Reference

API reference

The public, unauthenticated routes. Every schema on this page is generated from the OpenAPI document, and CI checks that document against the running API handler.

Generated from apps/docs/openapi/public-api.openapi.json (Silvector public API, version 2026-11-07).

POST /v1/check

Decide one request shape and return a signed receipt

Runs the request shape through the public policy for tenant try. Rate limited to 60 requests a minute per caller. A signature field in the JSON body is ignored; only HTTP message signatures on the request can verify an agent.

curl -s https://api.silvector.com/v1/check \
  -H 'content-type: application/json' \
  -d '{"method":"GET","path":"/pricing"}'

const res = await fetch("https://api.silvector.com/v1/check", {
  method: "POST",
  headers: { "content-type": "application/json" },
  body: JSON.stringify({ method: "GET", path: "/pricing" }),
});
const { outcome, ruleId, receipt } = await res.json();

import json, urllib.request
req = urllib.request.Request("https://api.silvector.com/v1/check",
    data=json.dumps({"method": "GET", "path": "/pricing"}).encode(),
    headers={"content-type": "application/json"})
decision = json.load(urllib.request.urlopen(req))

res, err := http.Post("https://api.silvector.com/v1/check", "application/json",
	strings.NewReader(`{"method":"GET","path":"/pricing"}`))

No authentication. Up to 60 requests a minute per caller address, counted by each Worker instance; over that, 429. To verify the receipt, follow a quickstart.

Request body · CheckRequest

Responses

Example response REPLAY

Recorded from https://api.silvector.com on 2026-11-07. Outcome allow, rule allow.default.

{
  "status": 200,
  "outcome": "allow",
  "ruleId": "allow.default",
  "verdict": "not_identified",
  "reason": "no_claim",
  "method": "none",
  "ignoredSignatureField": false,
  "receiptId": "a2d418a873a3b2a1d575a3cdcea89eef2004d996776cf75973fcf7d2fdc1e093",
  "receipt": {
    "body": {
      "v": "ag47.receipt.v1",
      "ts_edge": 1794073836000,
      "tenant": "try",
      "agent_kid": "edge-receipt",
      "delegation": null,
      "action_hash": "d7777da76fba8007e1516a9cdb3ce3e9ee031f774c47bb510f9b3639f87b6253",
      "policy_bundle_hash": "2f0edd22bc9aab7b6727c1011b973730e7132c40c74af8bbf9cf8c667c9d2c46",
      "flag_state_hash": "cf67de135395834ad2a0d41915e8cf3f6769fd5748d00dcc2a562974ce08c45b",
      "outcome": "allow",
      "rule_id": "allow.default",
      "prev": "0000000000000000000000000000000000000000000000000000000000000000",
      "bypass": false,
      "applied_outcome": "allow",
      "computed_outcome": "allow",
      "verification": "not_identified"
    },
    "sig": "vL1Iy9MUGhUEdBojuZV3dfUW13ICR20eYhroOzqmceZwBx648oN6ZhHsy0GhiHvHqZFxaxhjQ1ieg4a9I24kCA"
  }
}

GET /.well-known/jwks.json

Public keys that verify receipts and log heads

curl -s https://api.silvector.com/.well-known/jwks.json

Responses

Example response REPLAY

{
  "keys": [
    {
      "kty": "OKP",
      "crv": "Ed25519",
      "x": "-cOD_m33YIDM5Z096uppcsj2I_M3VdSXAmvb8ofSQ4c",
      "kid": "edge-receipt",
      "use": "sig"
    },
    {
      "kty": "OKP",
      "crv": "Ed25519",
      "x": "BobpKJc-Yj1n2DYUeBPMzO5NVX3gXGDk8PboyWBxuLQ",
      "kid": "identity",
      "use": "sig",
      "alg": "EdDSA"
    }
  ]
}

GET /.well-known/transparency

Signed tree head over placeholder leaves and recent receipt hashes, with one inclusion check and one consistency check

The leaves are four fixed placeholders followed by hashes of recent /v1/check receipts, appended on a best-effort basis. On the API Worker each data center keeps its own leaf list in its cache for up to six hours; the list stops growing at 64 leaves and is not stored durably, so two requests can return different heads. The inclusion check is for the first placeholder leaf, not for a receipt. Keys: the edge-receipt key in the JWKS on staging.

curl -s https://api.silvector.com/.well-known/transparency

Responses

GET /.well-known/transparency/inclusion

An inclusion check for one leaf of a separate four-leaf sample log

This route signs its own fixed four-leaf sample tree, not the head at /.well-known/transparency, so its tree head does not match that one. It says nothing about receipts.

curl -s https://api.silvector.com/.well-known/transparency/inclusion

Responses

GET /health

Service identity, build and flag snapshot

curl -s https://api.silvector.com/health

Responses

Schemas

CheckRequest

CheckResponse

SignedReceipt

ReceiptBody

Outcome

"allow" | "meter" | "price" | "edit" | "step_up" | "deny" | "throttle" | "tarpit" | "decoy"

Verification

"verified" | "verification_failed" | "not_verifiable" | "not_identified"

Jwks

TransparencyHead

Health

SignedTreeHead

InclusionCheck

Problem