Agentic API · single registry · ten transports

One registry. Every agent.

613 actions across 33 L5 domains. One Zod 4 source-of-truth registry generates every transport — REST, MCP, ChatGPT Apps, Gemini, Perplexity, Claude Cowork, A2A, NLWeb, Claude SKILLs — byte-identically, on every contracts version bump. W3C DID Web agent identities, SPIFFE workload identity, AP2 Verifiable Credential mandates, MCP Apps confirmation iframes, C2PA 2.1 content provenance. The same security posture as the dashboard, against the same hash-chained audit log.

613

Actions

L5 domains

Transport surfaces

Well-known files

OpenAPI 3.1 spec AGENTS.md MCP tool list

The stack · L1 to L6

Six layers,
one source.

Every Intramedial action is defined once in the contracts registry (L5) and the codegen pipeline (L4) emits every transport's wire format byte-identically. The Worker (L3) implements each action once; the gateway middleware (L2) enforces auth + idempotency + rate-limit + confirmation + mandate + audit across all transports. Customer surfaces (L1) — the dashboard, AI chats, partner agents — never re-derive contracts.

The agentic-API stack descends from L1 customer surfaces (dashboard, AI chats, partner agents) through L2 gateway middleware (15-step chain), L3 per-domain handlers, L4 codegen pipeline, L5 Action Registry, to L6 identity primitives. Each transport's wire format is derived from L5 byte-identically.

Layer
L1
Customer surfaces
Dashboard, embedded customer apps, partner agents reaching the gateway via OAuth or A2A or workload SVID.
Layer
L2
Gateway middleware
15-step middleware chain: CORS → site-gate → replay-defense → auth → workspace-context → idempotency → rate-limit → kill-switch → permission → mandate → confirmation → handler dispatch → audit envelope → Tops feed → response shaping.
Layer
L3
Per-domain handlers
One handler per L5 action. Pure modules: take RequestContext + parsed input, return result OR error. No global state.
Layer
L4
Codegen pipeline
Walks the L5 registry once, emits OpenAPI 3.1 · MCP tool list · ChatGPT Apps manifest · Gemini Extension · Perplexity Connector · Claude Cowork capability · A2A capability card · AsyncAPI 3 · NLWeb · Claude SKILLs · AGENTS.md.
Layer
L5
Action Registry (contracts)
Zod 4 schemas defined once with z.toJSONSchema(). 613 actions across 33 domains. Every transport's wire format derived from here.
Layer
L6
Identity + audit + cryptography primitives
W3C DID Web · SPIFFE · AP2 mandates · MCP Apps iframe · C2PA · OpenTimestamps · DPoP (RFC 9449) · intent claims · confirmation tokens · hash-chained audit log.

The catalogue · 613 actions

33 L5 domains.
Every action declared once.

Each action declares its safety level (read / mutation / destructive / billing_impacting), confirmation policy (none / ask / always / mandate), permission scopes, idempotency, audit kind, rate class, and transport surfaces. The L5 enum is the closed set; every codegen target walks it deterministically.

tools
131 actions
Cryptographic-receipt tools: the core tools and the catalogue.
paradigm
34 actions
Paradigm product line.
trustactor
33 actions
33 actions in the trustactor domain.
billing
32 actions
Subscription, packs, top-ups, invoices, cost centers.
receipts
32 actions
32 actions in the receipts domain.
tranquility
30 actions
Evidence coverage, usage seals, observability views.
org
26 actions
Organization-level CRUD, members, roles, invitations.
account
23 actions
Login session, profile, passkeys, locale, notification preferences.
velara
21 actions
Velara product line.
agents
20 actions
W3C DID Web identity + AP2 mandates + SPIFFE + federation roots.
audit
19 actions
Three-tier audit log (workspace, custody, Tops feed).
number_one
18 actions
Number One AI chat in 3 modes (Calculator / Analyst / Admin).
driftvice
15 actions
Driftvice product line.
tops
15 actions
Tops config cascade (org → workspace → actor).
workspace
15 actions
Workspace CRUD, members, settings, region binding.
lens
14 actions
Lens engine — compliance-evidence projections over the audit chain.
fabric
12 actions
Connector fabric — inbound adapters + broadcast.
retention
12 actions
Retention policy + paid extension.
webhooks
12 actions
Outbound webhook endpoints + signing secrets + deliveries.
pricevice
11 actions
Pricevice product line.
referrals
11 actions
Codes + redemption + spend ledger + Every.org charity.
alerts
10 actions
Alert rules + test fires + history.
exports
10 actions
Compliance exports + receipt bundles + EU AI Act Article 12.
keys
10 actions
Personal access tokens + workspace API keys (itml_pat_* + av_workspace_*).
actionflow
7 actions
Multi-step action composition + templates.
discovery
7 actions
Capabilities + version + schema + plan list.
witness
7 actions
Witness fabric — tee'd record attestation.
privacy
6 actions
GDPR/CCPA DSR submission, status, receipts. Always-on.
support
6 actions
Tickets + replies + satisfaction surveys.
vector
5 actions
Vector product line.
charter
3 actions
3 actions in the charter domain.
nexus
3 actions
Nexus product line.
notarian
3 actions
Signed evidence snapshots + OpenTimestamps anchoring.

Ten transports

Reach Intramedial
from anywhere.

Every action declares a default reach across REST + MCP + the four chat-surface manifests + A2A + NLWeb + Claude SKILL. Surface lists are per-action in the registry — a high-risk action (e.g.billing.subscription.cancel) ships REST-only by default and the customer opts into wider reach via the workspace settings.

REST
POST /api/v1/<action-id>. OAuth 2.1 + DPoP-bound or PAT or workspace API key.
MCP
Streamable HTTP + SSE at mcp.intramedial.com/mcp. 55 tools.
MCP Apps
ui.iframe capability for rich confirmation modals on mandate-gated actions.
ChatGPT Apps
OpenAI Apps SDK manifest at /.well-known/ai-plugin.json. OAuth + PKCE + DPoP-supported.
Gemini Extensions
Function declarations at /.well-known/gemini-extension.json.
Perplexity
Connector v1 tool list at /.well-known/perplexity-connector.json.
Claude Cowork
Capability card at /.well-known/claude-cowork.json with seeded prompts.
NLWeb
Natural-language-discoverable intents at /.well-known/nlweb.json.
Claude SKILLs
One SKILL.md per L5 domain published under /.well-known/claude-skills/.

Reference-grade primitives

Built on the
specs you already trust.

We never invent crypto. Every primitive here is W3C, IETF, SPIFFE, AP2, MCP, C2PA. The contracts repo cites every spec by section + RFC + version so partner integrations don't need to re-negotiate the wire format. The wiring docs map each spec to a deployment-ready Worker implementation.

W3C DID Web Method

Every agent on the platform has its own decentralized identity.

did:web:intramedial.com:agents:<id> for every enrolled agent.
Ed25519 (default) or ES256 signing keys. Customer-rotatable + customer-revocable.
Per-DID rotation history forms a hash chain. JCS-canonicalised (RFC 8785).
Universal resolver accepts did:web, did:key, did:peer for partner federations.

W3C DID Core 1.0 · DID Web Method 0.2 · JWK RFC 7517+7638

SPIFFE Workload Identity

Workloads attest themselves to the gateway — not just users.

spiffe.intramedial.com trust domain + JWT-SVID exchange.
DPoP-bound short-lived (5-minute) Intramedial sessions issued on workload-attest.
Workspace-scoped federation against partner trust domains.
Trust-bundle SHA-256 pinning + drift detection.

SPIFFE 1.0 · JWT-SVID · Trust Domain + Bundle + Federation

AP2 Verifiable Credential Mandates

Standing authorisation for agent-led billing — with cryptographic enforcement.

W3C VC Data Model 2.0 + SD-JWT VC (IETF). Selective-disclosure presentations.
Spend + invocation + per-hour + per-action limits enforced at every gateway call.
Conditions: IP CIDR allow-list, required DPoP key thumbprint, step-up factor.
BitstringStatusListCredential at /.well-known/mandates/status-list.json; 5-min refresh.

W3C VC Data Model 2.0 · SD-JWT VC · Data Integrity 1.0 · AP2 baseline

MCP Apps ui.iframe

Rich confirmation modals — sandboxed, audience-restricted, origin-separated.

Iframes served from ui.intramedial.com — a separate Cloudflare zone with strict CSP + COEP + COOP.
9-message postMessage protocol (`mcp-apps@1`). Host-issued nonces echoed by the iframe.
Audience-restricted UI session tokens (`aud: ["https://ui.intramedial.com"]`).
Subresource Integrity on every script + stylesheet.

MCP Specification 2025-06-18 · MCP Apps SEP-2025-09 · HTML5 sandbox · postMessage

C2PA 2.1 Content Credentials

Intramedial receipts paired with ecosystem-standard provenance manifests.

C2PA 2.1 manifests signed on request, attachable to a receipt or exhibit by reference.
COSE_Sign1 over RFC-8949-canonical CBOR (EdDSA default, ES256 for FIPS deploys).
DigiCert RFC 3161 timestamp authority countersignature (opt-in; Pro+ and higher).
AI-generated content disclosure auto-injected (EU AI Act Art. 50 §3).

C2PA 2.1 · COSE_Sign1 (RFC 8152 + RFC 9052) · RFC 8949 CBOR · RFC 3161 TSP · CAI member

Authenticate

Four ways in.
All workspace-scoped.

Every credential is workspace-scoped, revocable, and recorded to the audit log on every issuance + every use. No cross-workspace blast radius; no shared API keys; every request enforces the workspace context convention (X-Workspace-Id header or ?ws= URL parameter — pinned in the API docs).

Personal access token

itml_pat_*

Self-serve per-developer tokens. 25 scopes from read-only audit to write-mandate. Optional IP CIDR binding. Cleartext shown once at issuance. Revocable instantly from /app/account/tokens.

OAuth 2.1 grants

OAuth + DPoP

RFC 9449 DPoP-bound access tokens. Audience-restricted per RFC 8707. Dynamic Client Registration (RFC 7591). Customer sees + revokes every grant from /app/account/connections.

Agent identity (A2A)

DID Web + JWT-VC

W3C DID Web Method per agent (did:web:intramedial.com:agents:<id>). Customer-rotatable keys, hash-anchored every rotation. Delegation-chain JWT array on multi-agent workflows; visible end-to-end at /app/agent-identity.

Workspace API keys

Ingest tokens

Single workspace · single scope. The OpenClaw plugin + webhook ingest + every adapter use these. Rotation + revocation from the workspace settings; never cross-workspace.

Mandate-required calls

An action that declares a mandate policy refuses without a verified AP2 Verifiable Credential. The customer issues the mandate scoped to named actions; the agent presents it inX-Mandate-Presentationas base64url JSON — the presentation envelope, not the bare credential — and the gateway verifies it against the BitstringStatusList before the call runs. Sender binding comes from DPoP: setconditions.requiredDpopJwkThumbprinton the mandate and the presentation is only usable by the key it was bound to.

Step-up confirmation

Sensitive actions (large export, key bulk-revoke, mandate issuance over budget) hit the MCP Apps iframe at ui.intramedial.com for a customer-confirmed modal before the action lands.

Try it

One action.
Every safeguard, no extra code.

Here's the canonical "agent makes a billing-impacting call with an AP2 mandate" flow. The same shape works from REST, MCP, ChatGPT Apps, A2A — only the transport changes. The gateway middleware enforces auth + workspace context + idempotency + rate-limit + kill-switch + permission + mandate + confirmation, and writes the audit envelope.

1 · Issue a mandate (one-time, via dashboard or API)

curl -X POST https://api.intramedial.com/v1/agents/mandate/issue \
  -H "Authorization: Bearer itml_pat_…" \
  -H "DPoP: <RFC-9449 proof>" \
  -H "Intramedial-Workspace-Id: ws_demo_default" \
  -H "X-Idempotency-Key: $(uuidgen)" \
  -H "X-Intramedial-Confirmation: conf_…" \
  -d '{
    "label": "Stripe refund bot — Q3 budget",
    "agentDid": "did:web:intramedial.com:agents:refund-bot",
    "allowedActionIds": ["billing.refund.issue"],
    "maxSafetyLevel": "billing_impacting",
    "workspaceIds": ["ws_demo_default"],
    "maxSpendUsdFractional": 50000,
    "maxInvocations": 200,
    "validForDays": 30
  }'

2 · Agent invokes the action (mandate-gated)

curl -X POST https://api.intramedial.com/v1/billing/refund/issue \
  -H "Authorization: Bearer <agent-session-jwt>" \
  -H "DPoP: <RFC-9449 proof>" \
  -H "X-Mandate-Presentation: <base64url JSON MandatePresentation>" \
  -H "Intramedial-Workspace-Id: ws_demo_default" \
  -H "X-Idempotency-Key: $(uuidgen)" \
  -d '{
    "chargeId": "ch_3Pj…",
    "amountFractional": 14500,
    "reason": "Customer requested partial refund"
  }'

3 · Same call, from MCP (Claude Cowork)

// MCP client calls the gateway through mcp.intramedial.com/mcp
// Tool name mirrors the action id; the host attaches the mandate
// presentation as the "x-intramedial-mandate" annotation.
{
  "name": "billing.refund.issue",
  "arguments": {
    "chargeId": "ch_3Pj…",
    "amountFractional": 14500,
    "reason": "Customer requested partial refund"
  },
  "_meta": {
    "x-intramedial-mandate": "<base64url JSON MandatePresentation>"
  }
}

4 · Same call, from A2A (partner gateway)

// Partner agent presents an A2A claim against
// did:web:intramedial.com:agents:gateway.
// Worker validates the mandate VC's issuer DID is trusted by
// our workspace, the cross-signature is valid, the action is
// in actionScope.allowedActionIds, and the spend is under
// limits.maxSpend.
{
  "@context": ["https://a2a.org/v1"],
  "from": "did:web:partner.example.com:agents:billing-bot-12",
  "to":   "did:web:intramedial.com:agents:gateway",
  "actionId": "billing.refund.issue",
  "params":   { /* ... */ },
  "mandate":  "<base64url JSON MandatePresentation>"
}

Discovery

41 well-known files.
No login required.

Every transport surface publishes its manifest at the canonical IANA-registered or ecosystem-conventional well- known path. Agents (LLM hosts, partner integrations, security verifiers) discover the surface without an auth round-trip. Cache: public, max-age=300, must-revalidate. Every file is emitted by the contracts codegen, never written by hand.

Auditor-grade

Every call.
Hash-chained. Anchored.

Every agentic call lands in the same hash-chained audit log the customer dashboard surfaces — same SQLite append-only trigger, same Ed25519 detached signature, same OpenTimestamps daily anchor. Mandate-gated calls additionally log the mandate handle + estimated spend + verification outcome. Workload-attestation calls additionally log the SVID hash + trust-domain provenance.

Hash chain
Per-workspace SQLite trigger emits prev_hash → hash on every write. Append-only; mutation is detectable by re-walking the chain.
Keyless chain — no signing key to trust
Entries are not signed, and do not need to be: re-walking the chain detects any mutation using nothing but the entries themselves. Nothing to rotate, nothing to lose, no key of ours you have to take on faith. (Tools receipts are separately Ed25519-signed and verifiable against /.well-known/jwks.json.)
OpenTimestamps
Daily anchor commits the day's chain tip to the Bitcoin blockchain. Independent of Intramedial's infrastructure.
Action-specific kinds
agent.identity.* · agent.mandate.* · agent.spiffe.* · key.rotated · key.revoked — 36 audit event types total.

Security architecture Tops: Spot for Spot

For implementers + auditors

Every primitive.
Sourced + pinned.

The contracts registry cites every spec by version, and each primitive above names the standard it implements. Implementing a standard is not certification against it.

Browse the documentation Security & architecture Start a workspace

Intralock · Leases · Parley · Fleet Map

A Trustvice Product

Agenten handeln, wenn die Ebene Ja sagt – und das Protokoll sagt, warum.

Leiten Sie Agent-Aktionen, Inhalts-Hashes, API-Checks, DNS-Abfragen, Webhooks, LLM-Aufrufe und Git-Commits über Intramedial – für einen signierten Beleg, den jeder prüft, ohne uns zu vertrauen.

Registrieren Module entdecken

One registry. Every agent.

Six layers,
one source.

33 L5 domains.
Every action declared once.

Reach Intramedial
from anywhere.

Built on the
specs you already trust.

W3C DID Web Method

SPIFFE Workload Identity

AP2 Verifiable Credential Mandates

MCP Apps ui.iframe

C2PA 2.1 Content Credentials

Four ways in.
All workspace-scoped.

One action.
Every safeguard, no extra code.

41 well-known files.
No login required.

Every call.
Hash-chained. Anchored.

Every primitive.
Sourced + pinned.

Agenten handeln, wenn die Ebene Ja sagt – und das Protokoll sagt, warum.

Hinweis zu Marken

Region

Sprache wählen

One registry. Every agent.

Six layers,
one source.

33 L5 domains.
Every action declared once.

Reach Intramedial
from anywhere.

Built on the
specs you already trust.

W3C DID Web Method

SPIFFE Workload Identity

AP2 Verifiable Credential Mandates

MCP Apps ui.iframe

C2PA 2.1 Content Credentials

Four ways in.
All workspace-scoped.

One action.
Every safeguard, no extra code.

41 well-known files.
No login required.

Every call.
Hash-chained. Anchored.

Every primitive.
Sourced + pinned.

Agenten handeln, wenn die Ebene Ja sagt – und das Protokoll sagt, warum.

Hinweis zu Marken

Region

Sprache wählen

One registry. Every agent.

Six layers, one source.

33 L5 domains.Every action declared once.

Reach Intramedialfrom anywhere.

Built on thespecs you already trust.

W3C DID Web Method

SPIFFE Workload Identity

AP2 Verifiable Credential Mandates

MCP Apps ui.iframe

C2PA 2.1 Content Credentials

Four ways in.All workspace-scoped.

One action.Every safeguard, no extra code.

41 well-known files.No login required.

Every call.Hash-chained. Anchored.

Every primitive.Sourced + pinned.

Agenten handeln, wenn die Ebene Ja sagt – und das Protokoll sagt, warum.

One registry. Every agent.

Six layers, one source.

33 L5 domains.Every action declared once.

Reach Intramedialfrom anywhere.

Built on thespecs you already trust.

W3C DID Web Method

SPIFFE Workload Identity

AP2 Verifiable Credential Mandates

MCP Apps ui.iframe

C2PA 2.1 Content Credentials

Four ways in.All workspace-scoped.

One action.Every safeguard, no extra code.

41 well-known files.No login required.

Every call.Hash-chained. Anchored.

Every primitive.Sourced + pinned.

Agenten handeln, wenn die Ebene Ja sagt – und das Protokoll sagt, warum.

Six layers,
one source.

33 L5 domains.
Every action declared once.

Reach Intramedial
from anywhere.

Built on the
specs you already trust.

Four ways in.
All workspace-scoped.

One action.
Every safeguard, no extra code.

41 well-known files.
No login required.

Every call.
Hash-chained. Anchored.

Every primitive.
Sourced + pinned.

Six layers,
one source.

33 L5 domains.
Every action declared once.

Reach Intramedial
from anywhere.

Built on the
specs you already trust.

Four ways in.
All workspace-scoped.

One action.
Every safeguard, no extra code.

41 well-known files.
No login required.

Every call.
Hash-chained. Anchored.

Every primitive.
Sourced + pinned.