Reference

Public endpoints

Receipts, verification and the badge — the parts that need no key.

A handful of endpoints take no credential at all. They exist so that someone who does not have a Navige account — an auditor, a customer's security team, a regulator — can check a claim without taking our word for it or being given access to your console.

A receipt for one decision

GET/api/receipts/:actionId

Returns a signed, portable JSON object: the decision, the exact policy version that produced it, and a proof tying it to the batch it was anchored in.

It is verifiable offline. Fetch the signing key once and nothing after that requires trusting Navige's API — or Navige continuing to exist.

The signing key

GET/.well-known/navige-signing-key

The public half. Fetch it once, pin it, and verify receipts against it for as long as you like.

Verifying a batch

GET/api/blockchain/verify/:anchorId

GET/api/blockchain/verify/:anchorId/record/:actionId

Decisions are hashed into batches and anchored on-chain. The first endpoint checks a whole batch; the second proves one specific decision was in it, and was not altered afterwards.

What an anchor does and does not prove

It proves a record existed in the form you are holding, at the time the batch was anchored. It does not prove the decision was correct, and nothing on a chain ever could. The point is that neither we nor you can quietly rewrite history after the fact.

Organisation verification

GET/api/verified/:orgId

GET/api/badge/:orgId.svg

The first returns JSON describing what is actually true of an organisation's governance. The second is an SVG badge for a README or a trust page, which reads from the same source.

html

<img src="https://api.navige.ai/api/badge/YOUR_ORG_ID.svg"
     alt="Agent governance verified by Navige">

Health

GET /health — the process is up.
GET /ready — it can reach its dependencies and is willing to take traffic.

Point a load balancer at /ready and a liveness probe at /health. Using /health for both means traffic gets sent to an instance that is running and cannot serve it.