HTTP API overview

Agent integrations use the ingest API under /v1/aegis with a bearer ingest key. The console UI uses /v1/console with a session cookie — that surface is for operators, not embedded in customer agents.

Ingest API (agents)

• Authentication
• POST /events — ingest signed APS events
• POST /policy/evaluate — evaluate tool policy
• Approvals — obligation workflow

Public API (no auth)

• Public verify & transparency

Headers (all ingest routes)

• Authorization: Bearer <ingest_api_key> — required
• Content-Type: application/json
• Salanor-Version: 2026-05-18 — recommended (SDK sends automatically)
• Idempotency-Key — optional on POST /events

Identity API

User login, org membership, and invitations live on Salanor ID (/v1/id, port 8091). That API powers the console — not agent ingest. Documented separately when external IdP integrations ship.