HTTP API overview

Agent integrations use the ingest API under /v1/aegis with a bearer ingest key. The console UI uses /v1/console with a session cookie: that surface is for operators, not embedded in customer agents.

Ingest API (agents)

• Authentication
• POST /events: ingest signed APS events
• POST /policy/evaluate: evaluate tool policy
• Approvals: obligation workflow
• Workflow Bridge: POST /workflows/runs start / steps / complete (n8n, Zapier — server-signed)

Public API (no auth)

• Public verify & transparency

Headers (all ingest routes)

• Authorization: Bearer <ingest_api_key>: required
• Content-Type: application/json
• Salanor-Version: 2026-05-18: recommended (SDK sends automatically)
• Idempotency-Key: optional on POST /events

Identity API

User login, org membership, and invitations live on Salanor ID (/v1/id, port 8091). That API powers the console: not agent ingest. Documented separately when external IdP integrations ship.