{ "info": { "name": "Xynthera AI \u2014 Assurance, Workbench and Agent Controls", "schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json", "description": "Executable, credential-free evaluation pack. Public health/coverage/catalog/JWKS first; use your own sandbox API key locally for the remaining calls. Germany sandbox is the example. The policy hash is a synthetic illustration, not the hash of an actual verifier policy. The collection demonstrates HTTP integration and never claims to cryptographically verify an ALLOW. Use the SDK for enforcement. Coverage, pricing and release status must be read in current Xynthera documentation. No end-user identity documents are sent. Do not publish environment values or authenticated response examples. German role-signature checks currently rely on the certificate distributed by the same-origin manifest; independent authoritative anchoring is not established. Do not interpret a successful demo as certified identity or qualified trust validation. Website: https://xynthera-ai.toasty-seal-8877.chatgpt.site. Online subscriptions use the published purchase/recovery page and its live billing-country list. Access requires server-confirmed payment; no real paid customer fulfillment is claimed. Source coverage is a separate question. Keep generated values in a private environment; do not share/export them. New invoice and Agent Action APIs use the same shared Workbench allowance. Admin routes additionally require a private management key; generate it locally before bootstrap and never give it to an execution agent. JSON-RPC MCP paid checks use the private API key header. No automatic payment or external execution." }, "auth": { "type": "apikey", "apikey": [ { "key": "key", "value": "x-api-key", "type": "string" }, { "key": "value", "value": "{{xynthera_api_key}}", "type": "string" }, { "key": "in", "value": "header", "type": "string" } ] }, "variable": [ { "key": "base_url", "value": "https://pfxxzsnboehxsefyajml.supabase.co/functions/v1" }, { "key": "deployment_id", "value": "postman-sandbox-demo" }, { "key": "policy_hash", "value": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" }, { "key": "request_id", "value": "" }, { "key": "recipe_id", "value": "" }, { "key": "recipe_jws", "value": "" }, { "key": "xynthera_api_key", "value": "" }, { "key": "management_key", "value": "" } ], "item": [ { "name": "Start here \u2014 public reads", "item": [ { "name": "01 Service health", "request": { "method": "GET", "header": [], "url": "{{base_url}}/xynthera-ai-assurance/health", "description": "Public service availability. A healthy service does not prove paid activation or all countries supported.", "auth": { "type": "noauth" } }, "response": [] }, { "name": "02 Coverage and evidence levels", "request": { "method": "GET", "header": [], "url": "{{base_url}}/xynthera-ai-assurance/v1/coverage", "description": "Read actual evidence levels, freshness and missing capabilities. informational_only is true: this report never grants authorization. Separate 30 current national EU/EEA observations from historical UK and independently anchored trust.", "auth": { "type": "noauth" } }, "response": [] }, { "name": "03 Supported source catalog", "request": { "method": "GET", "header": [], "url": "{{base_url}}/xynthera-ai-assurance/v1/sources", "description": "Source inventory and access constraints. Source configuration does not establish an operational or independently verified national adapter. Read request 02 for actual evidence levels and freshness.", "auth": { "type": "noauth" } }, "response": [] }, { "name": "04 Receipt verification keys", "request": { "method": "GET", "header": [], "url": "{{base_url}}/xynthera-ai-eudi/jwks.json", "description": "Public ES256 keys. Use the Xynthera SDK to verify signature, type, exact expected context and expiry. Merely fetching keys does not validate a receipt.", "auth": { "type": "noauth" } }, "response": [] } ] }, { "name": "Sandbox assurance demonstration", "item": [ { "name": "05 Register sandbox deployment", "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" } ], "url": "{{base_url}}/xynthera-ai-assurance/v1/deployments", "description": "Writes one demonstration deployment to your sandbox tenant. Re-running updates the same demo ID. Use a sandbox key, not a production key.", "body": { "mode": "raw", "raw": "{\n \"deployment_id\": \"{{deployment_id}}\",\n \"ecosystem\": \"EUDI-DE\",\n \"source_keys\": [\n \"eudi-de-sandbox-lote\"\n ],\n \"policy_hash\": \"{{policy_hash}}\",\n \"version\": \"1.0.0\"\n}", "options": { "raw": { "language": "json" } } } }, "response": [] }, { "name": "06 Create signed Guard receipt", "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" } ], "url": "{{base_url}}/xynthera-ai-guard/v1/evaluate", "description": "Consumes one evaluation. Sample attributes are metadata, not an identity credential. Generates a unique request ID and requires Germany sandbox trust. An ALLOW is conditional on current source state.", "body": { "mode": "raw", "raw": "{\n \"request_id\": \"{{request_id}}\",\n \"country_code\": \"DE\",\n \"environment\": \"sandbox\",\n \"requested_credentials\": [\n \"age_over_18\"\n ],\n \"registered_intended_use\": {\n \"credentials\": [\n \"age_over_18\"\n ]\n },\n \"require_trust_state\": true,\n \"require_verifier_context\": true,\n \"verifier_context\": {\n \"deployment_id\": \"{{deployment_id}}\",\n \"policy_hash\": \"{{policy_hash}}\",\n \"version\": \"1.0.0\"\n }\n}", "options": { "raw": { "language": "json" } } } }, "response": [], "event": [ { "listen": "prerequest", "script": { "type": "text/javascript", "exec": [ "pm.environment.set(\"request_id\", \"postman-\" + pm.variables.replaceIn(\"{{$guid}}\"));" ] } }, { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Guard request accepted\", function () { pm.response.to.have.status(200); });", "if (pm.response.code === 200) {", " const body = pm.response.json();", " pm.test(\"Signed receipt is present (signature not verified here)\", function () {", " pm.expect(body.receipt.signature.compact).to.be.a(\"string\");", " });", "}" ] } } ] }, { "name": "07 Check deployment Gate", "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" } ], "url": "{{base_url}}/xynthera-ai-assurance/v1/gate", "description": "Consumes one Replay unit. A signed ALLOW expires after 30 seconds. HTTP 200 includes both ALLOW and DENY. This collection does not cryptographically validate the result: use the SDK before enforcement. This is an operational policy comparison, not running-code attestation.", "body": { "mode": "raw", "raw": "{\n \"request_id\": \"{{request_id}}\",\n \"deployment_id\": \"{{deployment_id}}\",\n \"expected_policy_hash\": \"{{policy_hash}}\",\n \"expected_version\": \"1.0.0\",\n \"max_source_age_seconds\": 600\n}", "options": { "raw": { "language": "json" } } } }, "response": [] }, { "name": "08 Inspect source impact", "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" } ], "url": "{{base_url}}/xynthera-ai-assurance/v1/impact", "description": "Consumes one Impact unit. Computes dependencies recorded by your tenant; unregistered dependencies cannot be inferred.", "body": { "mode": "raw", "raw": "{\n \"source_key\": \"eudi-de-sandbox-lote\"\n}", "options": { "raw": { "language": "json" } } } }, "response": [] }, { "name": "09 Export evidence metadata", "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" } ], "url": "{{base_url}}/xynthera-ai-assurance/v1/capsule", "description": "Consumes one Capsule unit. Signed metadata and retained source references; not a self-contained offline evidence bundle. Original receipt must remain retained (current beta: seven days).", "body": { "mode": "raw", "raw": "{\n \"request_id\": \"{{request_id}}\"\n}", "options": { "raw": { "language": "json" } } } }, "response": [] } ] }, { "name": "Bounded API Factory demonstration", "item": [ { "name": "10 Compile a bounded Gate API", "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" } ], "url": "{{base_url}}/xynthera-ai-assurance/v1/api-factory/compile", "description": "Consumes one Impact unit. Demonstrates release_gate; audit_export, source_impact and release_with_evidence are also implemented with their documented contracts and quotas. Stores the signed recipe in your private environment for the next request, not in the shared collection. Do not export environment values. Recipe expires after 24 hours.", "body": { "mode": "raw", "raw": "{\n \"name\": \"Postman sandbox policy gate\",\n \"need\": \"release_gate\",\n \"deployment_id\": \"{{deployment_id}}\",\n \"expected_policy_hash\": \"{{policy_hash}}\",\n \"expected_version\": \"1.0.0\",\n \"max_source_age_seconds\": 600\n}", "options": { "raw": { "language": "json" } } } }, "response": [], "event": [ { "listen": "prerequest", "script": { "type": "text/javascript", "exec": [ "pm.environment.set(\"recipe_id\", \"\");", "pm.environment.set(\"recipe_jws\", \"\");" ] } }, { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Recipe compilation accepted\", function () { pm.response.to.have.status(200); });", "if (pm.response.code === 200) {", " const body = pm.response.json();", " const valid = typeof body.recipe_id === \"string\" && /^[a-f0-9]{64}$/.test(body.recipe_id) && typeof body.recipe_jws === \"string\" && body.recipe_jws.split(\".\").length === 3;", " pm.test(\"Signed recipe fields are present (signature not verified here)\", function () { pm.expect(valid).to.eql(true); });", " if (valid) {", " pm.environment.set(\"recipe_id\", body.recipe_id);", " pm.environment.set(\"recipe_jws\", body.recipe_jws);", " }", "}" ] } } ] }, { "name": "11 Invoke generated Gate API", "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" } ], "url": "{{base_url}}/xynthera-ai-assurance/v1/apis/{{recipe_id}}/invoke", "description": "Consumes the underlying Replay quota. The compiled policy baseline cannot be overridden. Treat result as unenforced demonstration until SDK validation verifies the signed Gate, context and expiry.", "body": { "mode": "raw", "raw": "{\n \"recipe_jws\": \"{{recipe_jws}}\",\n \"input\": {\n \"request_id\": \"{{request_id}}\"\n }\n}", "options": { "raw": { "language": "json" } } } }, "response": [] } ] }, { "name": "Workbench consistency checks", "item": [ { "name": "Check supplied OpenAPI", "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"request_id\": \"{{request_id}}\",\n \"document\": {\n \"openapi\": \"3.0.3\",\n \"info\": {\n \"title\": \"Example\",\n \"version\": \"1\"\n },\n \"paths\": {}\n }\n}", "options": { "raw": { "language": "json" } } }, "url": "{{base_url}}/xynthera-ai-workbench/v1/contracts/check", "description": "Use a unique transport request_id. Keep keys in a private environment. HTTP200 does not establish external execution or payment." } }, { "name": "Check declared events", "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"request_id\": \"{{request_id}}\",\n \"events\": [\n {\n \"id\": \"event1\",\n \"stream\": \"billing\",\n \"sequence\": 1,\n \"timestamp\": \"2026-10-13T09:00:00Z\"\n }\n ]\n}", "options": { "raw": { "language": "json" } } }, "url": "{{base_url}}/xynthera-ai-workbench/v1/events/check", "description": "Use a unique transport request_id. Keep keys in a private environment. HTTP200 does not establish external execution or payment." } }, { "name": "Reconcile supplied invoice", "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"request_id\": \"{{request_id}}\",\n \"invoice\": {\n \"id\": \"INV-001\",\n \"supplier_id\": \"SUP-001\",\n \"currency\": \"EUR\",\n \"minor_digits\": 2,\n \"beneficiary_ref\": \"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\",\n \"lines\": [\n {\n \"id\": \"LINE-1\",\n \"item_ref\": \"SKU-1\",\n \"quantity\": 2,\n \"unit_price_minor\": 1000,\n \"discount_minor\": 100,\n \"tax_minor\": 380\n }\n ],\n \"total_minor\": 2280\n },\n \"purchase_order\": {\n \"id\": \"PO-001\",\n \"supplier_id\": \"SUP-001\",\n \"currency\": \"EUR\",\n \"minor_digits\": 2,\n \"lines\": [\n {\n \"item_ref\": \"SKU-1\",\n \"quantity\": 2,\n \"unit_price_minor\": 1000\n }\n ]\n },\n \"receipts\": [\n {\n \"id\": \"GR-001\",\n \"po_id\": \"PO-001\",\n \"supplier_id\": \"SUP-001\",\n \"lines\": [\n {\n \"item_ref\": \"SKU-1\",\n \"quantity\": 2\n }\n ]\n }\n ],\n \"payments\": [\n {\n \"id\": \"PAY-001\",\n \"invoice_id\": \"INV-001\",\n \"supplier_id\": \"SUP-001\",\n \"currency\": \"EUR\",\n \"minor_digits\": 2,\n \"amount_minor\": 2280,\n \"beneficiary_ref\": \"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\"\n }\n ],\n \"history\": [],\n \"supplier_profile\": {\n \"supplier_id\": \"SUP-001\",\n \"approved_beneficiary_ref\": \"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\"\n }\n}", "options": { "raw": { "language": "json" } } }, "url": "{{base_url}}/xynthera-ai-workbench/v1/invoices/reconcile", "description": "Use a unique transport request_id. Keep keys in a private environment. HTTP200 does not establish external execution or payment." } } ] }, { "name": "Invoice and agent controls", "item": [ { "name": "Owner policy \u2014 generate current policy with downloaded helper", "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "x-management-key", "value": "{{management_key}}" } ], "body": { "mode": "raw", "raw": "{\n \"request_id\": \"{{request_id}}\",\n \"policy\": {\n \"id\": \"owner-policy\",\n \"version\": \"1\",\n \"period\": \"{{current_utc_month}}\",\n \"validUntil\": {{future_epoch_ms_as_integer}},\n \"budgetMinor\": 10000,\n \"currency\": \"EUR\",\n \"reservationTtlMs\": 60000,\n \"rules\": [\n {\n \"agentId\": \"invoice-agent\",\n \"audience\": \"your-erp\",\n \"action\": \"invoice.release\",\n \"scopes\": [\n \"invoice.write\"\n ],\n \"maxAmountMinor\": 1000,\n \"confirmationRequired\": true,\n \"confirmationMaxAgeMs\": 60000\n }\n ]\n }\n}", "options": { "raw": { "language": "json" } } }, "url": "{{base_url}}/xynthera-ai-agent-action/v1/policies", "description": "Use a unique transport request_id. Keep keys in a private environment. HTTP200 does not establish external execution or payment." }, "event": [ { "listen": "prerequest", "script": { "type": "text/javascript", "exec": [ "pm.variables.set('current_utc_month', new Date().toISOString().slice(0,7));", "pm.variables.set('future_epoch_ms_as_integer', Date.now()+3600000);" ] } } ] }, { "name": "Issue owner approval", "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "x-management-key", "value": "{{management_key}}" } ], "body": { "mode": "raw", "raw": "{\n \"request_id\": \"{{request_id}}\",\n \"subject\": \"owner-demo\",\n \"request\": {\n \"requestId\": \"action-demo\",\n \"agentId\": \"invoice-agent\",\n \"audience\": \"your-erp\",\n \"action\": \"invoice.release\",\n \"scopes\": [\n \"invoice.write\"\n ],\n \"parameters\": {\n \"invoice_ref\": \"INV-001\"\n },\n \"amountMinor\": 1000,\n \"currency\": \"EUR\"\n }\n}", "options": { "raw": { "language": "json" } } }, "url": "{{base_url}}/xynthera-ai-agent-action/v1/approvals", "description": "Use a unique transport request_id. Keep keys in a private environment. HTTP200 does not establish external execution or payment." } }, { "name": "Reserve action \u2014 add returned approvalToken when required", "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"request_id\": \"{{request_id}}\",\n \"request\": {\n \"requestId\": \"action-demo\",\n \"agentId\": \"invoice-agent\",\n \"audience\": \"your-erp\",\n \"action\": \"invoice.release\",\n \"scopes\": [\n \"invoice.write\"\n ],\n \"parameters\": {\n \"invoice_ref\": \"INV-001\"\n },\n \"amountMinor\": 1000,\n \"currency\": \"EUR\"\n }\n}", "options": { "raw": { "language": "json" } } }, "url": "{{base_url}}/xynthera-ai-agent-action/v1/actions/reserve", "description": "Use a unique transport request_id. Keep keys in a private environment. HTTP200 does not establish external execution or payment." } }, { "name": "Commit reserved budget", "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"request_id\": \"{{request_id}}\",\n \"reservation_id\": \"action-demo\",\n \"input_hash\": \"{{action_input_hash}}\"\n}", "options": { "raw": { "language": "json" } } }, "url": "{{base_url}}/xynthera-ai-agent-action/v1/actions/commit", "description": "Use a unique transport request_id. Keep keys in a private environment. HTTP200 does not establish external execution or payment." } }, { "name": "Cancel uncommitted reserve", "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"request_id\": \"{{request_id}}\",\n \"reservation_id\": \"action-demo\",\n \"input_hash\": \"{{action_input_hash}}\"\n}", "options": { "raw": { "language": "json" } } }, "url": "{{base_url}}/xynthera-ai-agent-action/v1/actions/cancel", "description": "Use a unique transport request_id. Keep keys in a private environment. HTTP200 does not establish external execution or payment." } } ] } ] }