Integration Guide

1. Setup

# Set your API key
export API_KEY="your-api-key-here"
export BASE_URL="https://halm-mvp.abacusai.app"

2. Authorize

Submit a proposal for policy evaluation. Returns ALLOW, DENY, or HELD_FOR_VETO.

# Submit a proposal for policy evaluation
curl -X POST $BASE_URL/api/authorize \
  -H "Content-Type: application/json" \
  -H "X-API-Key: $API_KEY" \
  -d '{
    "proposalId": "prop-001",
    "action": "data:write",
    "resource": "users",
    "context": { "agentId": "agent-1" }
  }'

# Response:
# { "status": "ALLOW", "allowed": true, "rule": "default-allow", ... }

3. Execute

Execute an authorized action. Idempotent: duplicate calls return 409.

# Execute the authorized action (idempotent)
curl -X POST $BASE_URL/api/execute \
  -H "Content-Type: application/json" \
  -H "X-API-Key: $API_KEY" \
  -d '{ "proposalId": "prop-001", "payload": {} }'

# Response:
# { "success": true, "executedAt": "2026-02-25T12:00:00Z", ... }

4. Verify & Webhooks

Get proof packets for auditors. Verify webhook signatures with HMAC-SHA256.

# Get integrity proof for auditors
curl "$BASE_URL/api/proof/packet?proposalId=prop-001" \
  -H "X-API-Key: $API_KEY"

# Response includes:
# - Decision hash + execution hash
# - Merkle proof + anchor reference
# - Config snapshot + replay grade