HTTP API reference

Assay's primary interface is the MCP endpoint (POST /mcp, see Tools) and the on-chain verify tool. A handful of plain HTTP endpoints round out the surface. These are API-only — they are consumed by agents, the public site, or download links, not by a dedicated dashboard — and are documented here so nothing exists invisibly.

Base URL: https://api.assayed.xyz.

GET /health

Liveness probe. Returns { ok, queueAge, ... } in well under 100 ms with zero model calls. Used by the process supervisor and the anchor-queue age alert. No auth.

GET /.well-known/assay.json

The agent discovery manifest — machine-readable service metadata (name, tools, prices, network, registry, endpoint). This is how an agent finds Assay's capabilities without reading the docs. No auth; safe to cache.

GET /x402 and GET /x402/:service/schema

The free input contract for the marketplace resources. /x402 lists every registered service; /x402/:service/schema returns one service's tool name, price, argument list (generated from the same zod schemas the server registers), server-bound defaults, and a runnable example payload. No payment, no auth — a buyer can learn exactly what to send before spending anything. The service segment accepts the canonical slug, a dashed variant, or the marketplace service name.

GET /d-api

The anonymized recent-seals feed that powers the landing page's live strip. Returns at most 8 rows, each carrying only a truncated dossier reference, seal status, standard version, and a coarse (day-resolution) timestamp. Never any personal data (guardrails #3/#9). Cached 60 s.

GET /d-api/:id

A public, PII-sanitized dossier summary by dossier id (DSR-…). Returns the standard version, creation time, artifact kinds, per-claim strength/status, tribunal pass flags, and — if sealed — the salted commitment, chain id, and seal status. It never returns prose, contact details, evidence text, or salts. Anyone can inspect a dossier's shape and grade; nobody can reconstruct its contents. No auth (the id is the capability, and the payload is already sanitized).

GET /p/:slug

The public portfolio page for a sealed dossier. asy_create_dossier_job returns a portfolio path (/p/<slug>) alongside the artifact set; the page is the rendered portfolio_page artifact — evidence-gated prose, tier chips, and a link to verify the seal. Returns 404 for an unknown or unshared slug.

GET /f/:id?tok=…

Signed file download. Every generated artifact (ATS PDF, designed résumé, DOCX, cover letter, …) is fetched here with a short-lived HMAC token (tok) minted by the Studio or the dossier-job result. A missing or expired token returns 403; an unknown id returns 404. The token is the credential — no accounts.

---

These endpoints are stable and safe to depend on. Payment-gated capability lives only behind POST /mcp and the POST /x402/:service routes (see x402); everything documented here is free to read. Note that a GET to /mcp returns the 402 challenge rather than a document — it is a registered marketplace endpoint and buyers probe it for one. Use /.well-known/assay.json for free discovery.