API v1

API Reference

Seven compliance and AI infrastructure products. One API key. Base URL: https://api.agengate.com

1

Get an API key

Sign up for free at agengate.com/signup — no credit card required. Your key is generated instantly with the prefix ag_live_. Pass it on every authenticated request as the X-API-Key header.

Free plan includes 100 validations/month and gates G1, G2, G3. Upgrade anytime from the dashboard.

2

Install the SDK

npm install @agengate/sdk
3

Validate your first agent output

import { AgentGate } from '@agengate/sdk'; const gate = new AgentGate({ apiKey: 'ag_live_...' }); const result = await gate.validate({ agentOutput: 'Transfer $50,000 to account 4521...', context: { domain: 'banking', tier: 'T2', regulatory: true } }); console.log(result.status); // 'passed' | 'failed' | 'warning'
AgentGate

Validate agent output

Run an agent output through all 8 quality gates and receive a cryptographic SHA-256 evidence chain regardless of outcome.

POST /v1/validate API Key

Validates agent output against compliance gates. Runs G1–G8 based on domain, tier, and regulatory flags. Returns findings, violations, recommendations, and a tamper-evident evidence package.

REQUEST BODY
FieldTypeRequiredDescription
agent_outputstringrequiredThe raw text output from the agent to validate.
contextobjectrequiredExecution context for the agent.
context.domainstringrequiredOne of: banking, finance, accounting, legal, compliance, engineering, security, ai, data, brands, suppliers, product.
context.task_typestringrequiredShort verb describing the task (e.g. build, analyze, report).
context.tierstringrequiredComplexity tier: T1, T2, T3, or T4.
context.regulatorybooleanrequiredtrue if this output touches regulated data or processes.
context.ai_touchingbooleanrequiredtrue if the output was produced or processed by an AI model.
gatesstring[]optionalSubset of gate IDs to run (G1–G8). Omit to run all applicable.
evidencebooleanoptionalInclude cryptographic evidence chain in response. Default true.
RESPONSE — 200 OK
cURL EXAMPLE
SDK EXAMPLE
TRY IT OUT
GET /v1/validations/:id API Key

Retrieve a past validation result by its UUID. Returns the full result including gate outcomes and evidence chain.

cURL EXAMPLE
GET /v1/validations API Key

List recent validations. Paginated and filterable by status.

QUERY PARAMETERS
ParamTypeDefaultDescription
statusstringFilter by: passed, failed, warning.
limitinteger50Max results per page (max 200).
offsetinteger0Number of records to skip.
POST /v1/audit-package API Key

Generate a full compliance audit package for a regulation. Packages all evidence with a top-level SHA-256 attestation hash suitable for regulatory submission.

REQUEST BODY
FieldTypeRequiredDescription
regulationstringrequiredOne of: gdpr, pci-dss, sox, aml, iso27001, eu-ai-act, dora, ccpa, basel, ifrs.
GET /v1/regulations API Key

List all supported regulations with jurisdiction, effective date, and control counts.

GET /v1/gates API Key

List all 8 quality gates (G1–G8) with descriptions, check IDs, and applicability rules.

GET /v1/stats API Key

Global and per-key usage statistics: total validations, pass rate, average duration, and per-gate breakdowns.

GET /v1/health

Liveness probe. No authentication required. Use for uptime monitoring and pre-flight checks.

RESPONSE — 200 OK
Billing

Create subscription

Subscribe to any product and plan. Payment is processed immediately via Multicard Mesh (UZS) or Stripe (USD).

POST /v1/billing/subscribe API Key
REQUEST BODY
FieldTypeRequiredDescription
customer_idstringrequiredCustomer identifier (email or UUID).
productstringrequiredagentgate | pii-shield | audittrail | routeiq | learnloop | vectorvault | biasguard.
planstringrequiredstarter | pro | enterprise.
billing_cyclestringrequiredmonthly | annual.
GET /v1/billing/status API Key

Check whether the authenticated API key has an active subscription and which plan it is on.

GET /v1/billing/usage API Key

Current-period usage and projected cost for the authenticated key.

GET /v1/billing/history API Key

Full payment history for the authenticated API key with invoice IDs, amounts, and statuses.

PII Shield

Scan text for PII

Detect and redact personally identifiable information using composable regex patterns. Supports email, SSN, IBAN, credit cards, passport, phone, IP address, DOB, and custom patterns.

POST /v1/scan API Key
REQUEST BODY
FieldTypeRequiredDescription
textstringrequiredText to scan. Max 1,000,000 characters.
redactbooleanoptionalReturn redacted text alongside findings. Default false.
modestringoptionalRedaction mode: mask (***) | hash (sha256) | type ([EMAIL]) | remove. Default mask.
cURL EXAMPLE
TRY IT OUT
POST /v1/batch API Key

Scan up to 100 texts in a single request. Accepts the same redact and mode options as /v1/scan.

REQUEST BODY
FieldTypeRequiredDescription
textsstring[]requiredArray of strings to scan. Max 100 items.
redactbooleanoptionalRedact all matches. Default false.
modestringoptionalmask | hash | type | remove. Default mask.
POST /v1/patterns API Key

Register a custom PII detection pattern for your workspace. Returns 409 if the pattern ID already exists.

REQUEST BODY
FieldTypeRequiredDescription
idstringrequiredUnique slug (lowercase, hyphens/underscores only).
typestringrequiredPII type label (e.g. employee_id).
labelstringrequiredDisplay label for [TYPE] redaction mode.
patternstringrequiredJavaScript-compatible regex string.
flagsstringoptionalRegex flags (default: gi).
AuditTrail

Tamper-evident audit logging

Every entry is SHA-256 hashed into an append-only chain. Verification walks the chain forward, recomputing each hash. Genesis entry uses previousHash = "0"×64.

POST /v1/log API Key

Append an entry to the tamper-evident audit chain. Returns the entry ID, hash, and chain position.

REQUEST BODY
FieldTypeRequiredDescription
entitystringrequiredResource type (e.g. payment, user, contract).
actionstringrequiredVerb (e.g. created, approved, deleted).
actorstringrequiredIdentity of the actor (user ID, agent name, service account).
dataanyoptionalArbitrary structured payload. Callers are responsible for not including PII.
tagsstring[]optionalFree-form tags for grouping and filtering.
TRY IT OUT
GET /v1/log/:id API Key

Retrieve a specific audit log entry by its UUID, including hash and chain position.

GET /v1/log API Key

List audit entries, newest first. Filterable by entity, action, actor, tags, and time range.

QUERY PARAMETERS
ParamTypeDescription
entitystringFilter by entity type.
actionstringFilter by action verb.
actorstringFilter by actor identity.
tagsstringComma-separated tags (all must match).
fromstringISO 8601 start timestamp.
tostringISO 8601 end timestamp.
limitintegerMax results (default 50, max 200).
offsetintegerPagination offset (default 0).
POST /v1/verify API Key

Verify hash chain integrity over the full chain or a specific range. Returns the first broken entry ID if tampering is detected.

REQUEST BODY
FieldTypeRequiredDescription
fromIdstringoptionalStart entry UUID. Omit to start from genesis.
toIdstringoptionalEnd entry UUID. Omit to verify to latest.
POST /v1/export API Key

Export audit entries as JSON or CSV with a top-level SHA-256 attestation hash for tamper-evident packaging.

REQUEST BODY
FieldTypeRequiredDescription
formatstringoptionaljson | csv. Default json.
fromstringoptionalISO 8601 start timestamp.
tostringoptionalISO 8601 end timestamp.
entitystringoptionalFilter by entity type.
RouteIQ

AI task classification & routing

Classify free-text tasks into domains, complexity tiers, and recommended agent chains. Uses keyword-weighted scoring across 12 domains.

POST /v1/classify API Key

Classify a single task. Returns domain assignment, tier (T1–T4), regulatory flag, AI flag, confidence score, and recommended agent routing chain.

REQUEST BODY
FieldTypeRequiredDescription
taskstringrequiredTask description in natural language. Max 4,000 characters.
domainsstring[]optionalHint domains to consider (overrides auto-detection).
contextobjectoptionalAdditional context metadata.
TRY IT OUT
POST /v1/batch-classify API Key

Classify up to 50 tasks in one request. Returns an array of classification results plus batch-level timing statistics.

REQUEST BODY
FieldTypeRequiredDescription
tasksstring[]requiredArray of task descriptions. Max 50.
GET /v1/domains

List all 12 supported domains with descriptions and applicable regulations. No authentication required.

GET /v1/agents

List all agents grouped by hierarchy level (orchestrator → chief → VP → director → manager → team-lead → specialist → analyst → junior). No authentication required.

LearnLoop

Self-learning reinforcement API

Record state-action-reward learning events. Each API key gets a fully isolated tenant namespace — Thompson Sampling + Q-Learning. Training signal never leaks between tenants.

POST /v1/events API Key

Record a single learning event (state, action, reward) into your tenant's learning namespace.

REQUEST BODY
FieldTypeRequiredDescription
statestringrequiredState identifier (task context, domain, conditions).
actionstringrequiredAction taken (agent ID, tool, decision).
rewardnumberrequiredOutcome signal. Range -1.0 to 1.0 recommended.
metadataobjectoptionalOptional: domain, taskType, agentId for richer Q-state.
POST /v1/batch-events API Key

Record up to 100 learning events in a single call for bulk offline training scenarios.

REQUEST BODY
FieldTypeRequiredDescription
eventsobject[]requiredArray of event objects (same schema as /v1/events). Max 100.
POST /v1/recommend API Key

Get the best action for a given state using Thompson Sampling with Q-Table fallback from your tenant's learned model.

REQUEST BODY
FieldTypeRequiredDescription
statestringrequiredCurrent state for which to recommend an action.
candidatesstring[]requiredAvailable actions to choose from.
contextobjectoptionalOptional domain and taskType hints.
GET /v1/performance/:id API Key

Retrieve per-agent performance statistics from your tenant's learning namespace. Returns reward history, win rates, and confidence intervals.

VectorVault

Vector memory API

Hybrid semantic search using HNSW ANN + BM25 + recency scoring. Full Ebbinghaus-inspired memory decay. Each tenant gets a fully isolated HNSW index.

POST /v1/memories API Key

Store a memory with content, tier, domain, tags, and importance score. Returns a UUID and the initial strength value.

REQUEST BODY
FieldTypeRequiredDescription
contentstringrequiredMemory content to embed and store.
tierstringoptionalcore | working | episodic | semantic | procedural. Default working.
domainstringoptionalDomain tag for filtering.
tagsstring[]optionalFree-form tags.
importancenumberoptionalImportance score 0–1. Affects decay rate. Default 0.5.
metadataobjectoptionalArbitrary key-value metadata.
GET /v1/memories/:id API Key

Retrieve a memory by ID. Also updates its last-accessed timestamp and decay state.

DELETE /v1/memories/:id API Key

Permanently delete a memory from the tenant's vector store. Returns 204 No Content on success.

POST /v1/consolidate API Key

Run Ebbinghaus memory decay consolidation. Decays low-importance memories not accessed recently. Returns counts of strengthened and decayed memories.

BiasGuard

Algorithmic fairness testing

Computes four regulatory fairness metrics: Disparate Impact Ratio (DIR ≥ 0.80 required), Statistical Parity Difference, Equal Opportunity Difference (EOD ≤ 0.10), and Demographic Parity per group.

POST /v1/audit API Key

Run a full bias audit on a prediction dataset. Computes DIR, SPD, EOD, and demographic parity. Returns violations and remediation recommendations.

REQUEST BODY
FieldTypeRequiredDescription
predictionsobject[]requiredArray of prediction records with id, predicted, actual (optional), and protected_attributes.
protected_attributestringrequiredAttribute to analyse (e.g. gender, race, age_group).
privileged_groupstringrequiredValue of the privileged group (e.g. male, white).
favorable_outcomestring|numberoptionalValue considered favorable (default 1 / "approved" / "positive").
thresholdnumberoptionalDIR pass threshold. Default 0.80 (EEOC four-fifths rule).
cURL EXAMPLE
POST /v1/report API Key

Generate a formatted fairness report from a prior audit result. Includes executive summary, metric breakdowns, regulatory citations, and remediation recommendations.

REQUEST BODY
FieldTypeRequiredDescription
audit_idstringrequiredID returned by a prior /v1/audit call.
formatstringoptionaljson | markdown. Default json.
GET /v1/regulations

List all fairness regulations supported by BiasGuard with thresholds, jurisdictions, and applicability rules. No authentication required.