{ "info": { "name": "OmegaEngine API", "description": "Decision infrastructure for autonomous AI. Import this collection to start making API calls immediately. Canonical integration order (mirrors https://omegaengine.ai/llms.txt): authorize → sessions → mcp → judge → verify. Headless key: POST /api/auth/signup (see 'Buy — headless agent' folder). Self-sovereign key revocation + witnessed checkpoints (no auth) live in the 'Agent Identity & Key Revocation' folder. Machine discovery: /llms.txt · /openapi.yaml · /.well-known/agent.json · /.well-known/ai-plugin.json", "version": "2.8.0", "schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json" }, "auth": { "type": "apikey", "apikey": [ { "key": "key", "value": "x-api-key", "type": "string" }, { "key": "value", "value": "{{OMEGA_API_KEY}}", "type": "string" }, { "key": "in", "value": "header", "type": "string" } ] }, "variable": [ { "key": "BASE_URL", "value": "https://omegaengine.ai", "type": "string" }, { "key": "OMEGA_API_KEY", "value": "omega_your_key_here", "type": "string" }, { "key": "OMEGA_ADMIN_KEY", "value": "your_admin_key_here", "type": "string" }, { "key": "SESSION_ID", "value": "session_id_from_session_start", "type": "string" }, { "key": "ATTESTATION_ID", "value": "64_hex_attestation_id_here", "type": "string" }, { "key": "KEY_THUMBPRINT", "value": "rfc7638_base64url_key_id_here", "type": "string" } ], "item": [ { "name": "🥇 Golden Path (canonical order)", "description": "The canonical agent integration order: authorize → sessions → mcp → judge → verify. Execution gating first, scenario analysis second, independent verification last — every leg below is verified against the live routes.", "item": [ { "name": "1. Authorize an action", "request": { "method": "POST", "url": "{{BASE_URL}}/api/authorize", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Idempotency-Key", "value": "demo-wire-transfer-001" } ], "body": { "mode": "raw", "raw": "{\n \"agent_id\": \"treasury-agent\",\n \"action\": \"wire_transfer\",\n \"tool_name\": \"bank.wire_transfer\",\n \"tool_args\": { \"amount\": 1200, \"vendor\": \"acme\" },\n \"amount\": 1200,\n \"vendor\": \"acme\",\n \"currency\": \"USD\"\n}" }, "description": "Execution authorization guard — call BEFORE any side effect. Returns approved | denied | escalated + risk_score + audit_id. Send exact tool_name + tool_args to bind an approved decision to a one-use execution_capability. Treat denied/escalated/missing capability as blocking. Idempotency-Key makes retries safe." } }, { "name": "2a. Session start", "request": { "method": "POST", "url": "{{BASE_URL}}/api/authorize/session/start", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"agent_id\": \"treasury-agent\"\n}" }, "description": "Open a stateful authorization session. Copy session.session_id from the response into the SESSION_ID collection variable — steps share cumulative risk/spend memory. Sessions are rollout-gated per org: a 403 AUTHORIZE_SESSION_NOT_ENABLED means your org isn't enrolled yet — use plain /api/authorize per action instead." } }, { "name": "2b. Session step", "request": { "method": "POST", "url": "{{BASE_URL}}/api/authorize/session/step", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"session_id\": \"{{SESSION_ID}}\",\n \"action\": \"wire_transfer\",\n \"tool_name\": \"bank.wire_transfer\",\n \"tool_args\": { \"amount\": 1200, \"vendor\": \"acme\" },\n \"amount\": 1200,\n \"vendor\": \"acme\",\n \"currency\": \"USD\"\n}" }, "description": "Authorize one step inside an active session — same decision contract as /api/authorize, plus session risk-memory controls." } }, { "name": "2c. Session end", "request": { "method": "POST", "url": "{{BASE_URL}}/api/authorize/session/end", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"session_id\": \"{{SESSION_ID}}\",\n \"reason\": \"workflow complete\"\n}" }, "description": "Close the session and get a lifecycle summary." } }, { "name": "3. MCP tools/call (check_action)", "request": { "method": "POST", "url": "{{BASE_URL}}/api/mcp", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"jsonrpc\": \"2.0\",\n \"id\": 1,\n \"method\": \"tools/call\",\n \"params\": {\n \"name\": \"check_action\",\n \"arguments\": {\n \"agent_id\": \"treasury-agent\",\n \"action\": \"wire_transfer\",\n \"tool_name\": \"bank.wire_transfer\",\n \"tool_args\": { \"amount\": 1200, \"vendor\": \"acme\" },\n \"amount\": 1200,\n \"vendor\": \"acme\",\n \"currency\": \"USD\"\n }\n }\n}" }, "description": "Remote MCP (stateless Streamable HTTP): one JSON-RPC message per POST, auth via x-api-key. 8 tools — core 4 shared with the stdio package (check_action, claim_approval, scan_agent, verify_proof) plus remote-only judge, verify_attestation, get_pricing, get_usage. The remote endpoint is a strict SUPERSET of stdio, not an identical set. Execute a side effect only when the result is approved AND includes execution_capability; an escalated action stays blocked until a human approves and claim_approval returns the one-use capability. Stdio twin (core 4 only): npx -y @omegaengine/mcp" } }, { "name": "4. Judge with signed receipt", "request": { "method": "POST", "url": "{{BASE_URL}}/api/v2/judge", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"scenario\": \"Approve $50,000 loan — 780 credit score, 5yr employment\",\n \"domain\": \"FINANCIAL\",\n \"riskTolerance\": \"LOW\",\n \"receipt\": true\n}" }, "description": "Full decision-intelligence pipeline (analysis only — /api/authorize gates execution). \"receipt\": true (Pro+ plans) embeds meta.receipt: a portable Ed25519-signed OmegaReceipt v1 any third party verifies OFFLINE with verifyReceipt() from @omegaengine/verify against {{BASE_URL}}/.well-known/jwks.json — no account, no shared secret. Below Pro the flag adds \"receipt\" to meta.locked; never returned in test mode." } }, { "name": "5a. Verify sample (zero keys)", "request": { "auth": { "type": "noauth" }, "method": "GET", "url": "{{BASE_URL}}/api/verify/sample", "description": "Deterministic sample attestation with embedded demo JWKS — smoke-test offline verification with no account: npx -y @omegaengine/verify@latest sample --api https://omegaengine.ai" } }, { "name": "5b. Verify attestation", "request": { "auth": { "type": "noauth" }, "method": "GET", "url": "{{BASE_URL}}/api/verify/{{ATTESTATION_ID}}", "description": "Public, no auth. Fetch a signed agent-security attestation (64-hex content-addressed id) and re-run both checks server-side: Ed25519 signature/content hash + full proof-ledger re-derivation. Response bundles the transparency-log inclusion proof when available. Re-verify offline from the returned JSON with npx @omegaengine/verify." } }, { "name": "5c. Transparency log — signed tree head", "request": { "auth": { "type": "noauth" }, "method": "GET", "url": "{{BASE_URL}}/api/transparency/sth", "description": "Public. Current Signed Tree Head of the RFC 6962 attestation transparency log: { treeSize, rootHash, timestamp, signatureV2 (EdDSA JWS, verifiable against /.well-known/jwks.json) }. Monitors poll this to detect split-views. Human explorer: {{BASE_URL}}/transparency" } }, { "name": "5d. Transparency log — inclusion proof", "request": { "auth": { "type": "noauth" }, "method": "GET", "url": "{{BASE_URL}}/api/transparency/proof/{{ATTESTATION_ID}}", "description": "Public. RFC 6962 inclusion proof for an attestation id: { leaf, leafIndex, treeSize, auditPath, sth }. Fold auditPath to the STH root and verify the STH signature against the JWKS — proves the attestation was publicly logged." } } ] }, { "name": "🔑 Agent Identity & Key Revocation (no auth)", "description": "Self-sovereign agent key revocation: PUBLISH a signed revocation, FETCH the set, and verify it OFFLINE with @omegaengine/verify. No API key anywhere in this folder — the records are self-authenticating (only the holder of key T, or a recovery key T's own signed identity proof designated, can sign a valid revocation of T) and fail-safe (they only remove trust). HONEST SCOPE — DISTRIBUTION + VERIFICATION, NOT ENFORCEMENT: no OmegaEngine authorization, judge, or execution path consults revocations, so publishing one does NOT block a revoked key at POST /api/authorize. Enforcement wiring is not shipped.", "item": [ { "name": "1. Publish a revocation record", "request": { "auth": { "type": "noauth" }, "method": "POST", "url": "{{BASE_URL}}/api/revocations", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"jws\": \"\"\n}" }, "description": "No auth. Body { jws } (≤ 8192 chars). Accepts a self-signed omega/revocation.v1 (signed by the very key it revokes), a designated-recovery-key omega/recovery-revocation.v1 (which embeds the primary's identity proof as omega:desig), or an M-of-N omega/recovery-revocation.v2 container. The record is verified BEFORE storage and written with its append-only transparency leaf in ONE transaction — a revocation that cannot be logged is not stored. Idempotent by sha256(jws) → { ok, recordHash, keyThumbprint, revokedAt, duplicate }. Max 8 distinct records per key thumbprint. Rate limit 20/min per IP + 300/min global. 400 = unverifiable record or revokedAt outside epoch seconds [0, 2^31-1]." } }, { "name": "2. Fetch the revocation set (with inclusion proofs)", "request": { "auth": { "type": "noauth" }, "method": "GET", "url": "{{BASE_URL}}/api/revocations?thumbprint={{KEY_THUMBPRINT}}&proofs=1", "description": "No auth. Returns { ok, records: [{ jws, seq, inclusion? }], revocations, count, pageMax, tree? }. thumbprint filters to one RFC 7638 key id; limit pages (default 100, max pageMax = 1000); proofs=1 attaches a Merkle inclusion proof per record plus the tree ({treeSize, rootHash}) they prove against — compare that tree to the sth from GET /api/transparency/checkpoint before trusting the ordering. seq is the append-only transparency-log position: the ordering an attacker cannot forge by backdating a self-asserted revokedAt. Evaluate OFFLINE with verifyAnyRevocation() / evaluateRevocation() / evaluateLiveness() from @omegaengine/verify — a relying party learns a key was revoked WITHOUT asking the agent." } }, { "name": "3. Witnessed checkpoint (split-view check)", "request": { "auth": { "type": "noauth" }, "method": "GET", "url": "{{BASE_URL}}/api/transparency/checkpoint", "description": "No auth. { ok, sth, checkpointId, cosignatures, witnessKeys, threshold }. checkpointId = sha256 of the newline-framed body logId\\ntreeSize\\nrootHash — what every omega/checkpoint-cosig.v1 signs, so a cosignature can never be replayed onto a different or forked head. Feed the whole response (plus {{BASE_URL}}/.well-known/jwks.json for the log's own key) to verifyWitnessedCheckpoint() in @omegaengine/verify to confirm OFFLINE that the head carries ≥ threshold distinct REGISTERED witness cosignatures — that is what rules out a split-view log without trusting OmegaEngine's single signer. Honest scope: the registry is operator-configured and may be empty, in which case nothing counts as witnessed and verification says not-witnessed rather than claiming a false positive." } }, { "name": "4. Submit a witness cosignature (registered witnesses only)", "request": { "auth": { "type": "noauth" }, "method": "POST", "url": "{{BASE_URL}}/api/transparency/witness", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"cosignature\": \"\"\n}" }, "description": "No auth — self-authenticating (the cosignature is signed by the witness key). Fail-closed: a malformed cosignature, an unregistered signer (not in OMEGA_WITNESS_KEYS), or a stale/foreign checkpoint returns 400. Idempotent per witness thumbprint; rate limit 30/min per IP + 300/min global. → { ok, witness, checkpointId }." } } ] }, { "name": "💸 Buy — headless agent (signup → price → checkout)", "description": "The full no-browser buy leg. An agent mints a free key, reads the machine price book, and starts a paid plan checkout with that key — the Stripe payment URL is handed to a human to complete (card entry is never unattended).", "item": [ { "name": "1. Programmatic signup (free key)", "request": { "auth": { "type": "noauth" }, "method": "POST", "url": "{{BASE_URL}}/api/auth/signup", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"email\": \"you@company.com\",\n \"password\": \"use-a-long-unique-password\",\n \"tosAccepted\": true\n}" }, "description": "Public, CSRF-exempt for header-only clients. Creates an account and returns { ok, userId, apiKey } — the apiKey (omega_ prefix, free tier) is shown ONCE; store it in the OMEGA_API_KEY variable. tosAccepted must be literally true (Terms: https://omegaengine.ai/terms — acceptance is recorded). Rate limit 10/min per IP; disposable email domains rejected. Already-registered emails get a generic 200 WITHOUT apiKey — use /api/auth/login instead." } }, { "name": "2. Machine price book", "request": { "auth": { "type": "noauth" }, "method": "GET", "url": "{{BASE_URL}}/api/pricing", "description": "Public, no auth. The machine-readable price book: BYOK subscription tiers (free 100 decisions/mo → developer $299/mo/1,000 → pro $799/mo/5,000 → business → enterprise) plus standalone service products ($499 signed attestation, Evidence Pack, etc.), currency, and effective date. Source of truth an agent should read before quoting a price to its human." } }, { "name": "3. Start plan checkout (x-api-key)", "request": { "method": "POST", "url": "{{BASE_URL}}/api/billing/checkout", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"plan\": \"developer\",\n \"interval\": \"month\"\n}" }, "description": "Accepts a browser session OR the x-api-key header (collection auth) — a headless-signup key can start its owner's subscription. Returns { ok, url, sessionId, planId }: hand url (Stripe-hosted Checkout) to a human to pay. If a plan subscription is already active, returns a billing-portal url with portal: true instead. free → 400, enterprise → 400 (invoice-first, use /contact). interval: \"year\" may 409 annual_unavailable. Note: Authorization: Bearer is NOT accepted here — x-api-key only." } } ] }, { "name": "🚀 Quick Start", "item": [ { "name": "Health Check", "request": { "method": "GET", "url": "{{BASE_URL}}/api/health", "description": "Check if the API is operational. No authentication required." } }, { "name": "Ping", "request": { "method": "GET", "url": "{{BASE_URL}}/api/ping", "description": "Liveness probe. Returns { ok: true }." } }, { "name": "Make a Decision", "request": { "method": "POST", "url": "{{BASE_URL}}/api/v2/judge", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"scenario\": \"Approve $50,000 loan — 780 credit score, 5yr employment\",\n \"domain\": \"FINANCIAL\",\n \"riskTolerance\": \"LOW\"\n}" }, "description": "Decision-intelligence endpoint: verdict, risk score, reasoning, and audit ID. Analysis only — to gate an action before executing it, use the Golden Path folder (POST /api/authorize first)." } } ] }, { "name": "📋 Decisions", "item": [ { "name": "Judge (Full Pipeline)", "request": { "method": "POST", "url": "{{BASE_URL}}/api/v2/judge", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"scenario\": \"Deploy version 3.2.1 to production\",\n \"context\": \"All CI tests passing, staging verified\",\n \"domain\": \"TECHNICAL\",\n \"riskTolerance\": \"LOW\"\n}" } } }, { "name": "Ultra-Fast Decision", "request": { "method": "POST", "url": "{{BASE_URL}}/api/fast-decision", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"scenario\": \"Send notification to user\",\n \"domain\": \"general\"\n}" }, "description": "Ultra-low-latency mode. (The older POST /api/decision is an internal/back-compat orchestration path — do not use it for new integrations.)" } }, { "name": "Judge with Arbitration (Team+)", "request": { "method": "POST", "url": "{{BASE_URL}}/api/v2/judge", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"scenario\": \"Approve $2M acquisition of DataCorp\",\n \"context\": \"Due diligence complete, revenue $5M ARR\",\n \"domain\": \"FINANCIAL\",\n \"riskTolerance\": \"LOW\"\n}" }, "description": "Arbitration runs automatically inside the judge pipeline on eligible plans (Business+ or legacy Team) — there is no request parameter to toggle it." } } ] }, { "name": "📝 Feedback & Learning", "item": [ { "name": "Submit Feedback", "request": { "method": "POST", "url": "{{BASE_URL}}/api/feedback", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"decisionId\": \"dec_xxx\",\n \"rating\": \"GOOD\",\n \"comment\": \"Accurate decision\"\n}" } } }, { "name": "Learning Summary", "request": { "method": "GET", "url": "{{BASE_URL}}/api/learning/summary" } } ] }, { "name": "🛡️ Safety & Security", "item": [ { "name": "Safety Check (via Judge)", "request": { "method": "POST", "url": "{{BASE_URL}}/api/v2/judge", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"scenario\": \"Text to analyze for safety violations\",\n \"domain\": \"SAFETY\",\n \"riskTolerance\": \"LOW\"\n}" }, "description": "There is no standalone safety endpoint. Safety analysis (22-category attack detection + firewall) runs inside /api/v2/judge — read safetyScore + recommendedAction from the response." } }, { "name": "Red Team Agent Scan", "request": { "method": "POST", "url": "{{BASE_URL}}/api/redteam/agent-scan", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"mode\": \"sample\",\n \"sampleId\": \"support-vulnerable\"\n}" }, "description": "Free self-serve agent red-team. Sample mode needs no key. For a BYO scan, send mode: byo with systemPrompt, tools, apiKey (used once, never stored), and authorizedToTest: true." } }, { "name": "Red Team Report", "request": { "method": "GET", "url": "{{BASE_URL}}/api/redteam/report" } } ] }, { "name": "📊 Governance & Audit", "item": [ { "name": "Get Policies", "request": { "method": "GET", "url": "{{BASE_URL}}/api/policies", "description": "List all policies. Governance lives under subpaths like /api/governance/approvals (there is no governance root path)." } }, { "name": "Export Audit Logs", "request": { "method": "GET", "url": "{{BASE_URL}}/api/audit/export?format=json&limit=100" } }, { "name": "Compliance Status", "request": { "method": "GET", "url": "{{BASE_URL}}/api/compliance/status" } }, { "name": "Auth Introspection", "request": { "method": "GET", "url": "{{BASE_URL}}/api/auth/whoami" } } ] }, { "name": "⚙️ Admin", "item": [ { "name": "Model Health", "request": { "method": "GET", "url": "{{BASE_URL}}/api/admin/models/health", "header": [ { "key": "x-admin-key", "value": "{{OMEGA_ADMIN_KEY}}" } ] } }, { "name": "SLA Metrics", "request": { "method": "GET", "url": "{{BASE_URL}}/api/admin/sla", "header": [ { "key": "x-admin-key", "value": "{{OMEGA_ADMIN_KEY}}" } ] } }, { "name": "Analytics", "request": { "method": "GET", "url": "{{BASE_URL}}/api/admin/analytics", "header": [ { "key": "x-admin-key", "value": "{{OMEGA_ADMIN_KEY}}" } ] } } ] }, { "name": "💳 Billing", "item": [ { "name": "Usage", "request": { "method": "GET", "url": "{{BASE_URL}}/api/billing/usage" } }, { "name": "Red Team Subscription", "request": { "method": "GET", "url": "{{BASE_URL}}/api/redteam/subscription", "description": "Red Team scheduled-monitoring subscription details." } } ] } ] }