Documentation

The SabiProfile API, end to end.

Everything an integrator needs: how authentication works, which routes exist, and what the verification pipeline guarantees. Full request and response schemas live in the repository as API_DOCUMENTATION.md.

Four credentials, four jobs

Citizen vault routes

User session

Supabase Auth session cookie or Bearer JWT. Roles come from server-managed app metadata and cannot be set by the caller.

Screening, M2M, and query routes

Organization key

X-Sabi-Org-Key header, issued by a super admin to a registered organization in active standing.

Candidate data access, always paired with an organization key

Scoped consent key

sbk_live_v1_... token minted by a citizen. HMAC-signed, scoped to categories, with TTL, query quota, recipient binding, and one-click revocation.

Admin control-plane routes

Admin master key

X-Sabi-Admin-Key or Bearer matching the deployment's master secret. Rejects default or missing secrets in production.

Endpoint index

Citizen vault

GET /api/v1/vault/credentials
List the caller's vault records
POST /api/v1/vault/credentials
Add a record to the caller's vault
DELETE /api/v1/vault/credentials
Remove a record from the caller's vault
POST /api/v1/vault/sync
Ephemeral cloud sync, hash, and on-chain commit
GET /api/v1/vault/keys
List scoped keys (summaries only, secrets never re-disclosed)
POST /api/v1/vault/keys
Mint a scoped consent key
POST /api/v1/vault/keys/revoke
Revoke a key the caller owns
GET /api/v1/vault/audit-log
Citizen transparency log of vault access

Screening and queries

POST /api/v1/screen
Screen one candidate key against a rubric (org key + consent key)
POST /api/v1/vault/query
Consented scoped read of a candidate vault (dual key)
POST /api/v1/enterprise/criteria
Manage requirement rubrics
POST /api/v1/enterprise/screen-batch
Parallel batch screening

Machine to machine

POST /api/v1/m2m/query
Scoped candidate query with quota decrement
POST /api/v1/m2m/evaluate
Multi-agent evaluation with dual-key authentication
POST /api/v1/m2m/batch-verify
Queued batch verification
GET /api/v1/m2m/webhooks
List webhook subscriptions
POST /api/v1/m2m/webhooks
Subscribe to key.revoked and tamper events

Government, notary, admin

GET /api/v1/govt/analytics
Sovereign node telemetry and revenue share
POST /api/v1/govt/disburse
Disburse the 40% sovereign split
POST /api/v1/notary/attest
Tier 2 legal attestation anchored on-chain
GET /api/v1/admin/orgs
Organization registry (admin key)
GET /api/v1/admin/users
User registry (admin key)
GET /api/v1/admin/telemetry
Platform telemetry (admin key)
GET /api/v1/admin/config
Configuration vault (admin key)

Verification guarantees

Every screening run starts with an on-chain integrity check. A hash mismatch or a simulated anchor fails the request closed.
Scoped keys enforce their own policy: category scope, expiry, quota, and recipient binding are verified on every call.
The evaluation agent cites only verified record fields. Missing data fails the category; it is never estimated.
Production deployments refuse to start verification without configured signing and admin secrets.