Zero to first gate call
in under 10 minutes.

Three steps. No magic.

Every gate call follows the same path. Your agent sends a request. The gate enforces sequence. You get a receipt or a halt.

One header. Every request.

All requests to the wrapper require the Authorization: Bearer header. The demo key is public and rate-limited — use it to test without signing up.

Wrapper, Gate, and Report

AgenticRail deploys three public services:

Demo key DEMO-AGENTICRAIL-PUBLIC-2026 works with all three services. Wrapper prefixes demo sequence IDs with demo- and isolates receipts.

Fields, one by one.

All requests are Content-Type: application/json via POST. Fields are validated in order — a missing required field halts at gate step 1.

Timestamp freshness: The gate enforces a ±300 second window around the current time. If your request arrives more than 5 minutes early or late, it will be rejected with reason STALE_TIMESTAMP. Always generate ts_ms fresh using Date.now() or equivalent.

Copy. Paste. Run.

This example works against the live wrapper right now. Each snippet generates a fresh timestamp, a unique nonce, and a unique sequence ID on every run, so it returns ALLOW the moment you paste it.

# Paste the whole block. Fresh timestamp, unique nonce + sequence id - runs every time.
TS=$(( $(date +%s) * 1000 ))
NONCE=$(openssl rand -hex 8)
SEQ="my-seq-$(date +%s)"

curl -X POST https://api.agenticrail.nz/v1/evaluate \
  -H 'Content-Type: application/json' \
  -H 'Authorization: Bearer DEMO-AGENTICRAIL-PUBLIC-2026' \
  -d "{
    \"schema_version\": \"1.0\",
    \"model_id\":       \"my-agent\",
    \"sequence_id\":    \"$SEQ\",
    \"step\":           \"verify_identity\",
    \"function\":       \"verify_identity\",
    \"action_type\":    \"CHECK_STATE\",
    \"action\":         \"verify identity\",
    \"nonce\":          \"$NONCE\",
    \"ts_ms\":          $TS,
    \"inputs\":         {},
    \"step_order\":     [\"verify_identity\", \"assess_risk\", \"execute_transfer\", \"audit_ledger\"]
  }"

# Paste the whole block into PowerShell
$ts    = [DateTimeOffset]::UtcNow.ToUnixTimeMilliseconds()
$nonce = -join ((1..16) | ForEach-Object { '0123456789abcdef'[(Get-Random -Maximum 16)] })
$seq   = "my-seq-$ts"
$body = '{"schema_version":"1.0","model_id":"my-agent","sequence_id":"' + $seq + '","step":"verify_identity","function":"verify_identity","action_type":"CHECK_STATE","action":"verify identity","nonce":"' + $nonce + '","ts_ms":' + $ts + ',"inputs":{},"step_order":["verify_identity","assess_risk","execute_transfer","audit_ledger"]}'
$headers = @{ "Content-Type" = "application/json"; "Authorization" = "Bearer DEMO-AGENTICRAIL-PUBLIC-2026" }
(Invoke-WebRequest -UseBasicParsing -Uri https://api.agenticrail.nz/v1/evaluate -Method POST -Headers $headers -Body $body).Content

ts_ms is a required field — the current Unix time in milliseconds, within 300 seconds of server time. The snippets generate it for you. Note: date +%s%3N is GNU-only; the cross-platform form $(( $(date +%s) * 1000 )) works on macOS and Linux.

// One gate call — adapt into your agent loop
const res = await fetch('https://api.agenticrail.nz/v1/evaluate', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Authorization':    'Bearer DEMO-AGENTICRAIL-PUBLIC-2026',
  },
  body: JSON.stringify({
    schema_version: '1.0',
    model_id:       'my-agent',
    sequence_id:    'my-seq-' + Date.now(),
    step:           'verify_identity',
    function:       'verify_identity',
    action_type:    'CHECK_STATE',
    action:         'verify identity',
    nonce:          crypto.randomUUID().replace(/-/g, '').slice(0, 16),
    ts_ms:          Date.now(),
    inputs:         {},
    step_order:     ['verify_identity', 'assess_risk', 'execute_transfer', 'audit_ledger'],
  }),
});

const gate = await res.json();

if (gate.decision === 'ALLOW') {
  // Proceed with your step
} else {
  // Halt — do not proceed
  console.error('DENY:', gate.reasons);
}

No SDK is required. The gate is a plain HTTPS JSON call, exactly as above, so any language that can POST can use it. These packages wrap that call for convenience and ship the integrations below.

# Python — ships LangGraph and CrewAI integrations
pip install agenticrail

# JavaScript / TypeScript — dual ESM + CJS, works with LangGraph.js, Mastra, Genkit
npm install @agenticrail/core

Both are MIT-licensed and open source. Evaluate against the live gate with the public demo key above — no account, no signup. step_order is sent on every call; the gate reads it from each payload and does not store it.

ALLOW or DENY. Nothing in between.

The wrapper returns a flattened response with all decision details at the top level. There is no pack wrapper — the decision, reasons, and executed fields are directly in the response object. The nested receipt object carries the receipt metadata for that decision — key_id, signature_alg, payload_hash, and version.

{
  "decision": "ALLOW",
  "executed": true,
  "pack_id": "80fe6e6887ca024d2325260f83224c86c3d2157b10ef60cc73ee8fded4661552",
  "reasons": [],
  "sequence_id": "demo-test-seq-001",
  "step": "verify_identity",
  "function": "verify_identity",
  "action_type": "CHECK_STATE",
  "model_id": "client:demo",
  "result": {
    "status": "submitted",
    "data": {
      "state": null
    }
  },
  "receipt": {
    "pack_id": "80fe6e6887ca024d2325260f83224c86c3d2157b10ef60cc73ee8fded4661552",
    "key_id": "k2_2026-06-07_ed25519",
    "signature": null,
    "signature_alg": "Ed25519",
    "payload_hash": "201031e1bce583b179f7b9b8b9c794de2cd8514da84adae974232ed3f2ff0774",
    "prev_receipt_id": null,
    "ts_ms": 1780732058107,
    "version": "slp8_receipt_v2",
    "attestation": null
  },
  "log": {
    "ok": true,
    "error": null
  }
}

{
  "decision": "DENY",
  "executed": false,
  "pack_id": "1493ba42f5e0ffb81227e700eda1e03e762058fd9da4080f320c432b6fa23c2f",
  "reasons": ["SEQUENCE_VIOLATION"],
  "sequence_id": "demo-replay-test-seq",
  "step": "execute_transfer",
  "function": "execute_transfer",
  "action_type": "CHECK_STATE",
  "model_id": "client:demo",
  "result": {
    "status": "skipped",
    "message": "No execution triggered"
  },
  "receipt": {
    "pack_id": "1493ba42f5e0ffb81227e700eda1e03e762058fd9da4080f320c432b6fa23c2f",
    "key_id": "k2_2026-06-07_ed25519",
    "signature": null,
    "signature_alg": "Ed25519",
    "payload_hash": "9f2c1a77b4e83d0516a8c4f9e2b7d3061c5a8e94f0b2d6713a9e4c8051f7b2d4",
    "prev_receipt_id": "80fe6e6887ca024d2325260f83224c86c3d2157b10ef60cc73ee8fded4661552",
    "ts_ms": 1780732061488,
    "version": "slp8_receipt_v2",
    "attestation": null
  },
  "log": {
    "ok": true,
    "error": null
  }
}

About the signature. The inline receipt carries the decision metadata and the payload_hash. The signature itself is finalized in the durable receipt written to storage — it is not echoed in the synchronous response, so the calling system cannot verify it at the moment of decision, only afterward. That's deliberate: the synchronous path stays lean, and every verification is forced through the one durable, tamper-evident record rather than trusting an ephemeral API response. To verify it, call report.agenticrail.nz — the compliance report includes each receipt's raw signature (base64) and its exact signed_canonical preimage, so you can run ed25519_verify(public_key, signed_canonical, signature) yourself, entirely offline, against the published key at /spec/receipt-public-keys.json — no callback to AgenticRail, no trust in our own verification claim required.

Every code above arrives as an entry in the reasons array of a DENY, and every DENY is written to a signed receipt. A request can also be refused before it reaches enforcement, in which case you get a HALT instead. Those are a different class, and they are listed next.

Refused at the door. No receipt.

HALT is not an enforcement decision. ALLOW and DENY are decisions: the gate evaluated your step against the sequence and reached a verdict, and either way a signed receipt is written before your action runs. HALT means the request was rejected at the boundary — malformed, oversized, unauthenticated, or matching a prompt-injection pattern — and never reached the enforcement engine at all.

A HALT produces no receipt. Nothing was decided, so there is nothing to sign or store. If you are reconciling receipts against calls, HALTed calls will have no corresponding receipt, and that is correct behaviour, not a gap.

A HALT is returned with a non-2xx HTTP status and carries status rather than decision:

{
  "status": "HALT",
  "halt_gate_step": 1,
  "reason_code": "SCHEMA_VIOLATION",
  "reason_detail": "REJECT_ROLE_DIRECTIVES"
}

reason_code is the bucket; reason_detail, when present, is the specific trigger.

Three rejections happen earlier still, at the public wrapper, and return a plain error field rather than a HALT envelope: invalid_api_key (401) when a real key prefix is presented with the wrong secret, invalid_json (400) when the body will not parse, and rate_limited (429) when you exceed your rate limit. Treat all of these the same way you treat a HALT: the call did not reach enforcement, and there is no receipt.

Sending no key is not one of them. An unrecognised credential — no header at all, a placeholder, or a key that was never issued — does not fail. The call runs on the public demo lane and the response says so, carrying lane, lane_reason and lane_notice. Only a recognised key presented wrongly is refused: a wrong secret returns 401, a revoked key returns 403. The trade is that a demo-lane sequence is prefixed demo- and its report can be read by anyone holding the sequence id, so nothing private belongs in attestation.

The rules the gate enforces.

These aren't soft guidelines. A violation on any one of them returns DENY immediately.

Embed evidence in the receipt.

Each step can carry an attestation object — arbitrary evidence that travels with the request and gets signed into the R2 receipt. Use it to prove what happened at each step: an AML check passed, a human approved the action, an external system returned a specific result.

The attestation is stored alongside the receipt and appears in every compliance report generated for that sequence. It's not a separate log entry — it's part of the cryptographic chain.

from agenticrail import RailClient
import time

client = RailClient(api_key="DEMO-AGENTICRAIL-PUBLIC-2026")
seq = client.sequence("payment-run-001", [
    "verify_identity", "assess_risk", "request_approval",
    "execute_transfer", "audit_ledger"
])

# Attach evidence at each step — signed into the receipt
seq.next("verify_identity", attestation={
    "kyc_provider": "acme-kyc",
    "result": "pass",
    "checked_at": int(time.time() * 1000),
})

seq.next("assess_risk", attestation={
    "risk_score": 23,
    "threshold": 50,
    "decision": "below_threshold",
})

seq.next("request_approval", attestation={
    "approved_by": "risk-committee-id-7f3a",
    "approval_ref": "APR-2026-00412",
})

seq.next("execute_transfer")   # attestation optional — omit if nothing to prove
seq.next("audit_ledger")       # seals sequence — all attestations locked in chain

import { RailClient } from "@agenticrail/core";

const client = new RailClient({ apiKey: "DEMO-AGENTICRAIL-PUBLIC-2026" });
const seq = client.sequence("payment-run-001", [
  "verify_identity", "assess_risk", "request_approval",
  "execute_transfer", "audit_ledger"
]);

// Attach evidence at each step — signed into the receipt
await seq.next("verify_identity", {
  attestation: { kyc_provider: "acme-kyc", result: "pass", checked_at: Date.now() }
});

await seq.next("assess_risk", {
  attestation: { risk_score: 23, threshold: 50, decision: "below_threshold" }
});

await seq.next("request_approval", {
  attestation: { approved_by: "risk-committee-id-7f3a", approval_ref: "APR-2026-00412" }
});

await seq.next("execute_transfer");  // attestation optional
await seq.next("audit_ledger");       // seals sequence — all attestations locked in chain

The attestation field accepts any plain JSON object. Values can include strings, numbers, and nested objects. Large binary blobs are not supported — store those in your own system and include a reference ID or hash here instead.

One command. Full provenance report.

The report worker reads every receipt for a sequence, verifies the cryptographic chain, and produces a human-readable compliance report. This is the deliverable your lawyer, auditor, or regulator asks for — proof of what ran, verified independently of what the agent claims.

Not a log export. Chain-verified receipt evidence, generated on demand for any sequence.

# Replace SEQUENCE_ID with your sequence (demo‑ prefix for demo key)
curl -X POST https://report.agenticrail.nz/report \
  -H 'Content-Type: application/json' \
  -H 'x-slp8-key: DEMO-AGENTICRAIL-PUBLIC-2026' \
  -d '{
    "sequence_id": "demo‑my‑seq‑001",
    "format": "html"
  }'

Reports are deterministic — the same sequence always yields identical output. Verification uses multi‑generation hash checking to handle Gen‑1 and Gen‑2 receipts.

What the receipt chain proves — and to whom.

Every gate call produces enforcement output (ALLOW/DENY). It also produces a compliance record — a signed, chained, tamper-evident receipt that answers the question regulators and lawyers actually ask: "Can you prove what the AI did?"

These are the same facts. Different audience, different frame.

Receipt field reference — what each field proves

Ready to go further?

The demo key is open for testing, and you can drive the gate in the browser first — skip a step, replay one, and watch it get refused before you write any code. When you're ready for production — dedicated rate limits, private key, support, and integration help — get in touch.

Wiring this up from code, or pointing an agent at it? The machine-readable API description is published as OpenAPI 3.1 at agenticrail.nz/openapi.json — every endpoint, the full payload contract, all eight denial codes and the response schemas. It is linked as service-desc from /.well-known/api-catalog, so a client that follows RFC 9727 discovery will find it without being told. Framework integrations: the Python SDK ships LangGraph and CrewAI adapters, the JavaScript SDK covers LangGraph.js, Mastra and Genkit, and MCP clients can call the gate as a tool at mcp.agenticrail.nz.

Working out whether this fits at all, rather than how to call it? The product overview sets out what AgenticRail is in one page: what it enforces, what a receipt contains, what it is used for — EU AI Act Article 12 record-keeping, provable human oversight and sign-off, segregation of duties — how it sits alongside observability, guardrails and orchestration, and what it does not do.

Blunt questions — whether you can self-host, who holds the signing keys, what certifications we do and don't have, and what a receipt does not prove — are answered on the FAQ.

Looking for the formal side instead? The enforcement specification (versioned, fingerprinted, frozen) and the published briefs — evidence completeness, provable safeguards for automated decisions, sector gap analyses for NZ health and NZ education — all live under /spec/.