Skip to main content
This is the reference for the Sakshi HTTP API. The endpoint pages under Endpoints are generated from the live OpenAPI spec, so they always match the version of Sakshi you are running. This page orients you before you go there.

​
Base URL

Sakshi is single-tenant and runs in your environment, so the base URL is your own deployment:
The public demo at https://demo.rotavision.com serves the same API, read-only, over synthetic data. Every path below is relative to your base URL.

​
Versioning

All endpoints live under a version prefix:
New capabilities are added within v1. A breaking change would move to a new prefix, so a URL that works today keeps working.

​
Authentication

Every request carries a Bearer token in the Authorization header:
The token is either an ingest API key (register and witness) or an OIDC JWT from your IdP (governance and admin actions). Which one you need depends on the endpoint. See Authentication for how to mint, use, and rotate them, and Errors for what 401 and 403 mean.

​
Modules

The endpoints are grouped by tag, one per capability, plus two for the calling principal and access control:

register

Know Your Agent. Agents and models, ownership and provenance, attestations, verified agent identity, and the ingest keys and webhooks that feed the platform.

witness

The flight recorder. Capture a decision to the tamper-evident chain, list records, and recompute the chain with chain/verify and chain/head.

bound

Autonomy envelopes and enforcement. Evaluate an intended action, request a human handoff, drive the kill switch and circuit breakers, and work the review queues.

vidhi

Evidence. Regulator-mapped clause maps and readiness, signed evidence packs, incident register, evaluation runs, DPIA support, and audit bundles.

vishwas

Declared-first fairness. Declared and locality screens, pre-deploy runs, and the extraction, disposition, and MCP governance screens.

access

Admin-only. The entitlement mapping from IdP roles and groups to a Sakshi role and org unit, kept as chain-attested config.

me

The calling principal: the resolved entitlements for your token and your briefing.

​
Using the reference

Each endpoint page shows its method, path, parameters, request body, and response schema, with a live request panel. Point it at your deployment, paste a Bearer token, and call it.

Authentication

Ingest keys versus OIDC JWTs, and when each is required.

Python SDK

For most integrations, use the SDK instead of raw HTTP: it wraps these endpoints, buffers capture, and models the enforcement outcomes.