{
  "info": {
    "name": "OmegaEngine API",
    "description": "Decision infrastructure for autonomous AI. Import this collection to start making API calls immediately. Canonical integration order (mirrors https://omegaengine.ai/llms.txt): authorize → sessions → mcp → judge → verify. Headless key: POST /api/auth/signup (see 'Buy — headless agent' folder). Machine discovery: /llms.txt · /openapi.yaml · /.well-known/agent.json · /.well-known/ai-plugin.json",
    "version": "2.7.0",
    "schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json"
  },
  "auth": {
    "type": "apikey",
    "apikey": [
      { "key": "key", "value": "x-api-key", "type": "string" },
      { "key": "value", "value": "{{OMEGA_API_KEY}}", "type": "string" },
      { "key": "in", "value": "header", "type": "string" }
    ]
  },
  "variable": [
    { "key": "BASE_URL", "value": "https://omegaengine.ai", "type": "string" },
    { "key": "OMEGA_API_KEY", "value": "omega_your_key_here", "type": "string" },
    { "key": "OMEGA_ADMIN_KEY", "value": "your_admin_key_here", "type": "string" },
    { "key": "SESSION_ID", "value": "session_id_from_session_start", "type": "string" },
    { "key": "ATTESTATION_ID", "value": "64_hex_attestation_id_here", "type": "string" }
  ],
  "item": [
    {
      "name": "🥇 Golden Path (canonical order)",
      "description": "The canonical agent integration order: authorize → sessions → mcp → judge → verify. Execution gating first, scenario analysis second, independent verification last — every leg below is verified against the live routes.",
      "item": [
        {
          "name": "1. Authorize an action",
          "request": {
            "method": "POST",
            "url": "{{BASE_URL}}/api/authorize",
            "header": [
              { "key": "Content-Type", "value": "application/json" },
              { "key": "Idempotency-Key", "value": "demo-wire-transfer-001" }
            ],
            "body": {
              "mode": "raw",
              "raw": "{\n  \"agent_id\": \"treasury-agent\",\n  \"action\": \"wire_transfer\",\n  \"tool_name\": \"bank.wire_transfer\",\n  \"tool_args\": { \"amount\": 1200, \"vendor\": \"acme\" },\n  \"amount\": 1200,\n  \"vendor\": \"acme\",\n  \"currency\": \"USD\"\n}"
            },
            "description": "Execution authorization guard — call BEFORE any side effect. Returns approved | denied | escalated + risk_score + audit_id. Send exact tool_name + tool_args to bind an approved decision to a one-use execution_capability. Treat denied/escalated/missing capability as blocking. Idempotency-Key makes retries safe."
          }
        },
        {
          "name": "2a. Session start",
          "request": {
            "method": "POST",
            "url": "{{BASE_URL}}/api/authorize/session/start",
            "header": [
              { "key": "Content-Type", "value": "application/json" }
            ],
            "body": {
              "mode": "raw",
              "raw": "{\n  \"agent_id\": \"treasury-agent\"\n}"
            },
            "description": "Open a stateful authorization session. Copy session.session_id from the response into the SESSION_ID collection variable — steps share cumulative risk/spend memory. Sessions are rollout-gated per org: a 403 AUTHORIZE_SESSION_NOT_ENABLED means your org isn't enrolled yet — use plain /api/authorize per action instead."
          }
        },
        {
          "name": "2b. Session step",
          "request": {
            "method": "POST",
            "url": "{{BASE_URL}}/api/authorize/session/step",
            "header": [
              { "key": "Content-Type", "value": "application/json" }
            ],
            "body": {
              "mode": "raw",
              "raw": "{\n  \"session_id\": \"{{SESSION_ID}}\",\n  \"action\": \"wire_transfer\",\n  \"tool_name\": \"bank.wire_transfer\",\n  \"tool_args\": { \"amount\": 1200, \"vendor\": \"acme\" },\n  \"amount\": 1200,\n  \"vendor\": \"acme\",\n  \"currency\": \"USD\"\n}"
            },
            "description": "Authorize one step inside an active session — same decision contract as /api/authorize, plus session risk-memory controls."
          }
        },
        {
          "name": "2c. Session end",
          "request": {
            "method": "POST",
            "url": "{{BASE_URL}}/api/authorize/session/end",
            "header": [
              { "key": "Content-Type", "value": "application/json" }
            ],
            "body": {
              "mode": "raw",
              "raw": "{\n  \"session_id\": \"{{SESSION_ID}}\",\n  \"reason\": \"workflow complete\"\n}"
            },
            "description": "Close the session and get a lifecycle summary."
          }
        },
        {
          "name": "3. MCP tools/call (check_action)",
          "request": {
            "method": "POST",
            "url": "{{BASE_URL}}/api/mcp",
            "header": [
              { "key": "Content-Type", "value": "application/json" }
            ],
            "body": {
              "mode": "raw",
              "raw": "{\n  \"jsonrpc\": \"2.0\",\n  \"id\": 1,\n  \"method\": \"tools/call\",\n  \"params\": {\n    \"name\": \"check_action\",\n    \"arguments\": {\n      \"agent_id\": \"treasury-agent\",\n      \"action\": \"wire_transfer\",\n      \"tool_name\": \"bank.wire_transfer\",\n      \"tool_args\": { \"amount\": 1200, \"vendor\": \"acme\" },\n      \"amount\": 1200,\n      \"vendor\": \"acme\",\n      \"currency\": \"USD\"\n    }\n  }\n}"
            },
            "description": "Remote MCP (stateless Streamable HTTP): one JSON-RPC message per POST, auth via x-api-key. Tools: check_action, claim_approval, scan_agent, verify_proof, get_pricing, get_usage. Execute a side effect only when the result is approved AND includes execution_capability. Stdio twin: npx -y @omegaengine/mcp"
          }
        },
        {
          "name": "4. Judge with signed receipt",
          "request": {
            "method": "POST",
            "url": "{{BASE_URL}}/api/v2/judge",
            "header": [
              { "key": "Content-Type", "value": "application/json" }
            ],
            "body": {
              "mode": "raw",
              "raw": "{\n  \"scenario\": \"Approve $50,000 loan — 780 credit score, 5yr employment\",\n  \"domain\": \"FINANCIAL\",\n  \"riskTolerance\": \"LOW\",\n  \"receipt\": true\n}"
            },
            "description": "Full decision-intelligence pipeline (analysis only — /api/authorize gates execution). \"receipt\": true (Pro+ plans) embeds meta.receipt: a portable Ed25519-signed OmegaReceipt v1 any third party verifies OFFLINE with verifyReceipt() from @omegaengine/verify against {{BASE_URL}}/.well-known/jwks.json — no account, no shared secret. Below Pro the flag adds \"receipt\" to meta.locked; never returned in test mode."
          }
        },
        {
          "name": "5a. Verify sample (zero keys)",
          "request": {
            "auth": { "type": "noauth" },
            "method": "GET",
            "url": "{{BASE_URL}}/api/verify/sample",
            "description": "Deterministic sample attestation with embedded demo JWKS — smoke-test offline verification with no account: npx -y @omegaengine/verify@latest sample --api https://omegaengine.ai"
          }
        },
        {
          "name": "5b. Verify attestation",
          "request": {
            "auth": { "type": "noauth" },
            "method": "GET",
            "url": "{{BASE_URL}}/api/verify/{{ATTESTATION_ID}}",
            "description": "Public, no auth. Fetch a signed agent-security attestation (64-hex content-addressed id) and re-run both checks server-side: Ed25519 signature/content hash + full proof-ledger re-derivation. Response bundles the transparency-log inclusion proof when available. Re-verify offline from the returned JSON with npx @omegaengine/verify."
          }
        },
        {
          "name": "5c. Transparency log — signed tree head",
          "request": {
            "auth": { "type": "noauth" },
            "method": "GET",
            "url": "{{BASE_URL}}/api/transparency/sth",
            "description": "Public. Current Signed Tree Head of the RFC 6962 attestation transparency log: { treeSize, rootHash, timestamp, signatureV2 (EdDSA JWS, verifiable against /.well-known/jwks.json) }. Monitors poll this to detect split-views. Human explorer: {{BASE_URL}}/transparency"
          }
        },
        {
          "name": "5d. Transparency log — inclusion proof",
          "request": {
            "auth": { "type": "noauth" },
            "method": "GET",
            "url": "{{BASE_URL}}/api/transparency/proof/{{ATTESTATION_ID}}",
            "description": "Public. RFC 6962 inclusion proof for an attestation id: { leaf, leafIndex, treeSize, auditPath, sth }. Fold auditPath to the STH root and verify the STH signature against the JWKS — proves the attestation was publicly logged."
          }
        }
      ]
    },
    {
      "name": "💸 Buy — headless agent (signup → price → checkout)",
      "description": "The full no-browser buy leg. An agent mints a free key, reads the machine price book, and starts a paid plan checkout with that key — the Stripe payment URL is handed to a human to complete (card entry is never unattended).",
      "item": [
        {
          "name": "1. Programmatic signup (free key)",
          "request": {
            "auth": { "type": "noauth" },
            "method": "POST",
            "url": "{{BASE_URL}}/api/auth/signup",
            "header": [
              { "key": "Content-Type", "value": "application/json" }
            ],
            "body": {
              "mode": "raw",
              "raw": "{\n  \"email\": \"you@company.com\",\n  \"password\": \"use-a-long-unique-password\",\n  \"tosAccepted\": true\n}"
            },
            "description": "Public, CSRF-exempt for header-only clients. Creates an account and returns { ok, userId, apiKey } — the apiKey (omega_ prefix, free tier) is shown ONCE; store it in the OMEGA_API_KEY variable. tosAccepted must be literally true (Terms: https://omegaengine.ai/terms — acceptance is recorded). Rate limit 10/min per IP; disposable email domains rejected. Already-registered emails get a generic 200 WITHOUT apiKey — use /api/auth/login instead."
          }
        },
        {
          "name": "2. Machine price book",
          "request": {
            "auth": { "type": "noauth" },
            "method": "GET",
            "url": "{{BASE_URL}}/api/pricing",
            "description": "Public, no auth. The machine-readable price book: BYOK subscription tiers (free 100 decisions/mo → developer $299/mo/1,000 → pro $799/mo/5,000 → business → enterprise) plus standalone service products ($499 signed attestation, Evidence Pack, etc.), currency, and effective date. Source of truth an agent should read before quoting a price to its human."
          }
        },
        {
          "name": "3. Start plan checkout (x-api-key)",
          "request": {
            "method": "POST",
            "url": "{{BASE_URL}}/api/billing/checkout",
            "header": [
              { "key": "Content-Type", "value": "application/json" }
            ],
            "body": {
              "mode": "raw",
              "raw": "{\n  \"plan\": \"developer\",\n  \"interval\": \"month\"\n}"
            },
            "description": "Accepts a browser session OR the x-api-key header (collection auth) — a headless-signup key can start its owner's subscription. Returns { ok, url, sessionId, planId }: hand url (Stripe-hosted Checkout) to a human to pay. If a plan subscription is already active, returns a billing-portal url with portal: true instead. free → 400, enterprise → 400 (invoice-first, use /contact). interval: \"year\" may 409 annual_unavailable. Note: Authorization: Bearer is NOT accepted here — x-api-key only."
          }
        }
      ]
    },
    {
      "name": "🚀 Quick Start",
      "item": [
        {
          "name": "Health Check",
          "request": {
            "method": "GET",
            "url": "{{BASE_URL}}/api/health",
            "description": "Check if the API is operational. No authentication required."
          }
        },
        {
          "name": "Ping",
          "request": {
            "method": "GET",
            "url": "{{BASE_URL}}/api/ping",
            "description": "Liveness probe. Returns { ok: true }."
          }
        },
        {
          "name": "Make a Decision",
          "request": {
            "method": "POST",
            "url": "{{BASE_URL}}/api/v2/judge",
            "header": [
              { "key": "Content-Type", "value": "application/json" }
            ],
            "body": {
              "mode": "raw",
              "raw": "{\n  \"scenario\": \"Approve $50,000 loan — 780 credit score, 5yr employment\",\n  \"domain\": \"FINANCIAL\",\n  \"riskTolerance\": \"LOW\"\n}"
            },
            "description": "Decision-intelligence endpoint: verdict, risk score, reasoning, and audit ID. Analysis only — to gate an action before executing it, use the Golden Path folder (POST /api/authorize first)."
          }
        }
      ]
    },
    {
      "name": "📋 Decisions",
      "item": [
        {
          "name": "Judge (Full Pipeline)",
          "request": {
            "method": "POST",
            "url": "{{BASE_URL}}/api/v2/judge",
            "header": [
              { "key": "Content-Type", "value": "application/json" }
            ],
            "body": {
              "mode": "raw",
              "raw": "{\n  \"scenario\": \"Deploy version 3.2.1 to production\",\n  \"context\": \"All CI tests passing, staging verified\",\n  \"domain\": \"TECHNICAL\",\n  \"riskTolerance\": \"LOW\"\n}"
            }
          }
        },
        {
          "name": "Ultra-Fast Decision",
          "request": {
            "method": "POST",
            "url": "{{BASE_URL}}/api/fast-decision",
            "header": [
              { "key": "Content-Type", "value": "application/json" }
            ],
            "body": {
              "mode": "raw",
              "raw": "{\n  \"scenario\": \"Send notification to user\",\n  \"domain\": \"general\"\n}"
            },
            "description": "Ultra-low-latency mode. (The older POST /api/decision is an internal/back-compat orchestration path — do not use it for new integrations.)"
          }
        },
        {
          "name": "Judge with Arbitration (Team+)",
          "request": {
            "method": "POST",
            "url": "{{BASE_URL}}/api/v2/judge",
            "header": [
              { "key": "Content-Type", "value": "application/json" }
            ],
            "body": {
              "mode": "raw",
              "raw": "{\n  \"scenario\": \"Approve $2M acquisition of DataCorp\",\n  \"context\": \"Due diligence complete, revenue $5M ARR\",\n  \"domain\": \"FINANCIAL\",\n  \"riskTolerance\": \"LOW\"\n}"
            },
            "description": "Arbitration runs automatically inside the judge pipeline on eligible plans (Business+ or legacy Team) — there is no request parameter to toggle it."
          }
        }
      ]
    },
    {
      "name": "📝 Feedback & Learning",
      "item": [
        {
          "name": "Submit Feedback",
          "request": {
            "method": "POST",
            "url": "{{BASE_URL}}/api/feedback",
            "header": [
              { "key": "Content-Type", "value": "application/json" }
            ],
            "body": {
              "mode": "raw",
              "raw": "{\n  \"decisionId\": \"dec_xxx\",\n  \"rating\": \"GOOD\",\n  \"comment\": \"Accurate decision\"\n}"
            }
          }
        },
        {
          "name": "Learning Summary",
          "request": {
            "method": "GET",
            "url": "{{BASE_URL}}/api/learning/summary"
          }
        }
      ]
    },
    {
      "name": "🛡️ Safety & Security",
      "item": [
        {
          "name": "Safety Check (via Judge)",
          "request": {
            "method": "POST",
            "url": "{{BASE_URL}}/api/v2/judge",
            "header": [
              { "key": "Content-Type", "value": "application/json" }
            ],
            "body": {
              "mode": "raw",
              "raw": "{\n  \"scenario\": \"Text to analyze for safety violations\",\n  \"domain\": \"SAFETY\",\n  \"riskTolerance\": \"LOW\"\n}"
            },
            "description": "There is no standalone safety endpoint. Safety analysis (22-category attack detection + firewall) runs inside /api/v2/judge — read safetyScore + recommendedAction from the response."
          }
        },
        {
          "name": "Red Team Agent Scan",
          "request": {
            "method": "POST",
            "url": "{{BASE_URL}}/api/redteam/agent-scan",
            "header": [
              { "key": "Content-Type", "value": "application/json" }
            ],
            "body": {
              "mode": "raw",
              "raw": "{\n  \"mode\": \"sample\",\n  \"sampleId\": \"support-vulnerable\"\n}"
            },
            "description": "Free self-serve agent red-team. Sample mode needs no key. For a BYO scan, send mode: byo with systemPrompt, tools, apiKey (used once, never stored), and authorizedToTest: true."
          }
        },
        {
          "name": "Red Team Report",
          "request": {
            "method": "GET",
            "url": "{{BASE_URL}}/api/redteam/report"
          }
        }
      ]
    },
    {
      "name": "📊 Governance & Audit",
      "item": [
        {
          "name": "Get Policies",
          "request": {
            "method": "GET",
            "url": "{{BASE_URL}}/api/policies",
            "description": "List all policies. Governance lives under subpaths like /api/governance/approvals (there is no governance root path)."
          }
        },
        {
          "name": "Export Audit Logs",
          "request": {
            "method": "GET",
            "url": "{{BASE_URL}}/api/audit/export?format=json&limit=100"
          }
        },
        {
          "name": "Compliance Status",
          "request": {
            "method": "GET",
            "url": "{{BASE_URL}}/api/compliance/status"
          }
        },
        {
          "name": "Auth Introspection",
          "request": {
            "method": "GET",
            "url": "{{BASE_URL}}/api/auth/whoami"
          }
        }
      ]
    },
    {
      "name": "⚙️ Admin",
      "item": [
        {
          "name": "Model Health",
          "request": {
            "method": "GET",
            "url": "{{BASE_URL}}/api/admin/models/health",
            "header": [
              { "key": "x-admin-key", "value": "{{OMEGA_ADMIN_KEY}}" }
            ]
          }
        },
        {
          "name": "SLA Metrics",
          "request": {
            "method": "GET",
            "url": "{{BASE_URL}}/api/admin/sla",
            "header": [
              { "key": "x-admin-key", "value": "{{OMEGA_ADMIN_KEY}}" }
            ]
          }
        },
        {
          "name": "Analytics",
          "request": {
            "method": "GET",
            "url": "{{BASE_URL}}/api/admin/analytics",
            "header": [
              { "key": "x-admin-key", "value": "{{OMEGA_ADMIN_KEY}}" }
            ]
          }
        }
      ]
    },
    {
      "name": "💳 Billing",
      "item": [
        {
          "name": "Usage",
          "request": {
            "method": "GET",
            "url": "{{BASE_URL}}/api/billing/usage"
          }
        },
        {
          "name": "Red Team Subscription",
          "request": {
            "method": "GET",
            "url": "{{BASE_URL}}/api/redteam/subscription",
            "description": "Red Team scheduled-monitoring subscription details."
          }
        }
      ]
    }
  ]
}