Skip to main content
The Akhara PDP exposes a small HTTP API. Enforcement clients call a single endpoint, /api/policy/authorize; the rest onboard agents, attach policies, and read the evidence trail.

OpenAPI spec

The endpoints below are generated from api-reference/openapi.json.

​
Base URL

​
Authentication

Management endpoints take a workspace key as a bearer token:
The authorize endpoint identifies the caller by agentId in the body; an unknown agent returns 404 agent not found.

​
Conventions

  • All request and response bodies are JSON.
  • Timestamps are epoch milliseconds (ts, receivedAt).
  • Secrets are never returned: agent reads expose only apiKeyMasked.
  • Writes to the evidence feed are append-only (events.jsonl).

​
Endpoint groups

Enforcement

The authorize call every PEP makes.

Agents

Onboard, attach policies, provision, delete.

Evidence

Telemetry ingest and signed verification records.