API v1

API reference

Scoped keys, bounded usage, versioned decisions, and fields that make uncertainty visible.

Base URL https://api.trustiry.comFormat application/json

Quickstart

Make an action-aware check

Use a server-side API key. Keys are shown once, stored as a SHA-256 hash, and tied to one organization with explicit scopes.

curl https://api.trustiry.com/v1/agent-safety \
  -H "Authorization: Bearer <tr_live_your_key>" \
  -H "Content-Type: application/json" \
  -d '{"url":"https://example.com/checkout","intended_action":"payment"}'

Authentication

Send the key as a bearer token. Never place it in a browser bundle, URL, log message, or public repository.

AuthorizationBearer <tr_live_your_key>Manage keys →

Endpoints

POST/v1/check-url

Inspect a URL and return the current decision with its evidence summary.

Required scope: check

POST/v1/domain

Look up a normalized domain profile without transmitting a path or query string.

Required scope: domain

GET/v1/official?q=

Find relationships that passed Trustiry review.

Required scope: official

GET/v1/search?q=

Search records while keeping unreviewed results explicitly unreviewed.

Required scope: search

POST/v1/agent-safety

Check a destination before login, payment, upload, submission, or account creation.

Required scope: agent

Decision object

The decision keeps evidence, observed risk, action policy, confidence, unknowns, and time bounds separate.

{
  "decision_id": "uuid",
  "normalized_domain": "example.com",
  "relationship_status": "unverified",
  "risk_status": "no_high_risk_signal_observed",
  "action": "payment",
  "action_allowed": false,
  "reason_codes": ["no_decisive_signal"],
  "evidence_summary": [
    {"type":"automated_network_check","status":"observed"}
  ],
  "policy_version": "trustiry-policy-2026-07-17",
  "confidence_class": "medium",
  "unknowns": ["official_relationship_not_confirmed"],
  "expires_at": "2026-07-19T15:00:00.000Z"
}

Integration rules

Use POST for URLs

Keep paths and query strings out of access logs and analytics.

Stop when disallowed

Missing evidence never becomes approval for a sensitive action.

Refresh on expiry

Decisions are current observations, not permanent labels.

Show unknowns

Do not hide unresolved evidence when a decision affects a person or business.