GrayPass
Docs
Download PDF
For agents

API reference

The canonical JSON API uses HTTPS on https://app.graypass.org. Requests and responses use JSON unless an operation returns no content. The API version is an explicit contract identifier, not a deployment date.

Begin with authentication and errors and retries. Each operation below links to its credential scope, parameters, request body and response types. The schema catalog defines fields and constraints.

Operations

MethodPathOperation
GET/.well-known/graypass-proof-keys.jsonRead public proof verification keys
GET/api/v1/actionsList protected actions
POST/api/v1/actionsRegister a protected action
DELETE/api/v1/actions/{action_id}Archive a protected action
GET/api/v1/actions/{action_id}Read a protected action
PATCH/api/v1/actions/{action_id}Update action metadata or mode
GET/api/v1/actions/{action_id}/policy-versionsList action policy versions
POST/api/v1/actions/{action_id}/policy-versionsCreate a draft policy version
POST/api/v1/actions/{action_id}/policy-versions/{version}/activateActivate a reviewed policy version
GET/api/v1/activityList authorization activity
GET/api/v1/authorizations/{authorization_id}Read an authorization trace
POST/api/v1/authorizations/{authorization_id}/outcomeRecord the business outcome
POST/api/v1/authorizations/{authorization_id}/reviewResolve a held authorization
POST/api/v1/authorizeEvaluate a bound business request
GET/api/v1/challenges/{challenge_id}Read a scoped challenge
POST/api/v1/challenges/{challenge_id}/cancelCancel a pending challenge
POST/api/v1/challenges/{challenge_id}/completeComplete explicit action confirmation
POST/api/v1/challenges/{challenge_id}/passkey/optionsGet action-bound passkey options
POST/api/v1/client-tokensMint a scoped browser token
GET/api/v1/credentialRead calling credential identity
GET/api/v1/evaluationsList shadow evaluations
POST/api/v1/evaluationsCreate a shadow evaluation
POST/api/v1/evaluations/{evaluation_id}/closeClose a shadow evaluation
GET/api/v1/evaluations/{evaluation_id}/reportRead evaluation metrics
GET/api/v1/metaRead API capabilities and reason vocabulary
GET/api/v1/proofs/{jti}/statusRead current proof state
POST/api/v1/sessionsOpen an evidence session
GET/api/v1/sessions/{session_id}/assessmentRead a server Assurance Profile
POST/api/v1/sessions/{session_id}/endEnd an evidence session
POST/api/v1/sessions/{session_id}/evidenceSubmit an SDK evidence window
GET/api/v1/sessions/{session_id}/statusRead browser-safe session status
GET/api/v1/subjectsList subjects
POST/api/v1/subjectsCreate a pseudonymous subject
DELETE/api/v1/subjects/{subject_id}Delete operational subject data
GET/api/v1/subjects/{subject_id}Read a subject
POST/api/v1/subjects/{subject_id}/adaptation/freezeFreeze template adaptation
POST/api/v1/subjects/{subject_id}/enrollments/completeComplete ready enrollment
POST/api/v1/subjects/{subject_id}/exportExport bounded subject records
POST/api/v1/subjects/{subject_id}/passkeys/register/completeComplete passkey registration
POST/api/v1/subjects/{subject_id}/passkeys/register/optionsBegin passkey registration
POST/api/v1/subjects/{subject_id}/passkeys/registration-grantsIssue a passkey registration grant
DELETE/api/v1/subjects/{subject_id}/passkeys/{passkey_id}Revoke a registered passkey
POST/api/v1/subjects/{subject_id}/recoveryBegin subject recovery
POST/api/v1/subjects/{subject_id}/research-consentRecord or withdraw research consent
POST/api/v1/subjects/{subject_id}/revokeRevoke subject assurance
POST/api/v1/verifyVerify and optionally consume a proof

Machine-readable contract

Download OpenAPI JSON for client generation and request and response schemas, including field names, required values, defaults and constraints. Compare its API version with GET /api/v1/meta when integrating. Configure generated clients to handle the validation response convention.

Shared response and example conventions

Authentication, scope, rate-limit and dependency failures apply across operations; see errors and safe retry rules. Operation-specific failure notes supplement that common contract. HTTP success is not permission to execute a business action. Examples use illustrative identifiers and fixed times; replace them with values from your authenticated workflow. Response excerpts show selected fields; linked schemas define the full response. Use credentials, WebAuthn assertions, and proofs obtained through your own integration.