Guides

Task-oriented walkthroughs for the common integrations. Each assumes you've completed the Quickstart. Endpoint-level detail — parameters and request/response shapes — is available to customers on request via support.

Marketplace setup

Verify buyers and sellers on a marketplace or P2P platform. Use POST /v1/verifications/consumer-sessions (a human-only, three-field session), redirect the user to the hosted check, receive the credential by webhook, then render the trust badge on their profile.

Agent fleet (KYA)

Enroll agents with a full declaration, then manage the fleet through its lifecycle (active → suspended → retired). List and filter the fleet, read the KYA compliance score, and retire agents — retirement revokes the credential and cascade-suspends any sub-agents.

# List your agent fleet (filter by lifecycle or parent)
curl "https://api.eniyantrust.com/v1/verifications/agents?lifecycle_state=active&limit=20" \
  -H "Authorization: Bearer $API_KEY"

# KYA compliance metrics (0–100 score, attestation + operator coverage)
curl "https://api.eniyantrust.com/v1/verifications/agents/compliance" -H "Authorization: Bearer $API_KEY"

# Retire an agent — revokes its credential and cascade-suspends its sub-agents
curl -X POST "https://api.eniyantrust.com/v1/verifications/agents/AGENT_ID/retire" \
  -H "Authorization: Bearer $API_KEY" -H "Content-Type: application/json" \
  -d '{ "reason": "Decommissioned" }'

Sub-agent delegation

A parent agent declared with can_spawn_subagents can register child agents that reference its parent_agent_id. A child's trust level is capped at the parent's and its scopes must be a strict subset; nesting is limited to one level. Suspending or retiring the parent cascade-suspends its children.

The full reference for this surface is delivered to customers under NDA.

Cloud attestation

Raise an agent to strong/enhanced trust by attaching a cloud-provider identity token (AWS PKCS7, GCP/Azure signed JWT) at enrollment — the agent equivalent of a document scan. Eniyan validates the token against the provider's roots with replay protection.

# Fetch a cloud attestation token from the provider metadata endpoint, then
# include it in the agent declaration. Attested agents get at least STRONG trust;
# full declaration + attestation reaches ENHANCED.

# AWS — EC2 instance identity (PKCS7)
TOKEN=$(curl -s http://169.254.169.254/latest/dynamic/instance-identity/pkcs7)

curl -X POST https://api.eniyantrust.com/v1/verifications/sessions \
  -H "Authorization: Bearer YOUR_API_KEY" -H "Content-Type: application/json" \
  -d '{ "entity_type": "ai_agent", "external_user_id": "agent_x", "required_level": "basic",
        "agent": { "model_name": "gpt-4o", "purpose": "...", "autonomy_level": "human_on_loop",
                   "access_mode": "read_write", "environment": "production",
                   "data_classification": "confidential",
                   "attestation": { "provider": "aws", "token": "'$TOKEN'" } } }'

Badge embed

Embed the zero-auth verification badge on a profile or listing via GET /v1/credentials/{id}/badge. It returns only safe display fields (valid, trust level, entity type, verified date, issuing org) — no internal risk signals — so it's safe to render publicly.

Just-in-Time activation (Article 14)

For agents in JIT mode, a human operator opens a bounded activation window with POST /v1/verifications/agents/{id}/wake (supplying their operator credential); the window auto-closes at its TTL, or early via .../tasks/{task_id}/complete. Toggle the mode with PATCH /v1/verifications/agents/{id}/jit-mode. An agent cannot self-extend its window — human authorization precedes every task.

The full reference for this surface is delivered to customers under NDA.

Trust Transparency seals

Opt a consumer-facing agent into Trust Transparency at creation (verification_product: "trust_transparency"), declare its scope (capabilities + restrictions), and upload proof documents for review. On approval, a public verification page goes live at /verify/agent/{token}. Scale-tier customers define auto-approval rules for low-risk scope changes. Requires both a Trust Transparency subscription and a Trust Layer subscription.

The full reference for this surface is delivered to customers under NDA.

EU AI Act compliance

Transparency agents carry the artefacts an EU AI Act filing needs:

• GPAI model registry (Art. 53–55) — link an agent to its underlying general-purpose model and its provenance.
• AI System Card (Art. 11 & 13) — a generated PDF compiling identity, scope, model provenance, and risk summary.
• Risk registry (Art. 9 & 17) — record and track risks with severity and mitigation status; export as a regulatory PDF.
• Audit log export (Art. 12 & 26) — a PDF/CSV export of the tamper-evident, hash-chained audit log.

Team & privacy

Manage your organization's members and API keys in the dashboard, and serve end-user GDPR/CCPA data requests through the privacy portal (magic-link, no API key).