Developer referencev1 · previewCredentials on request
Build on the stack

Integrate the whole stack over an API. The engine stays sealed.

You call sealed products over standard, signed APIs — you never touch the internals. Genesis speaks S3, the AI speaks the OpenAI API, and a small signed REST surface covers the rest. If your team can call a URL, they can build on Validiti.

Program to it, not into it. Every capability is a sealed, signed binary that runs on your own hardware or your instance. Your code calls it over HTTP and reads a signed receipt back. There is nothing to import, no library of ours in your codebase, and no way to see how it works — only what it returns.

Authentication

Every request carries a bearer token issued with your access. Your base URLs ($VALIDITI_S3, $VALIDITI_AI, $VALIDITI_API) are provided in your access pack — on-prem or hosted.

Authorization: Bearer <YOUR_KEY>

Every answer is signed

Every response includes a receipt — a signed token binding the result to the exact records it was drawn from. You can verify it offline; nothing has to phone home. It is how you prove, later, that the answer was real and unchanged.

The three surfaces

Storage

S3-compatible

Genesis speaks the S3 API. Point any S3 client or SDK you already use at your endpoint — nothing new to learn. Objects are stored provable and byte-exact, and searchable without pulling them back.

PUT / GET / HEAD / DELETE/{bucket}/{key}

Standard S3 object operations (SigV4-signed). Use aws-cli, boto3, or any S3 SDK.

Example
aws --endpoint-url $VALIDITI_S3 s3 cp report.pdf s3://records/2026/report.pdf
aws --endpoint-url $VALIDITI_S3 s3 ls s3://records/2026/
POST/_validiti/search

Find objects by content, in place — no download, no rehydration.

Request
{ "query": "invoices over 50000 in Q2", "bucket": "records" }
Response
{ "matches": [ { "key": "2026/inv-8842.pdf", "score": 0.94 } ],
  "receipt": "vr-9f4b…" }
Example
curl -H "Authorization: Bearer $KEY" $VALIDITI_S3/_validiti/search \
  -d '{"query":"invoices over 50000 in Q2","bucket":"records"}'

AI

OpenAI-compatible + grounded

The answer engine speaks the OpenAI API, so anything you built against OpenAI works by changing one base URL. Or use the grounded endpoints, where every sentence is drawn only from your records and cites its source.

POST/v1/chat/completions

Drop-in OpenAI-compatible chat. Change the base URL; keep your code.

Request
{ "model": "validiti", "messages": [ { "role": "user", "content": "How is the NC book trending?" } ] }
Response
{ "choices": [ { "message": { "role": "assistant", "content": "…" } } ],
  "receipt": "vr-2a7c…" }
Example
curl $VALIDITI_AI/v1/chat/completions -H "Authorization: Bearer $KEY" \
  -d '{"model":"validiti","messages":[{"role":"user","content":"How is the NC book trending?"}]}'
POST/ask

Ask in plain English; get an answer drawn only from your records, with citations. Honest when there is no record.

Request
{ "query": "average margin in North Carolina this year" }
Response
{ "answer": "North Carolina averages 18.29% across 34 jobs.",
  "citations": [ { "record": "PRJ-100100", "field": "margin_pct" } ],
  "receipt": "vq-6d3c…" }
Example
curl $VALIDITI_AI/ask -H "Authorization: Bearer $KEY" \
  -d '{"query":"average margin in North Carolina this year"}'
POST/sense

Tell the system a record changed. It works out what it means and who should know — each at their own access level. The proactive layer.

Request
{ "record_id": "PRJ-110295", "field": "margin_pct", "new": -10.0 }
Response
{ "severity": "critical",
  "brief": "MassMutual · Lincolnton NC · margin -4% → -10%.",
  "notify": [ { "role": "account_owner", "note": "This job is now unprofitable — review." },
              { "role": "finance", "note": "Book impact immaterial; pattern flagged." } ],
  "receipt": "brf-6d3c…" }
Example
curl $VALIDITI_AI/sense -H "Authorization: Bearer $KEY" \
  -d '{"record_id":"PRJ-110295","field":"margin_pct","new":-10.0}'

Signed REST

compute · identity · screen

A small, uniform REST surface for the rest of the stack. Every response carries a signed receipt binding the result to the exact records it came from — verify it offline, no call-home.

POST/compute

Deterministic computation over your data (forecasts, drivers, levers). Same inputs → same signed result.

Request
{ "op": "outlook", "scope": { "state": "VT", "product": "PYL-30" } }
Response
{ "result": { "figure": 18.28, "band": [14.2, 22.3], "driver_pct": 18.0 },
  "receipt": "gf-5ac8…" }
Example
curl $VALIDITI_API/compute -H "Authorization: Bearer $KEY" \
  -d '{"op":"outlook","scope":{"state":"VT","product":"PYL-30"}}'
POST/verify

Confirm who or what an action or record claims to be — agent, human, or machine.

Request
{ "envelope": "…signed identity envelope…" }
Response
{ "valid": true, "subject": "agent:svc-ingest", "on_behalf_of": "acme", "receipt": "mk-1a94…" }
Example
curl $VALIDITI_API/verify -H "Authorization: Bearer $KEY" \
  -d @envelope.json
POST/intake

Screen anything before it reaches your data. Nothing acts until it is proven safe.

Request
{ "object": "…reference to an incoming file…" }
Response
{ "accepted": false, "reason": "unverified executable content", "receipt": "jn-7b2f…" }
Example
curl $VALIDITI_API/intake -H "Authorization: Bearer $KEY" \
  -d @incoming.json
GET/health

Liveness + what the instance is bound to.

Response
{ "status": "ok", "records": 22000, "integrity_ok": true }
Example
curl $VALIDITI_API/health -H "Authorization: Bearer $KEY"
Getting access. This is a preview reference. Live credentials, your base URLs, and the sealed on-prem binary are issued under a development agreement — contract is access. Request access and your team receives keys, endpoints, and a sandbox. Public self-serve keys are coming soon.
What you get and don't. You get the calling surface: endpoints, schemas, receipts, and examples — enough to build anything on top. You do not get, and never will, the engine source, the internal design, or an explanation of how any of it works. That is the point: the capability is yours to use; the mechanism stays ours to keep.

Validiti Developer Reference · v1 preview · interface only, engine sealed · request access for live credentials.