Developers / Agent interfaces

Build Veriom into the next decision.

One machine-readable contract connects typed REST clients, bounded agents, and OAuth-protected MCP integrations to the same evidence and authorization model.

Open the API contract Read the docs

Start from a contract

Give tools a precise surface, not a guessed one.

The public contract names each operation, input, response, scope, failure mode, and throttle signal so generated clients and function tools can behave predictably.

OpenAPI 3.1

Generate typed clients or function tools from more than 250 versioned operations with stable IDs and explicit schemas.

Open the contract

Authentication and scopes

Use customer sessions for the application or expiring workspace tokens with one of 25 least-privilege scopes.

Read the API guide

MCP gateway

Connect an OAuth-capable MCP client over Streamable HTTP while preserving tenant, evidence, and consent boundaries.

Inspect the tool manifest

Veriom CLI

Run contract checks, list least-privilege scopes, download OpenAPI, and make bounded /v1 requests from a terminal.

View the CLI source

Minimal REST flow

Inspect first. Ask for only what the operation needs.

Discover scopes before requesting a token, carry a request ID through logs, and let the server’s rate fields govern retry timing. The same flow is available through the source-distributed Veriom CLI.

READ WORKSPACESrepositories:read

curl https://api.veriom.ai/v1/workspaces \
  -H "Authorization: Bearer $VERIOM_API_TOKEN" \
  -H "Accept: application/json" \
  -H "X-Request-ID: agent-evaluation-001"

Runtime signals

Recovery information travels with every response.

Agents should never need to scrape an HTML error or guess when to retry. These conventions are also documented in the OpenAPI response headers and schemas.

Typed failures

Every API error uses application/problem+json with a stable code, recovery hint, and request ID.

Self-throttling

RateLimit-Policy and RateLimit describe live quota state; HTTP 429 also includes Retry-After.

CLI-ready

The official source package reads credentials only from the environment and understands scopes, structured failures, request IDs, and quota signals. Registry publication remains a release step.

Bring one bounded integration question.

Start with the zero-auth demo and public contract. Connect a production workspace only after the scope, evidence boundary, and human review path are clear.

Talk through your system