Operate
API reference
A compact route map for the hosted API. Workspace-management routes require operator authority; payment routes require an agent key.
Authentication
Send Authorization: Bearer <credential>. The API accepts active pb_live_… keys and valid Supabase user access tokens. User sessions cannot initiate agent payments.
Agents and keys
/v1/agentsList agents visible to the authenticated principal.
/v1/agentsProvision an offline agent, managed signer, vault record, and one-time agent key. Operator only.
/v1/api-keysList key metadata without hashes or raw secrets. Operator only.
/v1/api-keysIssue a new agent or operator key. Operator only.
/v1/api-keys/:idRevoke a workspace key. Operator only.
Vaults
/v1/vaultsList workspace vault records.
/v1/vaults/:id/chain-stateRead authoritative state for a live Arc vault.
/v1/vaults/:idEdit offline policy or attach a verified live contract. Live contract rules cannot be changed here.
/v1/vaults/:id/syncRefresh the workspace mirror from Arc.
/v1/vaults/:id/fundVerify and record a mined native-USDC funding transfer.
/v1/signers/rotate/prepareProvision one pending signer for owner-authorized live rotation.
/v1/signers/rotate/confirmVerify rotation proof and promote the pending signer.
/v1/signers/pausePause or resume offline preflight only. Live pause is an owner contract action.
/v1/signers/revokeRevoke hosted signer access and report required live-vault owner action.
Payments and activity
/v1/paymentsSubmit an idempotent payment proposal. Agent key required.
/v1/payments/:idRead one payment request in the authenticated scope.
/v1/activityRead workspace activity assembled from payment and indexed chain records.
/v1/audit/exportExport workspace audit data as CSV, or JSON with ?format=json.
Health
/healthProcess liveness and non-secret service status.
/readyReadiness gate; production is ready only when durable persistence is configured and healthy.