kredit

API reference

Base URL https://api.kredit.sh. One API; the console, the apps, the CLI and the MCP all call it.

Authentication

Create a key under API keys in the console and send it as a bearer token. A key acts as its owner. What needs a person (a new rule, a version, a deletion, a payment above the review line) is filed and waits for that person in the console or in the Fred app.

# every request
Authorization: Bearer kr_live_…
Content-Type: application/json

# base URL
https://api.kredit.sh

# errors: 4xx/5xx with { "detail": "…" }
# 401 missing or revoked key · 403 a person must do this · 404 not visible to this key · 422 validation

Organizations

GET /orgs

curl -X GET https://api.kredit.sh/orgs \
  -H "Authorization: Bearer $KREDIT_API_KEY"

POST /orgs

Body: OrgCreate
namestring required
descriptionstring
use_case"buyer" | "merchant" | "psp"
curl -X POST https://api.kredit.sh/orgs \
  -H "Authorization: Bearer $KREDIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "name": "procurement",
  "description": "…",
  "use_case": "buyer"
}'

GET /orgs/{org_id}

Parameters
org_idstring (path) required
curl -X GET https://api.kredit.sh/orgs/$ORG \
  -H "Authorization: Bearer $KREDIT_API_KEY"

PUT /orgs/{org_id}

Parameters
org_idstring (path) required
Body: OrgUpdate
namestring
descriptionstring
use_case"buyer" | "merchant" | "psp"
kybKyb
kycKycIn
settingsOrgSettings
curl -X PUT https://api.kredit.sh/orgs/$ORG \
  -H "Authorization: Bearer $KREDIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "name": "procurement",
  "description": "…",
  "use_case": "buyer",
  "kyb": {},
  "kyc": {},
  "settings": {}
}'

DELETE /orgs/{org_id}

Parameters
org_idstring (path) required
curl -X DELETE https://api.kredit.sh/orgs/$ORG \
  -H "Authorization: Bearer $KREDIT_API_KEY"

GET /orgs/{org_id}/summary

Parameters
org_idstring (path) required
curl -X GET https://api.kredit.sh/orgs/$ORG/summary \
  -H "Authorization: Bearer $KREDIT_API_KEY"

Rules

Rules live on three levels. Organization rules apply to every agent. An agent's rules and guardrails are its own and travel in its version, so a change over a key waits for a person. A wallet's rule is its budget and how it reloads.

GET /orgs/{org_id}/rules

Parameters
org_idstring (path) required
curl -X GET https://api.kredit.sh/orgs/$ORG/rules \
  -H "Authorization: Bearer $KREDIT_API_KEY"

POST /orgs/{org_id}/rules

A rule that governs every agent in the organization.

Parameters
org_idstring (path) required
Body: RuleIn
namestring
type"payment" | "api" | "tool"
providersstring[]
spendLimit
hit_rateRateLimit
allowedstring[]
blockedstring[]
enabledboolean
on_hit"deny" | "review"
direction"outgoing" | "incoming"
curl -X POST https://api.kredit.sh/orgs/$ORG/rules \
  -H "Authorization: Bearer $KREDIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "name": "",
  "type": "payment",
  "providers": [],
  "spend": {},
  "hit_rate": {},
  "allowed": []
}'

PUT /orgs/{org_id}/rules/{rule_id}

Parameters
org_idstring (path) required
rule_idstring (path) required
Body: RuleUpdate
namestring
type"payment" | "api" | "tool"
providersstring[]
spendLimit
hit_rateRateLimit
allowedstring[]
blockedstring[]
enabledboolean
on_hit"deny" | "review"
direction"outgoing" | "incoming"
curl -X PUT https://api.kredit.sh/orgs/$ORG/rules/$RULE \
  -H "Authorization: Bearer $KREDIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "name": "procurement",
  "type": "payment",
  "providers": [],
  "spend": {},
  "hit_rate": {},
  "allowed": []
}'

DELETE /orgs/{org_id}/rules/{rule_id}

Parameters
org_idstring (path) required
rule_idstring (path) required
curl -X DELETE https://api.kredit.sh/orgs/$ORG/rules/$RULE \
  -H "Authorization: Bearer $KREDIT_API_KEY"

GET /agents/{agent_id}/rules

The agent's own rules and guardrails, from the version that holds them.

Parameters
agent_idstring (path) required
curl -X GET https://api.kredit.sh/agents/$AGENT/rules \
  -H "Authorization: Bearer $KREDIT_API_KEY"

POST /agents/{agent_id}/rules

A rule on this agent alone. Proposes a version with it added.

Parameters
agent_idstring (path) required
Body: RuleIn
namestring
type"payment" | "api" | "tool"
providersstring[]
spendLimit
hit_rateRateLimit
allowedstring[]
blockedstring[]
enabledboolean
on_hit"deny" | "review"
direction"outgoing" | "incoming"
curl -X POST https://api.kredit.sh/agents/$AGENT/rules \
  -H "Authorization: Bearer $KREDIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "name": "",
  "type": "payment",
  "providers": [],
  "spend": {},
  "hit_rate": {},
  "allowed": []
}'

PUT /agents/{agent_id}/rules/{rule_id}

Parameters
agent_idstring (path) required
rule_idstring (path) required
Body: RuleUpdate
namestring
type"payment" | "api" | "tool"
providersstring[]
spendLimit
hit_rateRateLimit
allowedstring[]
blockedstring[]
enabledboolean
on_hit"deny" | "review"
direction"outgoing" | "incoming"
curl -X PUT https://api.kredit.sh/agents/$AGENT/rules/$RULE \
  -H "Authorization: Bearer $KREDIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "name": "procurement",
  "type": "payment",
  "providers": [],
  "spend": {},
  "hit_rate": {},
  "allowed": []
}'

DELETE /agents/{agent_id}/rules/{rule_id}

Parameters
agent_idstring (path) required
rule_idstring (path) required
curl -X DELETE https://api.kredit.sh/agents/$AGENT/rules/$RULE \
  -H "Authorization: Bearer $KREDIT_API_KEY"

PUT /agents/{agent_id}/guardrails

The agent's ceilings and lists: fields left out keep their value.

Parameters
agent_idstring (path) required
Body: GuardrailsUpdate
max_per_actionnumber
no_max_per_actionboolean
require_review_abovenumber
no_require_review_aboveboolean
allowed_merchantsstring[]
blocked_merchantsstring[]
allowed_categoriesstring[]
on_hitobject
notestring
curl -X PUT https://api.kredit.sh/agents/$AGENT/guardrails \
  -H "Authorization: Bearer $KREDIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "max_per_action": 0,
  "no_max_per_action": false,
  "require_review_above": 0,
  "no_require_review_above": false,
  "allowed_merchants": [],
  "blocked_merchants": []
}'

GET /orgs/{org_id}/wallets/rules

Parameters
org_idstring (path) required
curl -X GET https://api.kredit.sh/orgs/$ORG/wallets/rules \
  -H "Authorization: Bearer $KREDIT_API_KEY"

PUT /orgs/{org_id}/wallets/{kind}/{wallet_id}/rules

`kind` card with a card id, or wallet with a provider. A person sets it.

Parameters
org_idstring (path) required
kind"card" | "wallet" (path) required
wallet_idstring (path) required
Body: WalletRuleUpdate
budgetnumber
no_budgetboolean
reloadReload
no_reloadboolean
curl -X PUT https://api.kredit.sh/orgs/$ORG/wallets/$KIND/$WALLET/rules \
  -H "Authorization: Bearer $KREDIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "budget": 0,
  "no_budget": false,
  "reload": {},
  "no_reload": false
}'

Agents

GET /orgs/{org_id}/agents

Parameters
org_idstring (path) required
curl -X GET https://api.kredit.sh/orgs/$ORG/agents \
  -H "Authorization: Bearer $KREDIT_API_KEY"

POST /orgs/{org_id}/agents

Parameters
org_idstring (path) required
Body: AgentCreate
namestring required
descriptionstring
promptstring required
toolsToolIn[]
rulesRuleIn[]
guardrailsGuardrailsPer-action ceilings and merchant lists. Spend over time is a rule with a window (see RuleIn.spend), per agent or per organization.
curl -X POST https://api.kredit.sh/orgs/$ORG/agents \
  -H "Authorization: Bearer $KREDIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "name": "procurement",
  "prompt": "Buys office hardware from approved vendors.",
  "description": "…",
  "tools": [],
  "rules": [],
  "guardrails": {}
}'

GET /agents/{agent_id}

Parameters
agent_idstring (path) required
curl -X GET https://api.kredit.sh/agents/$AGENT \
  -H "Authorization: Bearer $KREDIT_API_KEY"

PUT /agents/{agent_id}

Parameters
agent_idstring (path) required
Body: AgentUpdate
namestring
descriptionstring
status"active" | "frozen"
wallet_idstring
curl -X PUT https://api.kredit.sh/agents/$AGENT \
  -H "Authorization: Bearer $KREDIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "name": "procurement",
  "description": "…",
  "status": "active",
  "wallet_id": "WALLET…"
}'

DELETE /agents/{agent_id}

Parameters
agent_idstring (path) required
curl -X DELETE https://api.kredit.sh/agents/$AGENT \
  -H "Authorization: Bearer $KREDIT_API_KEY"

POST /agents/{agent_id}/verify-identity

Parameters
agent_idstring (path) required
Body: VerifyIdentityBody
provider"kredit" | "skyfire" | "kite"
curl -X POST https://api.kredit.sh/agents/$AGENT/verify-identity \
  -H "Authorization: Bearer $KREDIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "provider": "kredit"
}'

POST /agents/{agent_id}/promote

Parameters
agent_idstring (path) required
Body: PromoteBody
environmentstring
curl -X POST https://api.kredit.sh/agents/$AGENT/promote \
  -H "Authorization: Bearer $KREDIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "environment": "production"
}'

GET /agents/{agent_id}/decisions

Parameters
agent_idstring (path) required
limitinteger (query)
beforestring (query)
curl -X GET https://api.kredit.sh/agents/$AGENT/decisions?limit=20&before=%E2%80%A6 \
  -H "Authorization: Bearer $KREDIT_API_KEY"

GET /agents/{agent_id}/passport

Parameters
agent_idstring (path) required
curl -X GET https://api.kredit.sh/agents/$AGENT/passport \
  -H "Authorization: Bearer $KREDIT_API_KEY"

POST /agents/{agent_id}/passport/present

A passport for the agent to hand to whoever it is paying: it proves who the agent is and what it was sent to do, and it cannot ask for anything. Returned once, good for a few minutes. The other side sends it on /check as actor.credential {type: "kredit", token}.

Parameters
agent_idstring (path) required
Body: PassportPresent
payeestring
max_amountnumber
curl -X POST https://api.kredit.sh/agents/$AGENT/passport/present \
  -H "Authorization: Bearer $KREDIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "payee": "…",
  "max_amount": 0
}'

Agent versions

An agent's prompt, tools, rules and guardrails are a version. A proposed version waits until a person approves it; approval activates it in one environment.

POST /agents/{agent_id}/versions

Parameters
agent_idstring (path) required
Body: VersionCreate
promptstring
toolsToolIn[]
rulesRuleIn[]
guardrailsGuardrails
notestring
curl -X POST https://api.kredit.sh/agents/$AGENT/versions \
  -H "Authorization: Bearer $KREDIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "prompt": "Buys office hardware from approved vendors.",
  "tools": [],
  "rules": [],
  "guardrails": {},
  "note": "lunch"
}'

POST /agents/{agent_id}/versions/{vid}/approve

Parameters
agent_idstring (path) required
vidstring (path) required
Body: ApproveBody
environment"sandbox" | "production"
curl -X POST https://api.kredit.sh/agents/$AGENT/versions/$VID/approve \
  -H "Authorization: Bearer $KREDIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "environment": "sandbox"
}'

POST /agents/{agent_id}/versions/{vid}/reject

Parameters
agent_idstring (path) required
vidstring (path) required
Body: RejectBody
notestring
curl -X POST https://api.kredit.sh/agents/$AGENT/versions/$VID/reject \
  -H "Authorization: Bearer $KREDIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "note": "lunch"
}'

Agent tokens

A token lets the agent itself call POST /check for its own intents. It is shown once and expires.

POST /agents/{agent_id}/tokens

A short-lived token the agent presents on /check. Returned once. From the console it takes a passkey; an API key may issue one; an agent may rotate its own while the current token is still live. Expired tokens cannot renew.

Parameters
agent_idstring (path) required
Body: AgentTokenIssue
ttl_minutesinteger
curl -X POST https://api.kredit.sh/agents/$AGENT/tokens \
  -H "Authorization: Bearer $KREDIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "ttl_minutes": 60
}'

GET /agents/{agent_id}/tokens

Parameters
agent_idstring (path) required
curl -X GET https://api.kredit.sh/agents/$AGENT/tokens \
  -H "Authorization: Bearer $KREDIT_API_KEY"

DELETE /agents/{agent_id}/tokens/{token_id}

Parameters
agent_idstring (path) required
token_idstring (path) required
curl -X DELETE https://api.kredit.sh/agents/$AGENT/tokens/$TOKEN \
  -H "Authorization: Bearer $KREDIT_API_KEY"

Check

POST /check

One question, two directions. With `agent_id`, your own agent asks whether it may act. With `actor`, someone else's agent (or anything at all) is at your door: send whatever you can observe and it is recorded against that actor and judged. The answer carries the signed x403 decision in its `x403.object` and in the X403-Decision header; `codes` are the reason codes.

Body: CheckRequest
org_idstring
agent_idstring
actorActorIn
environment"sandbox" | "production"
intentstring required
actionstring
amountnumber
currencystring
merchantMerchant
counterpartystring
payment_rail"card" | "usdc" | "skyfire" | "kite" | "ach" | "wire" | "crypto"
metadataobject
sessionSession
source"platform" | "api" | "mcp" | "store" | "simulation" | "seed" | "agent"
mode"inline" | "preflight" | "shadow"
budget_msinteger
on_timeout"denied" | "escalated"
evidenceEvidence[]
mandateMandate
declaredDeclared
noncestring
idempotency_keystring
curl -X POST https://api.kredit.sh/check \
  -H "Authorization: Bearer $KREDIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "intent": "buy 12 monitors at monitordepot.com for $4,188 by card",
  "agent_id": "AGENT…",
  "actor": {},
  "environment": "sandbox",
  "action": "…",
  "amount": 42.5
}'

Decisions

GET /orgs/{org_id}/decisions

Parameters
org_idstring (path) required
agent_idstring (query)
actor_idstring (query)
directionstring (query)
outcomestring (query)
environmentstring (query)
limitinteger (query)
beforestring (query)
curl -X GET https://api.kredit.sh/orgs/$ORG/decisions?agent_id=AGENT%E2%80%A6&actor_id=ACTOR%E2%80%A6&direction=%E2%80%A6&outcome=%E2%80%A6 \
  -H "Authorization: Bearer $KREDIT_API_KEY"

GET /decisions/{decision_id}

Parameters
decision_idstring (path) required
curl -X GET https://api.kredit.sh/decisions/$DECISION \
  -H "Authorization: Bearer $KREDIT_API_KEY"

POST /decisions/{decision_id}/review

Parameters
decision_idstring (path) required
Body: ReviewBody
approveboolean required
notestring
curl -X POST https://api.kredit.sh/decisions/$DECISION/review \
  -H "Authorization: Bearer $KREDIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "approve": true,
  "note": "lunch"
}'

POST /decisions/{decision_id}/execute

Parameters
decision_idstring (path) required
curl -X POST https://api.kredit.sh/decisions/$DECISION/execute \
  -H "Authorization: Bearer $KREDIT_API_KEY"

GET /orgs/{org_id}/reviews

Parameters
org_idstring (path) required
curl -X GET https://api.kredit.sh/orgs/$ORG/reviews \
  -H "Authorization: Bearer $KREDIT_API_KEY"

x403

The protocol: a signed risk decision before money moves. The query in the protocol's own shape, the decision anyone can verify against the published keys, receipts and outcomes that close the loop. The documents under /.well-known/x403 and the reason codes need no key. Read the protocol at /x403.

POST /x403/decide

A risk query in the protocol's shape. Answers with the signed decision; the status is 200 unless `bind=true`, in which case it is the decision's own.

Parameters
bindboolean (query)answer with the mapped status, not 200
Body: RiskQuery
schemestring
versionstring
policy_idstring
direction"inbound" | "outbound" required
mode"inline" | "preflight" | "shadow"
paymentPayment required
actorActor
intentIntent
evidenceEvidence[]
challengeChallenge
budget_msinteger
on_timeout"denied" | "escalated"
requesterRequester
requester_sigstring
decision_refstring
org_idstring
agent_idstring
environment"sandbox" | "production"
curl -X POST https://api.kredit.sh/x403/decide \
  -H "Authorization: Bearer $KREDIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "direction": "inbound",
  "payment": {
    "amount": "…",
    "executor": {
      "id": "ID…"
    }
  },
  "scheme": "x403",
  "version": "0.2",
  "policy_id": "POLICY…",
  "mode": "inline"
}'

POST /x403/preflight

Decide now, pay later citing the id. The same query with mode preflight.

Body: RiskQuery
schemestring
versionstring
policy_idstring
direction"inbound" | "outbound" required
mode"inline" | "preflight" | "shadow"
paymentPayment required
actorActor
intentIntent
evidenceEvidence[]
challengeChallenge
budget_msinteger
on_timeout"denied" | "escalated"
requesterRequester
requester_sigstring
decision_refstring
org_idstring
agent_idstring
environment"sandbox" | "production"
curl -X POST https://api.kredit.sh/x403/preflight \
  -H "Authorization: Bearer $KREDIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "direction": "inbound",
  "payment": {
    "amount": "…",
    "executor": {
      "id": "ID…"
    }
  },
  "scheme": "x403",
  "version": "0.2",
  "policy_id": "POLICY…",
  "mode": "inline"
}'

GET /x403/decisions/{decision_id}

Parameters
decision_idstring (path) required
format"json" | "jws" (query)
curl -X GET https://api.kredit.sh/x403/decisions/$DECISION?format=%5Bobject+Object%5D \
  -H "Authorization: Bearer $KREDIT_API_KEY"

POST /x403/receipts

The executor's countersignature on a decision it acted on. Marks the decision consumed; a second receipt for the same decision is a conflict. A receipt that carries a local decision files the executor's own timeout decision instead.

Body: ReceiptIn
decision_refstring required
decision_hashstring required
executedboolean required
executed_atstring
executionobject
executorExecutor required
executor_sigstring
local_decisionobjectthe signed local decision (section 4.6) this receipt files
org_idstringwhich organization files a local decision; the only one when omitted
curl -X POST https://api.kredit.sh/x403/receipts \
  -H "Authorization: Bearer $KREDIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "decision_ref": "…",
  "decision_hash": "…",
  "executed": true,
  "executor": {},
  "executed_at": "…",
  "execution": {}
}'

POST /x403/outcomes

What happened after the money moved: settled, delivered, disputed, chargeback, refund, reversal, fraud confirmed, false positive.

Body: OutcomeIn
decision_refstring required
decision_hashstringthe decision as signed, so the report cannot be moved to another decision
authority_idstring
outcome"settled" | "delivered" | "disputed" | "chargeback" | "refund" | "reversal" | "fraud_confirmed" | "false_positive" required
category"attack" | "accident" | "control_failure" | "commercial_dispute" | "none"
reported_via"executor" | "requester" | "issuer" | "network" | "facilitator" | "psp" | "authority"
atstring
amountstring
currencystring
reason_codestring
notestring
reporterobject
sigstring
curl -X POST https://api.kredit.sh/x403/outcomes \
  -H "Authorization: Bearer $KREDIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "decision_ref": "…",
  "outcome": "settled",
  "decision_hash": "…",
  "authority_id": "AUTHORITY…",
  "category": "attack",
  "reported_via": "executor"
}'

POST /x403/decisions/{decision_id}/revoke

Withdraw a decision before it is executed: it lands on the revoked list.

Parameters
decision_idstring (path) required
curl -X POST https://api.kredit.sh/x403/decisions/$DECISION/revoke \
  -H "Authorization: Bearer $KREDIT_API_KEY"

GET /x403/decisions/{decision_id}/receipts

Parameters
decision_idstring (path) required
curl -X GET https://api.kredit.sh/x403/decisions/$DECISION/receipts \
  -H "Authorization: Bearer $KREDIT_API_KEY"

GET /x403/decisions/{decision_id}/outcomes

Parameters
decision_idstring (path) required
curl -X GET https://api.kredit.sh/x403/decisions/$DECISION/outcomes \
  -H "Authorization: Bearer $KREDIT_API_KEY"

GET /x403/reason-codes

curl -X GET https://api.kredit.sh/x403/reason-codes \
  -H "Authorization: Bearer $KREDIT_API_KEY"

GET /.well-known/x403/authority.json

curl -X GET https://api.kredit.sh/.well-known/x403/authority.json \
  -H "Authorization: Bearer $KREDIT_API_KEY"

GET /.well-known/x403/jwks.json

curl -X GET https://api.kredit.sh/.well-known/x403/jwks.json \
  -H "Authorization: Bearer $KREDIT_API_KEY"

GET /.well-known/x403/policy/{policy_id}.json

`<org>/inbound` or `<org>/<agent>/<environment>`: what to bring, no weights.

Parameters
policy_idstring (path) required
curl -X GET https://api.kredit.sh/.well-known/x403/policy/$POLICY.json \
  -H "Authorization: Bearer $KREDIT_API_KEY"

GET /.well-known/x403/revoked.json

curl -X GET https://api.kredit.sh/.well-known/x403/revoked.json \
  -H "Authorization: Bearer $KREDIT_API_KEY"

Approvals

Changes made over a key or the MCP that need a person: a new rule, a version, a deletion.

GET /orgs/{org_id}/approvals

Parameters
org_idstring (path) required
statusstring (query)
curl -X GET https://api.kredit.sh/orgs/$ORG/approvals?status=%E2%80%A6 \
  -H "Authorization: Bearer $KREDIT_API_KEY"

POST /approvals/{approval_id}/approve

Make the change. Takes a passkey used moments ago.

Parameters
approval_idstring (path) required
curl -X POST https://api.kredit.sh/approvals/$APPROVAL/approve \
  -H "Authorization: Bearer $KREDIT_API_KEY"

POST /approvals/{approval_id}/reject

Parameters
approval_idstring (path) required
Body: RejectApproval
notestring
curl -X POST https://api.kredit.sh/approvals/$APPROVAL/reject \
  -H "Authorization: Bearer $KREDIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "note": "lunch"
}'

Pay and ask

GET /orgs/{org_id}/fredpay

Your handle, the wallet you receive with, what you earned and sent, and your contacts.

Parameters
org_idstring (path) required
curl -X GET https://api.kredit.sh/orgs/$ORG/fredpay \
  -H "Authorization: Bearer $KREDIT_API_KEY"

GET /fredpay/resolve

Whether a @handle or an email is on kredit: a name and a handle, nothing else.

Parameters
qstring (query) required
curl -X GET https://api.kredit.sh/fredpay/resolve?q=monitor \
  -H "Authorization: Bearer $KREDIT_API_KEY"

POST /orgs/{org_id}/fredpay/contacts

Parameters
org_idstring (path) required
Body: FredPayContact
namestring
emailstring
phonestring
handlestring
curl -X POST https://api.kredit.sh/orgs/$ORG/fredpay/contacts \
  -H "Authorization: Bearer $KREDIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "name": "",
  "email": "jo@northwind.co",
  "phone": "…",
  "handle": "…"
}'

DELETE /orgs/{org_id}/fredpay/contacts/{contact_id}

Parameters
org_idstring (path) required
contact_idstring (path) required
curl -X DELETE https://api.kredit.sh/orgs/$ORG/fredpay/contacts/$CONTACT \
  -H "Authorization: Bearer $KREDIT_API_KEY"

PUT /orgs/{org_id}/fredpay/wallet

The wallet payments to you land in. A person, with a passkey used moments ago.

Parameters
org_idstring (path) required
Body: WalletDefault
kind"card" | "stablecoin" | "rail" required
idstring required
curl -X PUT https://api.kredit.sh/orgs/$ORG/fredpay/wallet \
  -H "Authorization: Bearer $KREDIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "kind": "card",
  "id": "ID…"
}'

POST /orgs/{org_id}/fredpay/pay

Pay someone: a contact, a @handle or an email, from a wallet. Checked like every payment; held for the owner's Face ID above their review line.

Parameters
org_idstring (path) required
Body: FredPayPay
contact_idstring
tostring
amountnumber required
notestring
walletWalletDefault
repeat"once" | "week" | "month" | "year"
curl -X POST https://api.kredit.sh/orgs/$ORG/fredpay/pay \
  -H "Authorization: Bearer $KREDIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "amount": 42.5,
  "contact_id": "CONTACT…",
  "to": "@northwind-co",
  "note": "lunch",
  "wallet": {
    "kind": "card",
    "id": "ID…"
  },
  "repeat": "once"
}'

POST /orgs/{org_id}/fredpay/ask

Ask someone for money.

Parameters
org_idstring (path) required
Body: FredPayAsk
contact_idstring
tostring
amountnumber required
notestring
repeat"once" | "week" | "month" | "year"
curl -X POST https://api.kredit.sh/orgs/$ORG/fredpay/ask \
  -H "Authorization: Bearer $KREDIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "amount": 42.5,
  "contact_id": "CONTACT…",
  "to": "@northwind-co",
  "note": "lunch",
  "repeat": "once"
}'

POST /orgs/{org_id}/fredpay/asks/{ask_id}/pay

Pay what someone asked; checked and held like any payment.

Parameters
org_idstring (path) required
ask_idstring (path) required
Body: FredPayAskPay
walletWalletDefault
curl -X POST https://api.kredit.sh/orgs/$ORG/fredpay/asks/$ASK/pay \
  -H "Authorization: Bearer $KREDIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "wallet": {
    "kind": "card",
    "id": "ID…"
  }
}'

POST /orgs/{org_id}/fredpay/asks/{ask_id}/decline

Parameters
org_idstring (path) required
ask_idstring (path) required
curl -X POST https://api.kredit.sh/orgs/$ORG/fredpay/asks/$ASK/decline \
  -H "Authorization: Bearer $KREDIT_API_KEY"

DELETE /orgs/{org_id}/fredpay/asks/{ask_id}

Take back an ask of yours.

Parameters
org_idstring (path) required
ask_idstring (path) required
curl -X DELETE https://api.kredit.sh/orgs/$ORG/fredpay/asks/$ASK \
  -H "Authorization: Bearer $KREDIT_API_KEY"

DELETE /orgs/{org_id}/fredpay/repeats/{schedule_id}

Stop paying or asking again.

Parameters
org_idstring (path) required
schedule_idstring (path) required
curl -X DELETE https://api.kredit.sh/orgs/$ORG/fredpay/repeats/$SCHEDULE \
  -H "Authorization: Bearer $KREDIT_API_KEY"

Cards

GET /orgs/{org_id}/vault/cards

Parameters
org_idstring (path) required
curl -X GET https://api.kredit.sh/orgs/$ORG/vault/cards \
  -H "Authorization: Bearer $KREDIT_API_KEY"

POST /orgs/{org_id}/vault/cards

Parameters
org_idstring (path) required
Body: VaultCardIn
numberstring
exp_monthinteger | string
exp_yearinteger | string
holderstring
labelstring
budgetnumber | string
curl -X POST https://api.kredit.sh/orgs/$ORG/vault/cards \
  -H "Authorization: Bearer $KREDIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "number": "",
  "exp_month": 0,
  "exp_year": 0,
  "holder": "…",
  "label": "…",
  "budget": 0
}'

PUT /vault/cards/{card_id}

Parameters
card_idstring (path) required
Body: VaultCardUpdate
labelstring
numberstring
exp_monthinteger
exp_yearinteger
holderstring
budgetnumber
no_budgetboolean
reloadReload
no_reloadboolean
curl -X PUT https://api.kredit.sh/vault/cards/$CARD \
  -H "Authorization: Bearer $KREDIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "label": "…",
  "number": "…",
  "exp_month": 0,
  "exp_year": 0,
  "holder": "…",
  "budget": 0
}'

POST /vault/cards/{card_id}/default

Parameters
card_idstring (path) required
curl -X POST https://api.kredit.sh/vault/cards/$CARD/default \
  -H "Authorization: Bearer $KREDIT_API_KEY"

DELETE /vault/cards/{card_id}

Parameters
card_idstring (path) required
curl -X DELETE https://api.kredit.sh/vault/cards/$CARD \
  -H "Authorization: Bearer $KREDIT_API_KEY"

Integrations

GET /orgs/{org_id}/integrations

Parameters
org_idstring (path) required
curl -X GET https://api.kredit.sh/orgs/$ORG/integrations \
  -H "Authorization: Bearer $KREDIT_API_KEY"

PUT /orgs/{org_id}/integrations/{provider}

Parameters
org_idstring (path) required
providerstring (path) required
Body: IntegrationUpdate
keysobject
enabledboolean
mode"simulated" | "sandbox" | "live"
budgetnumber
no_budgetboolean
reloadReload
no_reloadboolean
curl -X PUT https://api.kredit.sh/orgs/$ORG/integrations/$PROVIDER \
  -H "Authorization: Bearer $KREDIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "keys": {},
  "enabled": true,
  "mode": "simulated",
  "budget": 0,
  "no_budget": false,
  "reload": {}
}'

POST /orgs/{org_id}/integrations/{provider}/test

Parameters
org_idstring (path) required
providerstring (path) required
curl -X POST https://api.kredit.sh/orgs/$ORG/integrations/$PROVIDER/test \
  -H "Authorization: Bearer $KREDIT_API_KEY"

Documents

GET /orgs/{org_id}/documents

Parameters
org_idstring (path) required
curl -X GET https://api.kredit.sh/orgs/$ORG/documents \
  -H "Authorization: Bearer $KREDIT_API_KEY"

POST /orgs/{org_id}/documents

Parameters
org_idstring (path) required
curl -X POST https://api.kredit.sh/orgs/$ORG/documents \
  -H "Authorization: Bearer $KREDIT_API_KEY"

DELETE /documents/{doc_id}

Parameters
doc_idstring (path) required
curl -X DELETE https://api.kredit.sh/documents/$DOC \
  -H "Authorization: Bearer $KREDIT_API_KEY"

Orders

GET /orgs/{org_id}/orders

Parameters
org_idstring (path) required
limitinteger (query)
curl -X GET https://api.kredit.sh/orgs/$ORG/orders?limit=20 \
  -H "Authorization: Bearer $KREDIT_API_KEY"

The decision

POST /check and every decision endpoint return this object. outcome is allow, review or deny. checks are the four questions (identity, mandate, payee, behavior), each the worst of its layers: pass, warn or fail. A failing layer denies; a warning layer escalates to a person; score runs 0 to 100. review fills in when a person decides; execution fills in when the action runs.

{
  "id": "6aa9c9b21f4cc27614259db6",
  "org_id": "6a9e5043480a787fa94b77df",
  "agent_id": "6a9e5043480a787fa94b77ff",
  "agent_name": "procurement",
  "agent_version_id": "6a9e5043480a787fa94b77fe",
  "direction": "outgoing",
  "environment": "sandbox",
  "source": "api",
  "outcome": "review",
  "score": 85,
  "reason": "above the $2,500 review threshold, a person decides",
  "intent": {
    "action": "payment.card",
    "description": "buy 12 monitors at monitordepot.com for $4,188 by card",
    "amount": 4188,
    "currency": "USD",
    "merchant": { "name": "Monitor Depot", "domain": "monitordepot.com", "category": "hardware" },
    "counterparty": null,
    "payment_rail": "card",
    "metadata": null
  },
  "checks": [
    { "key": "identity", "label": "Identity", "status": "pass", "ok": true, "value": "verified", "layers": ["agent_identity", "business_identity"] },
    { "key": "mandate",  "label": "Mandate",  "status": "warn", "ok": false, "value": "above the $2,500 review threshold, a person decides", "layers": ["guardrails", "scope"] },
    { "key": "payee",    "label": "Payee",    "status": "pass", "ok": true, "value": "known and clear", "layers": ["compliance", "disputes"] },
    { "key": "behavior", "label": "Behavior", "status": "pass", "ok": true, "value": "in line with its history", "layers": ["intent", "financial", "fraud"] }
  ],
  "layers": [
    { "key": "agent_identity", "name": "Agent identity", "status": "pass", "detail": "KYA verified via kredit", "ms": 0.006, "provider": "kredit" },
    { "key": "business_identity", "name": "Business identity", "status": "pass", "detail": "KYB verified via kredit", "ms": 0.003, "provider": "kredit" },
    { "key": "intent", "name": "Intent risk analysis", "status": "pass", "detail": "intent consistent with the agent's brief", "ms": 0.015, "provider": "kredit" },
    { "key": "compliance", "name": "Compliance", "status": "pass", "detail": "no sanctions match across 1 list(s)", "ms": 0.016, "provider": "kredit" },
    { "key": "guardrails", "name": "Guardrails & policies", "status": "warn", "detail": "above the $2,500 review threshold, a person decides", "ms": 0.086, "provider": "kredit" },
    { "key": "scope", "name": "Scope & permissions", "status": "pass", "detail": "payment.card covered by tool payments", "ms": 0.006, "provider": "kredit" },
    { "key": "financial", "name": "Financial risk", "status": "pass", "detail": "in line with its history", "ms": 0.003, "provider": "kredit" },
    { "key": "fraud", "name": "Fraud", "status": "pass", "detail": "no fraud signals", "ms": 0.027, "provider": "kredit" },
    { "key": "disputes", "name": "Disputes & recovery", "status": "pass", "detail": "merchant dispute rate 0.6%", "ms": 0.008, "provider": "kredit" }
  ],
  "latency_ms": 0.97,
  "created_at": "2026-10-01T18:07:34.614271+00:00",
  "review": { "status": "pending", "by": null, "at": null, "note": null },
  "execution": null
}