START HERE

Frequently asked questions

Short, grounded answers to the questions developers ask first. Each one points to the page that covers it in full. If you just want to make a receipt, skip to the Quickstart.

What is a Decision Receipt?

A Decision Receipt is a cryptographically signed, hash-chained record of an autonomous agent's action being evaluated before it takes effect. It captures the evidence behind the action, the policy result, the replay result, and an Ed25519 attestation, so the decision can be reconstructed and checked by anyone later. You get one back from POST /v1/evaluate. See Anatomy of a receipt for a field-by-field walk-through.

What is "admissibility," and how is it different from authorization?

Authorization asks whether an actor was permitted to do something. Admissibility asks whether the decision can be shown to have been right — supported by sufficient evidence, judged against a policy, and reproducible on replay. An action can be fully authorized and still fail to be admissible if its evidence is thin or its outcome cannot be replayed. The full argument lives on Decision admissibility.

Do I need an API key? Which endpoints need authentication?

Only write endpoints require an API key, passed as the X-API-Key header (a Bearer token in Authorization also works). The read-only surfaces — GET /health, GET /v1/status, POST /v1/verify, GET /v1/keys/server, and GET /v1/ledger/stats — are open and need no key. Get a free key with POST /v1/signup; new keys start on the free tier.

How much does it cost, and what are the rate limits?

Rate limits are enforced per key over a one-hour sliding window. The free tier allows 100 requests per hour, pilot allows 10,000 per hour, and enterprise is unlimited. Each response carries X-RateLimit-Limit and X-RateLimit-Remaining; exceeding the limit returns 429. For a pilot or enterprise tier, contact brian@summitcognitive.ai.

Can I verify a receipt without trusting your API?

Yes. You can call POST /v1/verify for an online check, but you do not have to trust the server to confirm a signature. Fetch the server's Ed25519 public key from GET /v1/keys/server (returned as PEM) and validate the attestation offline with any standard Ed25519 library. The Verifying receipts guide walks through both paths.

What do BLOCKED and ESCALATED mean?

Those are policy verdicts. ALLOWED means every policy check passed. BLOCKED means a check failed and the action should not proceed. ESCALATED means the claim needs human attention rather than an automatic pass or fail. See Policy & verdicts for how each is decided and what your caller should do with it.

What happens if a decision doesn't replay deterministically?

Replay determinism is checked as part of every evaluation. If the decision cannot be reproduced, the receipt's admissibility status is recorded as NON_DETERMINISTIC rather than being quietly accepted. The result is recorded honestly so the gap is visible instead of hidden. Replay & determinism explains the status values ACCEPTED, NON_DETERMINISTIC, and REJECTED.

Can I test a policy before enforcing it?

Yes. POST /v1/simulate runs a dry-run policy evaluation and returns the result without persisting a receipt, so you can see how a claim would be judged before you commit to it. This is the safe way to tune thresholds such as minimum sources, required source types, and confidence floors. The Custom policies guide covers the workflow.

What evidence types are supported?

Each source carries a type from a fixed enum: github, ci, agent_trace, code_review, test_result, policy_check, human_approval, model_output, runtime_log, infrastructure, and manual. A claim needs at least one source, and a policy can require a minimum number of distinct types. See Evidence & provenance for how sources, confidence, and chain of custody fit together.

Is there an OpenAPI spec or interactive docs?

Yes. The machine-readable spec is served from GET /v1/openapi.json. For a browsable view, the Swagger UI is at decrec.summitcognitive.ai/docs, and you can send live requests from the playground. The complete written contract is on the API reference.

How do I get a pilot or enterprise tier?

Sign up for a free key at any time with POST /v1/signup. To move to the pilot (10,000 requests/hour) or enterprise (unlimited) tier, contact brian@summitcognitive.ai and we will provision a key for you.

Ready to make your first receipt? The Quickstart takes you from signup to a verified receipt against the live API in about five minutes.