API documentation

export CORTEX_API_KEY="cs_test_REEMPLAZA_POR_LA_TUYA"

curl -X POST 'https://digitalcortex.tech/functions/v1Agents' \
  -H "Authorization: Bearer $CORTEX_API_KEY" \
  -H 'Content-Type: application/json' \
  -d '{
    "slug": "soporte",
    "name": "Soporte",
    "role": "First-line customer support",
    "autonomy_max": "A2",
    "public": true
  }'

curl -X POST 'https://digitalcortex.tech/functions/v1AgentManifest?id=<AGENT_ID>' \
  -H "Authorization: Bearer $CORTEX_API_KEY" \
  -H 'Content-Type: application/json' \
  -d '{
    "version": "1.0.0",
    "changelog": "First version",
    "manifest": {
      "schema": "https://digitalcortex.tech/schemas/agent-manifest/1.0",
      "name": "Soporte",
      "role": "First-line customer support",
      "operator": { "legalName": "ACME Robotics S.L.", "registryCode": "B12345678", "jurisdiction": "ES" },
      "autonomyMax": "A2",
      "skills": ["ticket.read", "ticket.reply"],
      "prohibited": ["payment.execute", "data.delete"],
      "tools": ["helpdesk:read", "helpdesk:write"],
      "limits": { "maxRiskWithoutApproval": "LOW", "maxTransactionEur": null }
    }
  }'

curl -X POST 'https://digitalcortex.tech/functions/v1Credentials' \
  -H "Authorization: Bearer $CORTEX_API_KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H 'Content-Type: application/json' \
  -d '{
    "agent_id": "<AGENT_ID>",
    "scope_skills": ["ticket.read", "ticket.reply"],
    "scope_prohibited": ["payment.execute", "data.delete"],
    "max_risk_without_approval": "LOW",
    "ttl_days": 90
  }'

curl -X POST 'https://digitalcortex.tech/functions/v1Verify' \
  -H 'Content-Type: application/json' \
  -d '{"tenant": "acme", "agent": "soporte", "skill": "ticket.reply"}'

curl -X POST 'https://digitalcortex.tech/functions/v1CredentialRevoke?id=CRD-2026-0002' \
  -H "Authorization: Bearer $CORTEX_API_KEY" \
  -H 'Content-Type: application/json' \
  -d '{"reason": "End of the quickstart", "skip_cascade": true}'

Authorization: Bearer cs_live_7f3a2b9c4d1e8a6f0b2c5d

{
  "error": "plan_limit_reached",
  "message": "The STARTER plan allows 5 agents in production and there are already 5. The SANDBOX environment has no limit.",
  "request_id": "req_6f3a2b9c4d1e8a6f0b2c5d1e",
  "docs_url": "/docs/seal"
}

{
  "id": "6aadb7188529f7ee594cd071",
  "slug": "soporte",
  "name": "Soporte",
  "autonomy_max": "A2",
  "environment": "SANDBOX",
  "public": true,
  "did": "did:web:digitalcortex.tech:t:acme:sandbox:soporte",
  "credential_status": "none",
  "links": {
    "verify": "/verify/acme/soporte",
    "did_document": "/functions/agentDid?t=acme&slug=soporte"
  }
}

{
  "version": "1.0.0",
  "manifest_hash": "ecab5c35f2c6157d…",
  "published_at": "2026-09-18T22:30:00.000Z",
  "credential_invalidated": false
}

{
  "error": "scope_conflict",
  "message": "The manifest does not meet the minimum schema.",
  "conflicting": ["ticket.reply"],
  "details": [{ "field": "skills", "message": "'ticket.reply' is in both skills and prohibited." }]
}

{
  "id": "CRD-2026-0002",
  "credential_id": "urn:uuid:8d690c9b-36d6-4a20-a04a-7ef0424937d3",
  "jwt": "eyJhbGciOiJFUzI1NiIsInR5cCI6InZjK2p3dCIsImtpZCI6…",
  "did": "did:web:digitalcortex.tech:t:acme:sandbox:soporte",
  "environment": "SANDBOX",
  "issued_at": "2026-09-18T22:30:00.000Z",
  "expires_at": "2026-12-17T22:30:00.000Z",
  "status_list": { "id": "cs-acme-1", "index": 16202, "url": "/functions/statusList?list=cs-acme-1" },
  "verify_url": "/verify/acme/soporte",
  "seal_url": "/functions/agentSeal?t=acme&slug=soporte",
  "credential_url": "/functions/agentCredential?t=acme&slug=soporte",
  "warnings": []
}

{
  "ok": true,
  "id": "CRD-2026-0002",
  "agent_slug": "soporte",
  "revoked_at": "2026-09-18T22:45:00.000Z",
  "status_list_version": 2,
  "revoked_count": 1,
  "visible_within_seconds": 60
}

# Por espacio de trabajo y agente
curl -X POST 'https://digitalcortex.tech/functions/v1Verify' -H 'Content-Type: application/json' \
  -d '{"tenant": "acme", "agent": "soporte"}'

# Por credencial concreta
curl -X POST 'https://digitalcortex.tech/functions/v1Verify' -H 'Content-Type: application/json' \
  -d '{"jwt": "eyJhbGciOiJFUzI1NiIsInR5cCI6InZjK2p3dCI…"}'

# Comprobando ademas que una accion concreta esta en el alcance
curl -X POST 'https://digitalcortex.tech/functions/v1Verify' -H 'Content-Type: application/json' \
  -d '{"tenant": "acme", "agent": "soporte", "skill": "ticket.reply"}'

{
  "valid": true,
  "requires_approval": false,
  "checks": {
    "format":          { "ok": true, "detail": "JWS with typ=vc+jwt and kid present" },
    "keyDeclared":     { "ok": true, "detail": "The key is declared in the issuer's assertionMethod" },
    "signature":       { "ok": true, "detail": "Valid ES256 signature" },
    "issuerMatch":     { "ok": true, "detail": "Issued by Cosmolabs OU (did:web:digitalcortex.tech)" },
    "validity":        { "ok": true, "detail": "In force, expires in 90 days" },
    "revocation":      { "ok": true, "detail": "Not revoked" },
    "manifestBinding": { "ok": true, "detail": "Manifest 1.0.0 (ecab5c35f2…157d) unchanged" },
    "scope":           { "ok": true, "detail": "'ticket.reply' within scope" },
    "didDocument":     { "ok": true, "detail": "The published DID document declares this key" }
  },
  "subject":   { "did": "did:web:…", "name": "Soporte", "autonomyLevel": "A2" },
  "principal": { "legalName": "ACME Robotics S.L.", "registryCode": "B12345678", "jurisdiction": "ES" }
}

POST /killswitch HTTP/1.1
Content-Type: application/json
X-Cortex-Signature: t=1789775186,v1=9cb63972…
X-Cortex-Event: agent.killswitch
X-Cortex-Dry-Run: 1          # only on dry runs

{"agent_did":"did:web:…","bindings":[{"id":"…","provider":"openai","ref":"sha256:…","type":"API_KEY"}],
 "credential_id":"CRD-2026-0002","dry_run":false,"event":"agent.killswitch",
 "issued_at":"2026-09-19T09:12:00.000Z","reason":"…","run_id":"…"}

import { createHmac, timingSafeEqual } from 'node:crypto';

export function verifyCortexSignature(rawBody, header, secret, toleranceSeconds = 300) {
  const parts = Object.fromEntries(
    String(header || '').split(',').map((kv) => kv.split('=').map((s) => s.trim()))
  );
  const t = Number(parts.t);
  const given = parts.v1;
  if (!t || !given) return false;
  if (Math.abs(Math.floor(Date.now() / 1000) - t) > toleranceSeconds) return false;

  const expected = createHmac('sha256', secret).update(`${t}.${rawBody}`).digest('hex');
  const a = Buffer.from(expected, 'utf8');
  const b = Buffer.from(given, 'utf8');
  return a.length === b.length && timingSafeEqual(a, b);
}

// Express: use express.raw({ type: 'application/json' }) to get the body AS IT ARRIVED.
app.post('/killswitch', express.raw({ type: 'application/json' }), (req, res) => {
  const raw = req.body.toString('utf8');
  if (!verifyCortexSignature(raw, req.get('X-Cortex-Signature'), process.env.CORTEX_WEBHOOK_SECRET)) {
    return res.sendStatus(401);
  }
  const order = JSON.parse(raw);
  if (req.get('X-Cortex-Dry-Run') === '1') return res.sendStatus(202);
  queue.push(order);           // queue and answer: do not cut inside the handler
  res.sendStatus(202);
});

import hashlib, hmac, json, time

def verify_cortex_signature(raw_body: bytes, header: str, secret: str, tolerance: int = 300) -> bool:
    try:
        parts = dict(p.strip().split("=", 1) for p in (header or "").split(","))
        t = int(parts["t"])
        given = parts["v1"]
    except (ValueError, KeyError):
        return False
    if abs(int(time.time()) - t) > tolerance:
        return False
    signed = f"{t}.".encode() + raw_body
    expected = hmac.new(secret.encode(), signed, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, given)


# FastAPI
@app.post("/killswitch")
async def killswitch(request: Request):
    raw = await request.body()
    if not verify_cortex_signature(raw, request.headers.get("x-cortex-signature", ""), SECRET):
        raise HTTPException(status_code=401)
    if request.headers.get("x-cortex-dry-run") == "1":
        return Response(status_code=202)
    await queue.put(json.loads(raw))
    return Response(status_code=202)

import { CortexSeal, verify } from '@cortexseal/sdk';

const seal = new CortexSeal({ apiKey: process.env.CORTEX_API_KEY! });

const agent = await seal.agents.create({ slug: 'soporte', name: 'Soporte', role: 'First line', autonomyMax: 'A2' });
await seal.manifests.publish(agent.id, { version: '1.0.0', manifest });
const cred = await seal.credentials.issue({
  agentId: agent.id,
  scopeSkills: ['ticket.read'],
  scopeProhibited: ['payment.execute'],
});

const result = await verify({ tenant: 'acme', agent: 'soporte', skill: 'ticket.reply' });
if (!result.valid || result.requires_approval) throw new Error('out of scope, or needs approval');

await seal.credentials.revoke(cred.id, { reason: 'Withdrawn from service', skipCascade: true });

import os
from cortex_seal import CortexSeal, verify

seal = CortexSeal(os.environ["CORTEX_API_KEY"])

agent = seal.agents.create(slug="soporte", name="Soporte", role="First line", autonomy_max="A2")
seal.manifests.publish(agent["id"], version="1.0.0", manifest=manifest)
cred = seal.credentials.issue(
    agent_id=agent["id"],
    scope_skills=["ticket.read"],
    scope_prohibited=["payment.execute"],
)

result = verify(tenant="acme", agent="soporte", skill="ticket.reply")
if not result["valid"] or result.get("requires_approval"):
    raise RuntimeError("out of scope, or needs approval")

seal.credentials.revoke(cred["id"], reason="Withdrawn from service", skip_cascade=True)

curl 'https://digitalcortex.tech/functions/v1Usage' -H "Authorization: Bearer $CORTEX_API_KEY"