · 400 raw_leaked
Answers: 200A signed record: verify offline against /jwks.
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
401Missing or wrong credential.
403A delegated desk key without the scope this route needs (`scope`; `needs` names it).
503The operator cannot sign, or its store is unavailable.

POST/disclosure/refuseRefuse a disclosure request.SignedCredential

Credential: member session or pilot token
Body: Object
Refused: All 25 raw trade fields, at any depth - the list · 400 raw_leaked
Answers: 200A signed record: verify offline against /jwks.
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
401Missing or wrong credential.
403A delegated desk key without the scope this route needs (`scope`; `needs` names it).
503The operator cannot sign, or its store is unavailable.

POST/disclosure/ledgerThe disclosure ledger.SignedCredential

Credential: member session or pilot token
Body: Object
Refused: All 25 raw trade fields, at any depth - the list · 400 raw_leaked
Answers: 200A signed record: verify offline against /jwks.
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
401Missing or wrong credential.
403A delegated desk key without the scope this route needs (`scope`; `needs` names it).
503The operator cannot sign, or its store is unavailable.

POST/discloseRedactable disclosure: prove one field of a verdict, withhold the rest.SignedCredential

Credential: member session or pilot token
Body: Object
Refused: All 25 raw trade fields, at any depth - the list · 400 raw_leaked
Answers: 200A signed record: verify offline against /jwks.
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
401Missing or wrong credential.
403A delegated desk key without the scope this route needs (`scope`; `needs` names it).
503The operator cannot sign, or its store is unavailable.

POST/verify-disclosureVerify a redactable disclosure.Open

Credential: None - open to anyone
Body: Object
Refused: All 25 raw trade fields, at any depth - the list · 400 raw_leaked
Answers: 200OK
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
503The operator cannot sign, or its store is unavailable.

POST/supervisor/feedThe supervisor seat: everything a regulator watches, in one call.SignedCredential

Credential: member session or pilot token
Body: Object
Refused: All 25 raw trade fields, at any depth - the list · 400 raw_leaked
Answers: 200A signed record: verify offline against /jwks.
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
401Missing or wrong credential.
403A delegated desk key without the scope this route needs (`scope`; `needs` names it).
503The operator cannot sign, or its store is unavailable.

POST/superviseRegulator read-only node: consistency proofs and equivocation detection over heads you bring.Open

Credential: None - open to anyone
Body: Object
Refused: All 25 raw trade fields, at any depth - the list · 400 raw_leaked
Answers: 200OK
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
503The operator cannot sign, or its store is unavailable.

POST/supervise/crosscheckCross-check two supervisors' views.Open

Credential: None - open to anyone
Body: Object
Refused: All 25 raw trade fields, at any depth - the list · 400 raw_leaked
Answers: 200OK
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
503The operator cannot sign, or its store is unavailable.

Flows and structure 8 endpoints

POST/flow/cyclesClosed trade loops over an opaque flow graph.SignedCredential

Credential: member session or pilot token
Body: Object
Refused: All 25 raw trade fields, at any depth - the list · 400 raw_leaked
Answers: 200A signed record: verify offline against /jwks.
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
401Missing or wrong credential.
403A delegated desk key without the scope this route needs (`scope`; `needs` names it).
503The operator cannot sign, or its store is unavailable.

POST/flow/gateThe k-anonymity gate in front of the flow graph.SignedCredential

Credential: member session or pilot token
Body: Object
Refused: All 25 raw trade fields, at any depth - the list · 400 raw_leaked
Answers: 200A signed record: verify offline against /jwks.
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
401Missing or wrong credential.
403A delegated desk key without the scope this route needs (`scope`; `needs` names it).
503The operator cannot sign, or its store is unavailable.

POST/attribute/reconcileBlind attribute reconciliation (ESG, dual-use, sanctions attributes).SignedCredential

Credential: member session or pilot token
Body: Object
Refused: All 25 raw trade fields, at any depth - the list · 400 raw_leaked
Answers: 200A signed record: verify offline against /jwks.
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
401Missing or wrong credential.
403A delegated desk key without the scope this route needs (`scope`; `needs` names it).
503The operator cannot sign, or its store is unavailable.

POST/chain/assessN-party chain balance: hop adjacency and accumulated tolerance drift.SignedCredential

Credential: member session or pilot token
Body: Object
Refused: All 25 raw trade fields, at any depth - the list · 400 raw_leaked
Answers: 200A signed record: verify offline against /jwks.
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
401Missing or wrong credential.
403A delegated desk key without the scope this route needs (`scope`; `needs` names it).
503The operator cannot sign, or its store is unavailable.

POST/exposure/commitCommit your financing exposure on one opaque document (duplicate-financing detection).Credential

Credential: member session or pilot token
Body: Object
Refused: All 25 raw trade fields, at any depth - the list · 400 raw_leaked
Answers: 200OK
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
401Missing or wrong credential.
403A delegated desk key without the scope this route needs (`scope`; `needs` names it).
503The operator cannot sign, or its store is unavailable.

POST/exposure/collisionsAsk about a document you committed: is anyone else financing it?SignedCredential

Credential: member session or pilot token
Body: Object
Refused: All 25 raw trade fields, at any depth - the list · 400 raw_leaked
Answers: 200A signed record: verify offline against /jwks.
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
401Missing or wrong credential.
403A delegated desk key without the scope this route needs (`scope`; `needs` names it).
503The operator cannot sign, or its store is unavailable.

POST/macroMirror statistics: divergence rate and velocity per corridor, k-gated, every rate with its denominator.SignedOpen

Credential: None - open to anyone
Body: Object
Refused: All 25 raw trade fields, at any depth - the list · 400 raw_leaked
Answers: 200A signed record: verify offline against /jwks.
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
503The operator cannot sign, or its store is unavailable.

POST/weatherCross-corridor structure counts, released only above the k-anonymity gate.SignedCredential

Credential: member session or pilot token
Body: Object
Refused: All 25 raw trade fields, at any depth - the list · 400 raw_leaked
Answers: 200A signed record: verify offline against /jwks.
400Refused: a malformed request, raw trade data (raw_leaked), a filing decision (sar_wall), or a route-specific refusal.
401Missing or wrong credential.
403A delegated desk key without the scope this route needs (`scope`; `needs` names it).
503The operator cannot sign, or its store is unavailable.

Rendered at build time from /openapi.json · sha256 aeffb702d53fb1ff… · generated by server/openapi.js and drift-tested against the operator by server/openapi.test.js

What no endpoint accepts

25 fields refused at the door, on every route, at any depth.

Not filtered, not stripped: a request carrying any of these is refused with 400 raw_leaked before a route reads it. A filing decision is refused the same way, with 400 sar_wall - see the filing-term corpus.

valueunit_qtybandcorridor_edgesshared_secretsaltquantityunit_pricetotal_valuequantity_edgesunit_price_edgestotal_value_edgesreceipt_secretmeasured_kgdeclared_kgtable_edgesfine_edgesreference_pricemeasured_gradedeclared_gradecertificate_secretdoc_saltcontainercontainer_numbercargo_key

Webhooks

3 events the operator pushes to you.

Delivered at least once, signed, with a delivery id a receiver in any language can recompute. See the webhook guide.

verdict.signed

A verdict was signed on a shipment where YOUR leg authenticated.

Delivered at least once, by the operator, to members subscribed to `verdict.signed`. Headers: Mirror-Delivery (the id), Mirror-Event, Mirror-Attempt. Answer 2xx to acknowledge (a duplicate too); 410 retires the endpoint and pauses the subscription; anything else is retried at 0s, 30s, 2m, 10m, 1h, 6h, 24h (plus up to 10% jitter), then the delivery is dead and stays listable.

Headers: Mirror-Delivery Mirror-Event Mirror-Attempt

recall.notice

A witness your clears rested on was suspended at quorum: your own signed recall notice.

Delivered at least once, by the operator, to members subscribed to `recall.notice`. Headers: Mirror-Delivery (the id), Mirror-Event, Mirror-Attempt. Answer 2xx to acknowledge (a duplicate too); 410 retires the endpoint and pauses the subscription; anything else is retried at 0s, 30s, 2m, 10m, 1h, 6h, 24h (plus up to 10% jitter), then the delivery is dead and stays listable.

Headers: Mirror-Delivery Mirror-Event Mirror-Attempt

webhook.ping

A test delivery you asked for with /webhooks/ping.

Delivered at least once, by the operator, to members subscribed to `webhook.ping`. Headers: Mirror-Delivery (the id), Mirror-Event, Mirror-Attempt. Answer 2xx to acknowledge (a duplicate too); 410 retires the endpoint and pauses the subscription; anything else is retried at 0s, 30s, 2m, 10m, 1h, 6h, 24h (plus up to 10% jitter), then the delivery is dead and stays listable.

Headers: Mirror-Delivery Mirror-Event Mirror-Attempt

Schemas

19 shapes, nothing hidden.

Every request and record the endpoints above name. Errors carry a stable code; the full taxonomy is signals.json, and what may change between versions is in the stability policy.

Error3 fields

errorrequiredstring
coderequiredA stable code; the full taxonomy is /signals.json.
hintstring

Proof5 fields

algrequired
kidrequiredstring
signaturerequiredbase64url, low-S
canonicalizationstring
notestring

SignedRecord2 fields

recordrequiredVerify as ES256 over the record's canonical JSON (recursively sorted keys) against /jwks, matching proof.kid.
proofrequiredProof

Objectobject · refuses 25 raw fields

Emptyobject · refuses 25 raw fields

AuthChallengeRequest2 fields · refuses 25 raw fields

kidrequiredstring
delegationfor a desk key: the member root's signed delegation (mirror-delegation)

AuditExportRequest4 fields · refuses 25 raw fields

cursorstring
since_msinteger
limitinteger
include_recordsboolean

TimeRequest1 field · refuses 25 raw fields

noncerequiredstring

AuthSessionRequest4 fields · refuses 25 raw fields

challengerequiredobject
signaturerequiredES256 over the canonical assertion record (mirror-auth assertionRecord)
kidstring
delegationSignedRecord

Leg10 fields · refuses 25 raw fields

rolerequiredstring
commitmentsrequiredarray of string
shipment_refstring
attestthe member's ES256 attestation over the leg envelope
banderobject
physicalobject
qualityobject
originobject
fineobject
basis_commitmentstring

ReconcileRequest5 fields · refuses 25 raw fields

shipment_refAn opaque locator commitment (l:<64 hex>). A plaintext reference is refused after 2026-12-01.
legsrequiredarray of Leg
policyobject
physical_measurementsWitness-signed measurements (terminal, weighbridge, assayer...)
cargoobject

ReconcileDimensionsRequest4 fields · refuses 25 raw fields

shipment_refstring
locatorstring
legsrequiredarray of object
policyobject

RegistryEventRequest1 field · refuses 25 raw fields

eventrequiredobject

RecallRequest2 fields · refuses 25 raw fields

witness_kidrequiredstring
k_mininteger

WitnessForksRequest2 fields · refuses 25 raw fields

headsarray of SignedRecord
linksarray of object

WebhookSubscribeRequest2 fields · refuses 25 raw fields

urlrequiredhttps, a public DNS name, no credentials
eventsarray of items

WebhookIdRequest1 field · refuses 25 raw fields

idrequiredstring

WebhookRedeliverRequest1 field · refuses 25 raw fields

delivery_idrequiredstring

WebhookDelivery2 fields

proofrequiredProof
recordrequiredobject