The Assurance API
42 routes over CRA Article 14 and Machinery Regulation Annex III evidence. Bearer auth via one header, JSON in and out, and a real OpenAPI 3 schema you can fetch instead of trusting this page.
One header. Bearer token, never a cookie.
Send X-API-Key: <your key>. Get a key from POST /v1/checkout (Register or Cell) or by running the service locally with ASSURANCE_ALLOW_UNAUTHENTICATED=1 for evaluation. A missing key is a 401. A valid key on the wrong plan is a 402, never a 403 — the obstacle is payment, not permission, and every gated route says exactly which plan unlocks it.
Free, no key needed
curl -X POST https://<your-deployment>/v1/spec/validate \
-H 'content-type: application/json' \
-d '{"track":"actively_exploited_vulnerability","stage":"early_warning","payload":{}}'Free vs. paid, straight from the routers
Every row below is gated in code, in src/assurance/api/deps.py — if it is not gated, it is free. This is a curated view of the 42 routes; the full machine-readable schema (parameters, response shapes, every route including account/billing) is at /openapi.json.
| Method | Route | Plan | What it does |
|---|---|---|---|
GET | /v1/spec/fields | Validator — free | The platform field specification for a track/stage |
POST | /v1/spec/validate | Validator — free | Validate a draft submission without recording it |
GET | /v1/plans | Validator — free | What is on sale — this table, live |
POST | /v1/machine/separation | Validator — free | ISO/TS 15066 protective separation distance |
POST | /v1/machine/bundle/check | Validator — free | Re-verify someone else's evidence bundle |
POST | /v1/machinery/diff | Validator — free | Is the machine still the configuration you signed off? |
POST | /v1/machinery/passport/check | Validator — free | Re-verify someone else's machine passport |
POST | /v1/fleet/advisory/check | Validator — free | Is this one machine affected by this advisory? |
POST | /v1/fleet/declaration/check | Validator — free | Does this declaration still describe the machine? |
POST | /v1/check/machine | Validator — free | Machine Assurance Check — one manifest, one advisory, no account |
GET | /v1/ledger/attest/key | Validator — free | The public key this service counter-signs with |
POST | /v1/ledger/attest/verify | Validator — free | Check an attestation log |
GET | /v1/supplier/feed/{id} | Validator — free | Read a hosted supplier advisory feed |
GET | /v1/register | Register — €390/mo | The Article 14 register for your account |
GET | /v1/register/breaches | Register — €390/mo | Cases past a deadline clock |
GET | /v1/cases | Register — €390/mo | List cases |
POST | /v1/cases/{id}/triage | Register — €390/mo | Record a triage decision |
POST | /v1/cases/{id}/filings | Register — €390/mo | Record a platform filing |
GET | /v1/ledger/verify | Register — €390/mo | Verify the hash chain |
POST | /v1/machine/verify | Cell — €1,290/mo | Verify a recorded machine run against its declared envelope |
POST | /v1/machinery/manifest | Cell — €1,290/mo | Seal a safety software manifest |
POST | /v1/machinery/coverage | Cell — €1,290/mo | Which safety functions still have valid evidence |
POST | /v1/machinery/passport | Cell — €1,290/mo | Seal the machine's evidence position |
GET | /v1/fleet/machines | Cell — €1,290/mo | Every enrolled machine, worst coverage first |
POST | /v1/fleet/advisory | Cell — €1,290/mo | Fan an advisory out across the whole fleet |
POST | /v1/check/fleet-machine | Cell — €1,290/mo | Machine Assurance Check — an enrolled machine, its ledger history and the fleet fan-out |
POST | /v1/fleet/declare | Cell — €1,290/mo | Bind a Declaration of Conformity to a configuration |
POST | /v1/ledger/attest | Cell — €1,290/mo | Counter-sign the head of your ledger |
GET | /v1/ledger/attest/log | Cell — €1,290/mo | Every attestation for your account |
POST | /v1/supplier/advisory | Supplier — contact sales | Publish a signed advisory to your hosted feed |
What a 402 looks like — and what success looks like
POST /v1/machine/verify needs the Cell plan. Called with a Register-only key, it fails closed with a structured upgrade hint instead of a bare 403 — an agent can parse this and route a human to checkout automatically.
Python
import httpx
resp = httpx.post(
"https://<your-deployment>/v1/machine/verify",
headers={"X-API-Key": api_key},
json={"envelope": envelope, "trace": trace, "actor": "you@example.com"},
)
if resp.status_code == 402:
detail = resp.json()["detail"]
# {"error": "plan_does_not_include_machine_verification",
# "tier": "register", "account_status": "active",
# "remedy": "...GET /v1/plans, then POST /v1/checkout."}
print(detail["remedy"])
else:
resp.raise_for_status()
print(resp.json())Wire an agent to this instead of reading it
Cursor, Claude, and CI bots discover this the same way: llms.txt, openapi.json, and this page.