Guides

Task-oriented walkthroughs for the common integrations. Each assumes you've completed the Quickstart. Endpoint-level detail — parameters and request/response shapes — is available to customers on request via support.

Marketplace setup

Verify buyers and sellers on a marketplace or P2P platform. Use POST /v1/verifications/consumer-sessions (a human-only, three-field session), redirect the user to the hosted check, receive the credential by webhook, then render the trust badge on their profile.

Agent fleet (KYA)

Enroll agents with a full declaration, then manage the fleet through its lifecycle (active → suspended → retired). List and filter the fleet, read the KYA compliance score, and retire agents — retirement revokes the credential and cascade-suspends any sub-agents.

Fleet management
bash
# List your agent fleet (filter by lifecycle or parent)
curl "https://api.eniyantrust.com/v1/verifications/agents?lifecycle_state=active&limit=20" \
  -H "Authorization: Bearer $API_KEY"

# KYA compliance metrics (0–100 score, attestation + operator coverage)
curl "https://api.eniyantrust.com/v1/verifications/agents/compliance" -H "Authorization: Bearer $API_KEY"

# Retire an agent — revokes its credential and cascade-suspends its sub-agents
curl -X POST "https://api.eniyantrust.com/v1/verifications/agents/AGENT_ID/retire" \
  -H "Authorization: Bearer $API_KEY" -H "Content-Type: application/json" \
  -d '{ "reason": "Decommissioned" }'

Sub-agent delegation

A parent agent declared with can_spawn_subagents can register child agents that reference its parent_agent_id. A child's trust level is capped at the parent's and its scopes must be a strict subset; nesting is limited to one level. Suspending or retiring the parent cascade-suspends its children.

The full reference for this surface is delivered to customers under NDA.

Cloud attestation

Raise an agent to strong/enhanced trust by attaching a cloud-provider identity token (AWS PKCS7, GCP/Azure signed JWT) at enrollment — the agent equivalent of a document scan. Eniyan validates the token against the provider's roots with replay protection.

Cloud attestation
bash
# Fetch a cloud attestation token from the provider metadata endpoint, then
# include it in the agent declaration. Attested agents get at least STRONG trust;
# full declaration + attestation reaches ENHANCED.

# AWS — EC2 instance identity (PKCS7)
TOKEN=$(curl -s http://169.254.169.254/latest/dynamic/instance-identity/pkcs7)

curl -X POST https://api.eniyantrust.com/v1/verifications/sessions \
  -H "Authorization: Bearer YOUR_API_KEY" -H "Content-Type: application/json" \
  -d '{ "entity_type": "ai_agent", "external_user_id": "agent_x", "required_level": "basic",
        "agent": { "model_name": "gpt-4o", "purpose": "...", "autonomy_level": "human_on_loop",
                   "access_mode": "read_write", "environment": "production",
                   "data_classification": "confidential",
                   "attestation": { "provider": "aws", "token": "'$TOKEN'" } } }'

Badge embed

Embed the zero-auth verification badge on a profile or listing via GET /v1/credentials/{id}/badge. It returns only safe display fields (valid, trust level, entity type, verified date, issuing org) — no internal risk signals — so it's safe to render publicly.

Just-in-Time activation (Article 14)

For agents in JIT mode, the agent's operator opens a bounded activation window with POST /v1/verifications/agents/{id}/wake, either from their own dashboard session or from their application with a signed, single-use operator_assertion. The window auto-closes at its TTL, or early via .../tasks/{task_id}/complete. Toggle the mode with PATCH /v1/verifications/agents/{id}/jit-mode. An operator credential id is not proof on its own, so your org API key alone cannot open a window. An agent that holds the key but not your signing key cannot open or extend its own window. The only other way to open one is an org admin's audited override. An admin can relax this to accept a bare operator id, and wakes opened that way are labelled unverified.

Register the assertion's signing key on the dashboard's JIT tab. An assertion is an ES256 or RS256 JWT with aud="eniyantrust", token_use="jit_operator", sub set to the operator's external_user_id, the agent_id, an action of wake or attest (with the task_id), a unique jti, and at most five minutes between iat and exp.

The full reference for this surface is delivered to customers under NDA.

Trust Transparency seals

Opt a consumer-facing agent into Trust Transparency at creation (verification_product: "trust_transparency"), declare its scope (capabilities + restrictions), and upload proof documents for review. On approval, a public verification page goes live at /verify/agent/{token}. Scale-tier customers define auto-approval rules for low-risk scope changes. Requires both a Trust Transparency subscription and a Trust Layer subscription.

The full reference for this surface is delivered to customers under NDA.

EU AI Act compliance

Transparency agents carry the artefacts an EU AI Act filing needs:

  • GPAI model registry (Art. 53–55) — link an agent to its underlying general-purpose model and its provenance.
  • AI System Card (Art. 11 & 13) — a generated PDF compiling identity, scope, model provenance, and risk summary.
  • Risk registry (Art. 9 & 17) — record and track risks with severity and mitigation status; export as a regulatory PDF.
  • Audit log export (Art. 12 & 26) — a PDF/CSV export of the tamper-evident, hash-chained audit log.

Team & privacy

Manage your organization's members and API keys in the dashboard, and serve end-user GDPR/CCPA data requests through the privacy portal (magic-link, no API key).