Infrastructure
Your agents, governed by the same layer as ours
The trust layer is not a Xyranik feature that happens to be exposed. It is infrastructure, and an agent you wrote elsewhere can hold a credential, ask the gateway for permission, and be refused by the same code that refuses ours.
14-day evaluation · no card · start before you connect anything
How it works
- 1
Scoped tokens, stored as a hash
A token carries only the permissions you granted it, and only a one-way hash is kept — so it cannot be shown again after it is created, by us or by anybody who reaches the database.
- 2
Rotation with an overlap
A replacement token can be issued while the old one still works, so an integration can be moved across without a window where it is broken.
- 3
A test token that writes nothing
A test credential reads your real records and simulates every write — checked exactly as a live one would be, and answered as simulated. It is the sandbox, and it means the code path you tested is the code path that runs.
- 4
Idempotent writes
Writes take an idempotency key, and the same request repeated within the window returns the first answer rather than doing the work twice.
POST /api/v1/agent/authorize
Authorization: Bearer xyr_agt_…
Idempotency-Key: 8f2c41b0-…
{ "action": "adjust_campaign_budget",
"facts": { "amountPercent": 12 } }{ "verdict": "requires_approval",
"because": ["a rule asks a person above 20%"],
"simulated": false }The same three verdicts our own agents receive, from the same gateway. A test credential answers simulated: true and writes nothing.
What you can build with it
A description generated from the API itself
The OpenAPI document is produced from the same registry the API answers from, so the description and the behaviour cannot disagree. The live endpoint list is on the platform overview.
Usage you can actually read
Calls are broken down per token, by endpoint and by day, so an integration that has started misbehaving is visible before the bill is.
The same three answers
Allow, require approval, deny — the same verdicts our own agents receive, from the same gateway.
Limits, and what is not served
Listed here rather than discovered against a rate limiter at three in the morning.
There are no client libraries
No SDKs exist. Any HTTP client works, and most languages can generate one from the OpenAPI description — but we would rather say that than list SDKs we have not written.
Rate limits are per token and fixed
Each token has an hourly allowance stated in the reference. It is not negotiable per endpoint, and exceeding it is refused rather than queued.
Build an agent that can act without a blank cheque
Your agents ask the same gateway ours do, on a credential of their own, and are held to the same permissions, limits and record. The endpoint list is served by the API itself rather than written out here.