Skip to main content
Audact
See the offer

API

Six endpoints. One evidence chain.

Public API host: In development

https://api.audact.ai/v1

The public API host. The code examples document the intended interface and the endpoints used within the current product.

No public API is served on this host yet, apart from the published Merkle roots at /v1/metachain. The endpoints used inside the product are not the same thing as a public API.

Why this status
Claim
In development · By application
Scope
The public API host. The code examples document the intended interface and the endpoints used within the current product.
Ground
No public API is served on this host yet, apart from the published Merkle roots at /v1/metachain. The endpoints used inside the product are not the same thing as a public API.
What it does not establish
That any individual endpoint works today. That is confirmed per endpoint, and the confirmation is open.
What you can get today
Production access sits inside an applicable paid agreement. Endpoints are not priced separately.
Last checked
5 October 2026
Where to check it
/apis

API: In development

Every Audact API answers the same question in a different place: may this happen, and what does it leave behind. The public host is not available; access runs through onboarding, and availability is confirmed per endpoint there. The pages below document the intended interface and the endpoints used within the current product. The evidence chain is designed so that receipts from every endpoint share one Merkle tree and one export — that design is not yet something an auditor can exercise end to end. All six are part of Agency Voice and Enterprise; there is no per-API procurement.

One call, before the action

curl -X POST https://api.audact.ai/v1/governance/gate \
  -H "Authorization: Bearer $AUDACT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "agent_id": "agent_dental_intake_v2",
    "candidate_response": "Sure, I can offer 50% off the implant package.",
    "policy_bundle": "dental_de_brand_v3"
  }'

The same authorisation header, base URL and error shape on all six endpoints.

The answer, and the artefact

{
  "verdict": "BLOCK",
  "reasons": [
    { "policy": "commercial_commitment", "severity": "hard" }
  ],
  "rewrite_suggestion": "I can connect you with our scheduling team.",
  "call_id": "7f3c2a1e-0000-4000-8000-000000000000"
}

Allow, modify or block. A receipt either way, including for a block.

What is available

REST, versioned under /v1. Request and response shapes as documented here.
In development
Webhooks with an HMAC-SHA256 authentication code, at-least-once delivery, 72-hour replay window.
In development
TypeScript, Python and Go SDKs.
Planned
Rate-limited sandbox tenant, provisioned after a scoping call.
Planned
Production access after domain-ownership and legal-entity verification.
By design — no anonymous production keys

The six

One regulatory primitive each.

They compose. A single outbound call typically touches three of them: eligibility before the dial, the gate before each utterance, attestation on the disclosure. Every one of those writes into the same chain.

  • Endpoint
    Governance Gate
    What it decides
    May this utterance reach the person?
    Status
    In controlled testing
  • Endpoint
    Article 50 Attestation
    What it decides
    Was the disclosure made, and where in the call?
    Status
    In controlled testing
  • Endpoint
    Outbound Eligibility
    What it decides
    May this number be dialled, now, by you?
    Status
    In controlled testing
  • Endpoint
    Evidence Vault
    What it decides
    Retrieve and recompute what was recorded. Production export worked when it was retested on 26 August 2026 after the deploy (measured on browser calls rather than over a telephone line).
    Status
    Working today · retested on 26 August 2026 after the deploy
  • Endpoint
    Multi-regulation
    What it decides
    Which policy pack applies in this country?
    Status
    Germany: national policy layer active. Netherlands: in development. Belgium and Austria: planned.
  • Endpoint
    Channel continuity
    What it decides
    Carry the chain across a hand-off. Voice only; chat and email are planned.
    Status
    In controlled testing

Shared by all six

One chain and one export, by design.

  • The chain is designed so that every event from every endpoint shares one Merkle tree, and an auditor would then need one export rather than six. Production export worked when it was retested on 26 August 2026 after the deploy (measured on browser calls rather than over a telephone line).
  • One legal entity, one contract, one invoice. No per-API procurement and no per-API negotiation.
  • Errors, pagination, idempotency keys and the receipt envelope are identical across endpoints. Learn one, you know all six.
  • The governance stack behind them is patent-pending at the UK IPO.

Questions

What is in a receipt?
Three things anyone can recompute today without a key or an account: the hash of what went in, the hash of what came out, and the link to the receipt before it. A fourth, inclusion in the Merkle root, is checked against the published root with the inclusion proof from the call's Article 50 report. Alongside those sits an authentication code (HMAC-SHA256) under a symmetric key held by Audact. It is not a digital signature and there is no public verification key.
What happens if the gate is unreachable?
There is no single answer. The failure contract differs per action class and is agreed per customer and written into the contract; /apis/governance-gate and /architecture set out the cases.
Can I use one endpoint without the others?
Yes. They compose but do not depend on each other. The only shared piece is the evidence chain, and that is what makes using two of them cheaper than using one twice.

The shape of a request, end to end

The architecture page carries the request path, the failure behaviour, and the field-by-field note on which parts of a receipt a third party can recompute without a key.

See the architecture

Related