API Reference
Seven compliance and AI infrastructure products. One API key. Base URL: https://api.agengate.com
Get an API key
Sign up for free at agengate.com/signup — no credit card required. Your key is generated instantly with the prefix ag_live_. Pass it on every authenticated request as the X-API-Key header.
Free plan includes 100 validations/month and gates G1, G2, G3. Upgrade anytime from the dashboard.
Install the SDK
Validate your first agent output
Validate agent output
Run an agent output through all 8 quality gates and receive a cryptographic SHA-256 evidence chain regardless of outcome.
Validates agent output against compliance gates. Runs G1–G8 based on domain, tier, and regulatory flags. Returns findings, violations, recommendations, and a tamper-evident evidence package.
| Field | Type | Required | Description |
|---|---|---|---|
| agent_output | string | required | The raw text output from the agent to validate. |
| context | object | required | Execution context for the agent. |
| context.domain | string | required | One of: banking, finance, accounting, legal, compliance, engineering, security, ai, data, brands, suppliers, product. |
| context.task_type | string | required | Short verb describing the task (e.g. build, analyze, report). |
| context.tier | string | required | Complexity tier: T1, T2, T3, or T4. |
| context.regulatory | boolean | required | true if this output touches regulated data or processes. |
| context.ai_touching | boolean | required | true if the output was produced or processed by an AI model. |
| gates | string[] | optional | Subset of gate IDs to run (G1–G8). Omit to run all applicable. |
| evidence | boolean | optional | Include cryptographic evidence chain in response. Default true. |
Retrieve a past validation result by its UUID. Returns the full result including gate outcomes and evidence chain.
List recent validations. Paginated and filterable by status.
| Param | Type | Default | Description |
|---|---|---|---|
| status | string | — | Filter by: passed, failed, warning. |
| limit | integer | 50 | Max results per page (max 200). |
| offset | integer | 0 | Number of records to skip. |
Generate a full compliance audit package for a regulation. Packages all evidence with a top-level SHA-256 attestation hash suitable for regulatory submission.
| Field | Type | Required | Description |
|---|---|---|---|
| regulation | string | required | One of: gdpr, pci-dss, sox, aml, iso27001, eu-ai-act, dora, ccpa, basel, ifrs. |
List all supported regulations with jurisdiction, effective date, and control counts.
List all 8 quality gates (G1–G8) with descriptions, check IDs, and applicability rules.
Global and per-key usage statistics: total validations, pass rate, average duration, and per-gate breakdowns.
Liveness probe. No authentication required. Use for uptime monitoring and pre-flight checks.
Create subscription
Subscribe to any product and plan. Payment is processed immediately via Multicard Mesh (UZS) or Stripe (USD).
| Field | Type | Required | Description |
|---|---|---|---|
| customer_id | string | required | Customer identifier (email or UUID). |
| product | string | required | agentgate | pii-shield | audittrail | routeiq | learnloop | vectorvault | biasguard. |
| plan | string | required | starter | pro | enterprise. |
| billing_cycle | string | required | monthly | annual. |
Check whether the authenticated API key has an active subscription and which plan it is on.
Current-period usage and projected cost for the authenticated key.
Full payment history for the authenticated API key with invoice IDs, amounts, and statuses.
Scan text for PII
Detect and redact personally identifiable information using composable regex patterns. Supports email, SSN, IBAN, credit cards, passport, phone, IP address, DOB, and custom patterns.
| Field | Type | Required | Description |
|---|---|---|---|
| text | string | required | Text to scan. Max 1,000,000 characters. |
| redact | boolean | optional | Return redacted text alongside findings. Default false. |
| mode | string | optional | Redaction mode: mask (***) | hash (sha256) | type ([EMAIL]) | remove. Default mask. |
Scan up to 100 texts in a single request. Accepts the same redact and mode options as /v1/scan.
| Field | Type | Required | Description |
|---|---|---|---|
| texts | string[] | required | Array of strings to scan. Max 100 items. |
| redact | boolean | optional | Redact all matches. Default false. |
| mode | string | optional | mask | hash | type | remove. Default mask. |
Register a custom PII detection pattern for your workspace. Returns 409 if the pattern ID already exists.
| Field | Type | Required | Description |
|---|---|---|---|
| id | string | required | Unique slug (lowercase, hyphens/underscores only). |
| type | string | required | PII type label (e.g. employee_id). |
| label | string | required | Display label for [TYPE] redaction mode. |
| pattern | string | required | JavaScript-compatible regex string. |
| flags | string | optional | Regex flags (default: gi). |
Tamper-evident audit logging
Every entry is SHA-256 hashed into an append-only chain. Verification walks the chain forward, recomputing each hash. Genesis entry uses previousHash = "0"×64.
Append an entry to the tamper-evident audit chain. Returns the entry ID, hash, and chain position.
| Field | Type | Required | Description |
|---|---|---|---|
| entity | string | required | Resource type (e.g. payment, user, contract). |
| action | string | required | Verb (e.g. created, approved, deleted). |
| actor | string | required | Identity of the actor (user ID, agent name, service account). |
| data | any | optional | Arbitrary structured payload. Callers are responsible for not including PII. |
| tags | string[] | optional | Free-form tags for grouping and filtering. |
Retrieve a specific audit log entry by its UUID, including hash and chain position.
List audit entries, newest first. Filterable by entity, action, actor, tags, and time range.
| Param | Type | Description |
|---|---|---|
| entity | string | Filter by entity type. |
| action | string | Filter by action verb. |
| actor | string | Filter by actor identity. |
| tags | string | Comma-separated tags (all must match). |
| from | string | ISO 8601 start timestamp. |
| to | string | ISO 8601 end timestamp. |
| limit | integer | Max results (default 50, max 200). |
| offset | integer | Pagination offset (default 0). |
Verify hash chain integrity over the full chain or a specific range. Returns the first broken entry ID if tampering is detected.
| Field | Type | Required | Description |
|---|---|---|---|
| fromId | string | optional | Start entry UUID. Omit to start from genesis. |
| toId | string | optional | End entry UUID. Omit to verify to latest. |
Export audit entries as JSON or CSV with a top-level SHA-256 attestation hash for tamper-evident packaging.
| Field | Type | Required | Description |
|---|---|---|---|
| format | string | optional | json | csv. Default json. |
| from | string | optional | ISO 8601 start timestamp. |
| to | string | optional | ISO 8601 end timestamp. |
| entity | string | optional | Filter by entity type. |
AI task classification & routing
Classify free-text tasks into domains, complexity tiers, and recommended agent chains. Uses keyword-weighted scoring across 12 domains.
Classify a single task. Returns domain assignment, tier (T1–T4), regulatory flag, AI flag, confidence score, and recommended agent routing chain.
| Field | Type | Required | Description |
|---|---|---|---|
| task | string | required | Task description in natural language. Max 4,000 characters. |
| domains | string[] | optional | Hint domains to consider (overrides auto-detection). |
| context | object | optional | Additional context metadata. |
Classify up to 50 tasks in one request. Returns an array of classification results plus batch-level timing statistics.
| Field | Type | Required | Description |
|---|---|---|---|
| tasks | string[] | required | Array of task descriptions. Max 50. |
List all 12 supported domains with descriptions and applicable regulations. No authentication required.
List all agents grouped by hierarchy level (orchestrator → chief → VP → director → manager → team-lead → specialist → analyst → junior). No authentication required.
Self-learning reinforcement API
Record state-action-reward learning events. Each API key gets a fully isolated tenant namespace — Thompson Sampling + Q-Learning. Training signal never leaks between tenants.
Record a single learning event (state, action, reward) into your tenant's learning namespace.
| Field | Type | Required | Description |
|---|---|---|---|
| state | string | required | State identifier (task context, domain, conditions). |
| action | string | required | Action taken (agent ID, tool, decision). |
| reward | number | required | Outcome signal. Range -1.0 to 1.0 recommended. |
| metadata | object | optional | Optional: domain, taskType, agentId for richer Q-state. |
Record up to 100 learning events in a single call for bulk offline training scenarios.
| Field | Type | Required | Description |
|---|---|---|---|
| events | object[] | required | Array of event objects (same schema as /v1/events). Max 100. |
Get the best action for a given state using Thompson Sampling with Q-Table fallback from your tenant's learned model.
| Field | Type | Required | Description |
|---|---|---|---|
| state | string | required | Current state for which to recommend an action. |
| candidates | string[] | required | Available actions to choose from. |
| context | object | optional | Optional domain and taskType hints. |
Retrieve per-agent performance statistics from your tenant's learning namespace. Returns reward history, win rates, and confidence intervals.
Vector memory API
Hybrid semantic search using HNSW ANN + BM25 + recency scoring. Full Ebbinghaus-inspired memory decay. Each tenant gets a fully isolated HNSW index.
Store a memory with content, tier, domain, tags, and importance score. Returns a UUID and the initial strength value.
| Field | Type | Required | Description |
|---|---|---|---|
| content | string | required | Memory content to embed and store. |
| tier | string | optional | core | working | episodic | semantic | procedural. Default working. |
| domain | string | optional | Domain tag for filtering. |
| tags | string[] | optional | Free-form tags. |
| importance | number | optional | Importance score 0–1. Affects decay rate. Default 0.5. |
| metadata | object | optional | Arbitrary key-value metadata. |
Hybrid search combining semantic similarity (HNSW cosine), BM25 keyword matching, and recency scoring. Returns ranked results with relevance scores.
| Field | Type | Required | Description |
|---|---|---|---|
| query | string | required | Natural language search query. |
| topK | integer | optional | Number of results to return. Default 10, max 100. |
| tier | string | optional | Filter by memory tier. |
| domain | string | optional | Filter by domain. |
| minStrength | number | optional | Minimum memory strength (0–1). Filters decayed memories. |
Retrieve a memory by ID. Also updates its last-accessed timestamp and decay state.
Permanently delete a memory from the tenant's vector store. Returns 204 No Content on success.
Run Ebbinghaus memory decay consolidation. Decays low-importance memories not accessed recently. Returns counts of strengthened and decayed memories.
Algorithmic fairness testing
Computes four regulatory fairness metrics: Disparate Impact Ratio (DIR ≥ 0.80 required), Statistical Parity Difference, Equal Opportunity Difference (EOD ≤ 0.10), and Demographic Parity per group.
Run a full bias audit on a prediction dataset. Computes DIR, SPD, EOD, and demographic parity. Returns violations and remediation recommendations.
| Field | Type | Required | Description |
|---|---|---|---|
| predictions | object[] | required | Array of prediction records with id, predicted, actual (optional), and protected_attributes. |
| protected_attribute | string | required | Attribute to analyse (e.g. gender, race, age_group). |
| privileged_group | string | required | Value of the privileged group (e.g. male, white). |
| favorable_outcome | string|number | optional | Value considered favorable (default 1 / "approved" / "positive"). |
| threshold | number | optional | DIR pass threshold. Default 0.80 (EEOC four-fifths rule). |
Generate a formatted fairness report from a prior audit result. Includes executive summary, metric breakdowns, regulatory citations, and remediation recommendations.
| Field | Type | Required | Description |
|---|---|---|---|
| audit_id | string | required | ID returned by a prior /v1/audit call. |
| format | string | optional | json | markdown. Default json. |
List all fairness regulations supported by BiasGuard with thresholds, jurisdictions, and applicability rules. No authentication required.