API and integration
Use the existing hosted endpoints. Credentials determine tenant and permissions; this portal neither proxies nor stores your API credentials.
Core endpoints
| Method and path | Credential | Purpose |
|---|---|---|
| POST /tenant/pricing | admin | Publish a price expression; returns pricing.hash |
| POST /tenant/credentials | admin | Create an ingest credential shown once |
| POST /t/{slug}/ingest/events | ingest / admin | Submit an event array; credential must belong to the tenant |
| GET /tenant/status | admin | Inspect issuance, commitments, TSA and anchoring |
| GET /tenant/events | admin | Inspect pending, processed, rejected events and reasons |
| GET /t/{slug}/api/receipt/bundle?stream=…&seq=… | Anonymous or disclosure credential | Retrieve one receipt bundle |
| POST /tenant/grants | admin | Issue a supplier-side audit grant for selected streams |
| POST /tenant/customer-tokens | admin | Issue a short-lived customer-bound token |
| GET /tenant/export | admin | Export the tenant ledger as NDJSON |
Generation 6 input
The outer event uses stream, source_event_id, generation, occurred_at_ms and input. input uses Go field names such as RequestID, PromptTokens and Pricing.ExprHash. This is distinct from signed sections, which use snake_case names and decimal strings.
Generation 6 supports token metering only. Publish pricing in the same tenant first. UsageSemantic must be openai or anthropic to declare the actual counting convention; it is not model-authenticity evidence. Amounts and tiers are evaluated by the server.
The current service has zero-value defaults: MultiplierBps of 0 becomes 10000; CostMicroUsd of 0 is filled by expression evaluation. Do not use these values to express an explicit zero price or multiplier.
Retries and errors
| Status | Action |
|---|---|
| 200 / success: true | Inspect enqueued and ids, then observe issuance readiness |
| 400 | Fix fields, generation, pricing or counting semantics before retrying |
| 401 / 403 | Check credential kind, expiry, revocation, tenant and suspension |
| 413 | Reduce the batch to service limits; keep source IDs stable |
| 网络错误 / 5xx | Retry with backoff and the original source event ID |
Synthetic traffic must not enter a real ledger; events marked synthetic are rejected by the signer. HTTP acceptance and issuance are different stages. Inspect event status for the eventual result.
Credentials are not interchangeable
An admin manages its tenant; an ingest credential delivers events; an audit grant discloses supplier data for selected streams; a customer token discloses only its subject’s customer data. Operator credentials must not be given to tenants or placed in a browser.
Read the public protocol and section schemas