HTTP reference
Console API — port 8788, proxied at /api/
Reads carry Authorization: Bearer … when the visitor has proved an address.
Without one the API answers with what the deployment published and nothing else, which
is the right answer for somebody who has signed nothing — the recorded incident is
published, so a reader with no wallet still reaches a complete case file.
Reads the evidence spine. It can record exactly two things — a named human's decision on a hold, and a disclosure request — and it cannot write an action, a case step or a finding: the database role has no grant for those.
| Route | Answers |
|---|---|
| GET /api/challenge?address= | A one-shot sign-in challenge, and the exact sentence a wallet will show |
| POST /api/session | Exchanges a signed challenge for a bearer token. The token reads and never writes |
| POST /api/signout | Ends it |
| GET /api/whoami | Which address this request has proved, or null |
| GET /api/incident | The pinned incident, or ?mandate= / ?owner=. Bounds, actions, settled window. Detail of an unpublished instrument needs proof of control |
| GET /api/mandates | Every instrument one ?owner= holds. Only that owner may ask |
| GET /api/case/:actionId | The assembled case file, with every claim's citation. Follows its instrument's access rule |
| GET /api/authoriser/:address | Whether an address may resolve holds for an owner |
| GET /api/deployment | Chain id, contract addresses, and Hedera's 0.0.x id for each |
| GET /api/hedera?address= | The 0.0.x id for one address. null is an answer: a key that has never received value here has no account yet |
| POST /api/preview | What a mandate would permit — simulated, no wallet |
| POST /api/investigate | Runs the supervisory crew for one held action. Signed in as that mandate’s owner, and capped: three per owner per day, forty across the deployment. The only route here that spends money |
| GET /api/investigate/:actionId | What the crew is doing, or why it stopped |
| POST /api/disclosure | A disclosed record, verified against its published commitment. Signed in, so the audit row carries a proved address beside the claimed name |
| POST /api/decision | Files a decision the chain already shows. A forged one is refused with 409, and so is a second filing of the same transaction — one transaction, one decision |
Relayer — port 8789, proxied at /relay/
Pays for postage and holds no authority. Every payload it forwards is already signed by the party that matters, so it is unauthenticated by design and capped by balance: per visitor, across all visitors, and a reserve below which it stops rather than stranding somebody halfway through their first mandate.
| Route | Forwards |
|---|---|
| GET /relay/status | Relayer address, balance, reserve, caps, contracts |
| POST /relay/session | Derives a visitor's agent, funds it for gas, mints test tokens |
| POST /relay/permit | An EIP-2612 approval — the guard as sole spender |
| POST /relay/venue | A signed venue classification |
| POST /relay/authoriser | A signed authoriser appointment |
| POST /relay/mandate | A signed mandate registration |
| POST /relay/run | Runs the visitor's agent until something is held |
| POST /relay/resolve | A signed release or refusal from a named authoriser |
What the relayer will spend
Ceilings, not targets. The service exists so a visitor can use AMW without holding HBAR; it does not exist to be a faucet, and the difference is entirely in these figures.
| Cap | Figure | Why that one |
|---|---|---|
| HBAR to one visitor's agent | 6 | Hedera reserves gas limit × gas price before it runs anything; at ~1,200 gwei one action puts about 1.7 HBAR on hold |
| Test USDC minted, once | 3,000,000 | Enough for the incident, not for a market |
| Forwards per visitor per hour | 40 | A session, a mandate and two runs, with room to make mistakes |
| Forwards across all visitors per hour | 400 | A room full of people, not a script |
| Reserve it will not spend below | 25 | It stops rather than stranding somebody halfway through their first mandate |
| Actions one run may fire | 12 | The incident needs nine |
Sends from one key are serialised and a nonce collision is refetched and retried, so concurrent visitors do not refuse each other's transactions. A revert is never retried: it is the contract deciding.