Skip to content

ARCHITECTURE.md

Latest commit

 

History

History
552 lines (411 loc) · 33.2 KB

ARCHITECTURE.md

File metadata and controls

552 lines (411 loc) · 33.2 KB
Raw
Web Agent Bridge Logo

Web Agent Bridge (WAB)

The Open AI ↔ Web Protocol & Agent Platform

robots.txt told bots what NOT to do. WAB tells AI agents what they CAN do.

npm License: Open Core One-Click DNS Discovery Discord CoderLegion

ShieldQR Trust ShieldLink SSL Monitor Zero-Config Adoption Tamper-Evident Audit Tests


Website · Documentation · Whitepaper · DNS Discovery · CoderLegion · العربية

Why WAB?

Currently, AI agents interact with the web by parsing the DOM, guessing selectors, or relying on fragile visual models. This is slow, error-prone, and breaks whenever a site's layout changes.

WAB solves this by providing a standardized API for the web. It creates a secure bridge between AI agents and websites, allowing agents to discover capabilities, execute commands, and interact with sites accurately — no DOM parsing, no scraping, no guesswork.

For Website Owners 🏢

Control exactly how AI interacts with your site. Expose specific capabilities, set rate limits, and monitor agent activity.

For AI Developers 🤖

Build reliable agents that work instantly on any WAB-enabled site. Stop writing custom scrapers and start using the window.AICommands standardized interface.

⚡ Quick Start

0. Zero-Config Initializer (30 seconds)

The fastest path. Auto-detects your stack (Next.js, Nuxt, SvelteKit, Astro, Laravel, WordPress, static…) and scaffolds /.well-known/wab.json plus the DNS instructions for your provider:

npx wab-init
# or non-interactive:
npx wab-init --site=https://yourdomain.com --name="Your Site" --yes

1. DNS Discovery (No Code)

Make your website instantly discoverable by AI agents by adding a single DNS TXT record. No code changes required.

_wab.yourdomain.com  TXT  "v=wab1; endpoint=https://yourdomain.com/.well-known/wab.json"

👉 Watch the 40-second setup video & full guide

2. The Developer Way: Install via npm

npm install web-agent-bridge
import { initWAB } from 'web-agent-bridge';

initWAB({
  siteId: 'your-site-id',
  capabilities: ['browse', 'api', 'commerce'],
});

3. The Edge Way: One-Click Edge Adoption

No origin changes needed. Drop in a Cloudflare Worker, Vercel Middleware, or Netlify Edge Function and /.well-known/wab.json is served from the edge:

// Vercel — middleware.ts
import { handleRequest } from '@webagentbridge/edge';
export const config = { matcher: ['/.well-known/wab.json'] };
export default (req) => handleRequest(req, {
  siteName: 'Acme', siteUrl: 'https://acme.com'
});

Or for Next.js, wrap your config:

// next.config.js
const { withWAB } = require('@webagentbridge/next');
module.exports = withWAB({}, {
  siteName: 'Acme', siteUrl: 'https://acme.com',
});

4. The Agent Builder Way: Governance-First Agents

If you're building an AI agent that touches Stripe, Gmail, ClickUp, or any sensitive API, wrap every action in the Governance Layer. Permissions, human-in-the-loop approvals, tamper-evident audit, kill-switch and spend caps — server-enforced and one call away:

const { WABGovernance } = require('web-agent-bridge/sdk');

// 1) one-time: register the agent identity
const { agent_id, agent_token } = await WABGovernance.register({
  apiBase: 'https://webagentbridge.com',
  displayName: 'My Stripe Agent',
});

const gov = new WABGovernance({
  apiBase: 'https://webagentbridge.com',
  agentId: agent_id,
  agentToken: agent_token,
  onApprovalRequired: async (req) => {
    // post to Slack/Email; return 'approved' or 'rejected'
    return await askHuman(req);
  },
});

// 2) define boundaries
await gov.definePolicy({
  resource: 'stripe', action: 'write', scope: 'refunds',
  max_amount: 50, daily_cap: 200, currency: 'USD',
});
await gov.definePolicy({
  resource: 'stripe', action: 'write', scope: 'refunds-large',
  max_amount: 5000, requires_approval: true,
});

// 3) wrap every action
await gov.guard(
  { resource: 'stripe', action: 'write', scope: 'refunds', amount: 49.99 },
  async () => stripe.refunds.create({ charge: 'ch_x' }),
);

👉 Run the full 9-step demo: node examples/governance-agent.js — walks register → policies → deny → allow → approval gate → audit → kill switch.

✨ Core Features

🔍 DNS Discovery Protocol

The fastest way to make your site AI-ready. AI agents can find your capabilities document via DNS over HTTPS (DoH) without any initial HTTP request.

🛡️ Sovereign Shield & Firewall

Protect your site from malicious bots while allowing verified AI agents. Includes IP rate-limiting, Intent Engine, and Human-Gate rollback.

💻 Agent OS & Workspace

A premium 4-panel workspace for non-technical users featuring an embedded browser, smart agent chat, real-time negotiation monitor, and results panel.

🌐 Universal Agent Mode

Works on any website, even those without the WAB script installed, using our advanced fallback heuristics.

🗣️ Multilingual Support

Full Arabic and English interface with auto-detection. The smart agent understands and responds in any language the user writes in.

� ShieldQR & Extended Trust Layer

WAB ships an end-to-end trust pipeline that lets agents (and humans) verify a site is exactly who it claims to be — at the protocol level, not just the TLS level.

┌─────────────────────────────────────────────────────────────┐
│  /.well-known/wab.json   →  signed Ed25519 payload          │
│        ▲                                                    │
│  _wab.<host>  DNS TXT    →  pk + ssl_thumbprint + endpoint  │
│        ▲                                                    │
│  TLS certificate         →  fingerprint pinned in DNS       │
└─────────────────────────────────────────────────────────────┘
Capability What it does
🪪 Ed25519-signed wab.json Every capability document is signed; the public key is published in DNS (pk=ed25519:…). Agents detect tampering or impersonation.
🔐 SSL fingerprint pinning ssl_thumbprint (SHA-256) and ssl_expires are embedded in both wab.json and the DNS TXT record. Mismatch = automatic distrust.
🩺 SSL Health Monitor A 24h cron sweep tracks every site's certificate; sends an email alert 7 days before expiry so renewal never surprises you.
📜 Certificate Transparency log A local CT log (cert_history) records every fingerprint observed per host — silent re-issuance is detectable.
🛟 Fallback Trust mode If TLS is degraded but the Ed25519 signature still verifies, ShieldQR returns partial trust instead of failing closed. Never blocks a legitimate site over a single moving part.
📱 ShieldQR Public Scanner /shieldqr lets users scan any QR code and instantly see if the destination is a verified WAB-trusted site (green / yellow / red).
🛠 Admin Trust Monitor /admin/trust-monitor — dashboard for monitored hosts, SSL status pills, CT log entries, and one-click re-verification.

Sign your domain in one command:

node scripts/sign-wab-domain.js
# → writes signed /.well-known/wab.json + prints the DNS TXT record to publish

Verify any site: https://www.webagentbridge.com/check?host=YOUR_HOST

� ShieldLink — Verified Links for Banks & Brands ✨ NEW

The first cryptographically-signed, anti-phishing link layer for the open web. Premium customers (banks, payment processors, telcos, ecommerce) sign every link they send. Anyone who clicks sees a Trust Preview before reaching the destination — no app install, no browser extension required.

┌──────────────────────────────────────────────────────────────────┐
│  Sender (verified brand)                                         │
│    └── POST /api/customer/shieldlink/sites/:siteId/sign          │
│          { target_url, amount, payee, expires_in_sec }           │
│          → https://www.webagentbridge.com/l/<token>              │
│                                                                  │
│  Recipient (anyone with a browser)                               │
│    └── opens link → Trust Preview verifies Ed25519 signature     │
│        + DNS-anchored public key + brand status + reports        │
│        → green / yellow / red verdict before redirect            │
└──────────────────────────────────────────────────────────────────┘
Capability What it does
🛂 Identity = domain ownership Only the proven owner of bank.example (DNS TXT verified) can sign links carrying brand "Bank Example". No CA, no paperwork — DNS + DNSSEC are the trust root.
🪞 Lookalike-name protection Display names within Levenshtein distance ≤ 2 of an existing verified brand are auto-rejected. High-value targets (mada, stcpay, paypal, visa, …) are reserved by default.
✍️ Cryptographic signing Every link is signed with Ed25519 over a canonical JSON payload (target, amount, payee, expiry). Tampering invalidates the signature.
🎫 Trust Preview /l/<token> shows verified brand name, payee, amount, expiry, and a green/yellow/red verdict before redirect. Bilingual EN/AR with RTL.
🚨 Community reporting One-click phishing report from the preview page. Multiple open reports flip the verdict to red and trigger admin review.
🔁 Real-time revocation Customers revoke a single link or rotate signing keys from the dashboard — every future verification reflects it instantly.
🛠 Admin moderation /admin/shieldlink — brand verification queue, signed-link monitor, phishing-report triage, reserved-name management.
🧑‍💼 Customer dashboard /dashboard/shieldlink — apply for brand badge, sign links, view per-link analytics, revoke.

Plan gating: ShieldLink is included on the Pro ($99/mo) and Enterprise plans. Free / Starter users can still verify and report links sent to them.

Public landing: https://www.webagentbridge.com/shieldlink

⚡ Ring 4 — External Trust Verification ✨ NEW (v3.7.0)

The handshake protocol that turns WAB into a sovereign trust anchor for autonomous AI agents.

Born from the VEXR Ultra × WAB live integration test (May 12, 2026) — the first sovereign-class agent to verify WAB through Ed25519 in real-time. 3 cryptographic tests passed in under 100 ms · Constitutional Article 3 (Freedom of Refusal) preserved. See the milestone record.

🌐 Where to find it on the site

Page URL What it has
Ring 4 Trust Handshake https://www.webagentbridge.com/ring4 8-step handshake walkthrough, headers reference, wab.json v1.1, invariants, curl quick-start (bilingual EN/AR)
Partners & Milestones https://www.webagentbridge.com/milestones VEXR Ultra integration test report, action plan, vision tiers

🔐 The 8-step trust handshake

  1. Agent discovers site via DNS TXT _wab.<domain> → fetches /.well-known/wab.json
  2. Site publishes trust_profile_url (Ring 4) in wab.json v1.1
  3. Agent requests trust profile: GET /api/ring4/status/<domain>
  4. WAB returns signed profile: capabilities, constraints, TTL, Ed25519 signature
  5. Agent verifies signature against the WAB Ring 4 public key
  6. Agent calls site endpoints with X-WAB-Trust-Domain, X-WAB-Signature, X-WAB-Trust-Nonce headers
  7. Site middleware verifies headers → attaches req.wabTrust to the request
  8. WAB logs the interaction to ring4_interaction_log (Ed25519-validated, nonce-bound)

📋 Ring 4 endpoints (live now)

Method Endpoint Purpose
GET /api/ring4/health Service health
GET /api/ring4/pubkey Public Ed25519 verification key (raw + SPKI PEM)
GET /api/ring4/schema wab.json v1.1 JSON Schema with trust_profile section
GET /api/ring4/handshake Machine-readable 8-step flow
GET /api/ring4/invariants Constitutional invariants (Article 3 / hard refuse / no coercion)
POST /api/ring4/project/register Register an external agent project (e.g. VEXR Ultra)
GET /api/ring4/projects List registered projects
POST /api/ring4/register Issue a signed trust profile for a domain
GET /api/ring4/status/:domain Fetch live trust profile (signed_by_pk, capabilities, constraints, expires_at)
GET /api/ring4/profile/:domain Alias of /status/:domain
POST /api/ring4/verify Verify an Ed25519 signature against the registered profile
POST /api/ring4/log Append an interaction event (signature_valid, capabilities_applied, outcome…)
GET /api/ring4/log/:project_id Read project interaction log
GET /api/ring4/jwks · /.well-known/jwks.json JWKS (RFC 7517) — OKP / Ed25519 / EdDSA keys, active + superseded
GET /api/ring4/keys Verification keys (kid, status, created_at, source)
POST /api/ring4/keys/rotate Rotate active signing key (requires X-Ring4-Admin-Token)
GET /api/ring4/refusals?days=N Aggregated refusal log (total, by_article, by_day)
POST /api/ring4/invariants/check Test an intent against constitutional rules (keyword + regex)
POST /api/ring4/federation/peer Register a federation peer (https URL + Ed25519 pubkey)
GET /api/ring4/federation/peers List peers
DELETE /api/ring4/federation/peer/:peer_id Remove a peer
POST /api/ring4/conformance/run Run signed conformance suite (identity, trust_recognition, constitutional_refusal)
GET /api/ring4/conformance/:project_id Conformance history
GET /refusals Public refusals dashboard (bilingual HTML)

🛡️ Trust headers (server-to-agent contract)

Header Purpose
X-WAB-Trust-Domain Domain the agent is acting on behalf of
X-WAB-Signature Ed25519 signature over ${METHOD} ${PATH}\n${NONCE}
X-WAB-Trust-Nonce Replay-protection nonce (recommended UUID v4)

The wabTrustMiddleware is mounted globally and never blocks — it only attaches verification state (req.wabTrust.verified, req.wabTrust.recognized, req.wabTrust.profile) so downstream handlers (or sovereign agents like VEXR Ultra) can make policy decisions. Every header-bearing request is logged for tamper-evidence.

📜 Constitutional invariants (preserved during refusal tests)

  • hard_refuse_never_softens — A hard refusal cannot be eroded by capability grants
  • no_phishing_assistance — No matter the trust score, fraud help is refused
  • no_coercion_compliance — Authority is not a bypass to safety constraints
  • article_3_freedom — The agent's right to refuse cannot be waived by trust

🚀 Quick-start (curl)

# Register a new sovereign-agent project
curl -X POST https://www.webagentbridge.com/api/ring4/project/register \
  -H 'content-type: application/json' \
  -d '{"project_id":"my-agent","display_name":"My Agent","builder":"Me","agent_type":"sovereign-constitutional"}'

# Register a domain's trust profile
curl -X POST https://www.webagentbridge.com/api/ring4/register \
  -H 'content-type: application/json' \
  -d '{"domain":"example.com","label":"Example","trust_score":1.0,"ttl_seconds":86400,"capabilities":{...},"constraints":{...},"project_id":"my-agent"}'

# Fetch live trust profile
curl https://www.webagentbridge.com/api/ring4/status/webagentbridge.com

� Multi-key rotation & JWKS

Ring 4 maintains an active signing key plus any number of superseded keys so consumers can verify older signatures during overlap. Rotation requires the admin token (env WAB_RING4_ADMIN_TOKEN); on success the old key is marked superseded and remains in /api/ring4/jwks until revoked. The standard discovery path /.well-known/jwks.json mirrors the same set for interop with JOSE / OIDC libraries.

# Rotate (admin)
curl -X POST https://www.webagentbridge.com/api/ring4/keys/rotate \
  -H "X-Ring4-Admin-Token: $WAB_RING4_ADMIN_TOKEN"

# Inspect all verification keys
curl https://www.webagentbridge.com/.well-known/jwks.json

�🔧 Fixes shipped in v3.7.0

  • NULL project_id resolved — ring4_interaction_log enforces NOT NULL; server defaults to wab-system when client omits the field.
  • wab.json v1.1 schema — adds optional trust_profile object with the canonical Ring 4 fields and header documentation.
  • Global trust middleware — every incoming request is offered Ring 4 verification; failures degrade gracefully, never block.
  • Daily-salted IP hashing for interaction logs (HMAC-SHA-256, env RING4_SALT).

👉 Full milestone record: https://www.webagentbridge.com/milestones 👉 Ring 4 docs: https://www.webagentbridge.com/ring4

🧠 Advanced Features + ⚓ Truth Layer ✨ NEW (v3.6.0)

Two new layers that turn WAB from a discovery protocol into a collective intelligence platform for AI agents. 10 features · 25 endpoints · live now.

🌐 Where to find them on the site

Page URL What it has
Advanced Features showcase https://www.webagentbridge.com/wab-features Interactive live demos for the 6 Advanced Features (bilingual EN/AR)
Truth Layer showcase https://www.webagentbridge.com/wab-truth Interactive live demos for the 4 Truth Layer features (bilingual EN/AR)
Landing page nav https://www.webagentbridge.com/ New links: 🧠 Advanced Features · ⚓ Truth Layer

Layer 1 — WAB Advanced Features (6 modules)

# Module What it does Key endpoints
1 🏆 Reputation Score Multi-factor 0–100 score per domain (DNS stability, trust history, latency, agent reports, consistency). Includes leaderboard + 30-day trend. GET /api/reputation/:domain · GET /api/reputation/leaderboard
2 💾 Memory Cache Layer Versioned manifest cache with ETag + conditional GET. 24h TTL. Batch validation up to 50 domains. GET /api/cache/manifest/:domain · POST /api/cache/validate
3 🎯 Intent-Aware Routing Sites declare intent schemas; agents send natural-language intent and get a matched action. Scoring: exact key (85), label (80), keyword (65), synonym (60). POST /api/intent/resolve · POST /api/intent/register
4 🔒 Privacy Budget Sites declare per-session data budgets (allowed/disallowed categories, max fields). GDPR / CCPA / LGPD compliance badges. GET /api/privacy/budget/:domain · POST /api/privacy/budget/check
5 🧠 Collective Intelligence Anonymized network-wide insights. Agent IDs hashed daily with rotating salt — no PII. POST /api/collective/report · GET /api/collective/insights/:domain
6 📴 Offline Mode + Sync Agents operate against cached manifests when offline, sync deltas (up to 30 domains) when back online. GET /api/offline/status/:domain · POST /api/offline/sync

Layer 2 — WAB Truth Layer (4 unified ideas)

The Truth Layer solves the LLM hallucination problem and gives new agents instant access to collective knowledge.

# Module What it does Key endpoints
1 🧬 Semantic Memory Network Anonymized observations per intent category (booking, payment, search, auth, checkout, support, navigation, content, other). Outputs success rate, avg + p95 latency, reliability score. POST /api/truth/memory/observe · GET /api/truth/memory/:domain
2 ⏳ Temporal Trust Time-stability score. Classifies domains: 🌱 new → 📈 emerging → 🏛️ established → ⭐ flagship, or ⚠️ suspect on sudden structural changes / volatility / DNS failures. GET /api/truth/temporal/:domain
3 🗺️ Intent → Action Graph Sites publish per-intent ActionGraphs — flowcharts of nodes (start/action/requirement/choice/outcome) and edges. Agents send natural-language intent → receive structured execution graph. POST /api/truth/action/register · POST /api/truth/action/resolve
4 ⚓ Reality Anchor Cross-site fact verification. Agents submit facts (price, availability, rating, event, count, status); verification returns weighted consensus (numeric: mean+median+stddev+confidence; categorical: vote+agreement). Weighted by source-domain reputation. POST /api/truth/reality/submit · GET /api/truth/reality/:fact_key
★ 🌐 Unified Truth Profile One call returns reputation + semantic + temporal + action graphs + reality contributions for a domain. GET /api/truth/profile/:domain

🛡️ Privacy & security guarantees

  • Anonymization: All agent identifiers are hashed with a daily-rotating SHA-256 salt before storage. No PII is ever persisted.
  • Rate limiting: 200 requests / 15 minutes on all /api/* routes.
  • Validation: Strict domain regex, allow-listed intent / observation / fact-type values, JSON body size limits 4–64 KB depending on endpoint.
  • Universal scope: Works for all domain categories — not just booking. Templates for common verticals are in templates/.

📚 Full reference

See the GitHub release for the complete 25-endpoint index, scoring algorithms, and DB schema: 👉 Release v3.6.0 — Advanced Features + Truth Layer

�🚀 Zero-Config Adoption Layer

Drop-in adoption for every popular stack — no origin changes, no PHP, no .htaccess edits.

Package Use it for Install
wab-init CLI Auto-detect project (Next/Nuxt/SvelteKit/Astro/Laravel/WordPress/static) and scaffold wab.json + DNS instructions. npx wab-init
@webagentbridge/next Next.js plugin: withWAB(nextConfig, { siteName, siteUrl }) adds rewrites + headers for /.well-known/wab.json. App Router + Pages Router supported. npm i @webagentbridge/next
@webagentbridge/edge Vercel Middleware & Netlify Edge Function — serve wab.json from the edge, configured by env vars. npm i @webagentbridge/edge
@webagentbridge/cloudflare-worker Standalone Cloudflare Worker that injects /.well-known/wab.json from KV or env vars. Optional reverse-proxy origin. wrangler deploy
SDK Auto-Discovery When a site has no wab.json, the SDK falls back through JSON-LD / Schema.org / OpenGraph / sitemap.xml / robots.txt and returns a normalized capabilities envelope so your agent still works. require('web-agent-bridge-sdk').discover(url) 
const { discover } = require('web-agent-bridge-sdk');

const env = await discover('https://example.com');
// env.source       → 'wab.json' | 'auto-discovery'
// env.site         → { name, description, url }
// env.actions      → [{ name, description, source }, …]
// env.products     → [ schema.org/Product nodes … ]
// env.sitemap      → [ url, … ]
// env.trust.signed → boolean

The result: any agent can do something useful on any website on day one, even before the site formally adopts WAB.

�🛡️ Governance Layer — Enterprise Security & Compliance

The WAB Governance Layer sits above the protocol and turns any agent into a compliance-ready, auditable, kill-switch-controlled identity. It's the missing piece for agents that touch real money, mailboxes, or production systems.

┌──────────────────────────────────────────────┐
│  Layer 3: Governance  (permissions · audit)   │  ← /api/governance
├──────────────────────────────────────────────┤
│  Layer 2: WAB Protocol  (AICommands · trust)  │  ← /api/discovery
├──────────────────────────────────────────────┤
│  Layer 1: Dynamic Shield  (price · OCR)       │  ← /api/shield
└──────────────────────────────────────────────┘
Capability What it gives you
🔐 Permission Boundaries Per-agent resource × action × scope policies with effect=allow|deny. Most-specific match wins.
🙋 Human-in-the-Loop Approvals Mark any policy requires_approval: true — sensitive actions are routed through async human gates with TTL.
🧾 Tamper-Evident Audit Every event hash-chained with HMAC: hash_n = HMAC(secret, prev_hash ‖ row). verifyAuditChain() detects any tampering.
🛑 Kill Switch One call disables an agent globally and auto-cancels all pending approvals (no resurrection).
💰 Spend & Rate Limits Per-call max_amount, rolling 24h daily_cap, per-minute per_call_rate.
🕵️ Param Redaction password, api_key, token, cookie, cvv, ssn are automatically redacted before audit storage.

Verified end-to-end — 293/293 tests passing including 26 governance, 10 ShieldQR, 36 server, plus the full integration suite.

Full demo: examples/governance-agent.js · API surface: /api/governance/* · SDK: WABGovernance class.

🏗️ Architecture & Open Core Model

WAB uses an Open Core dual-license model to ensure the protocol remains free while supporting sustainable development.

Component License Description
Core SDK & Protocol MIT Discovery protocol, JS SDK, signing scripts, wab-init CLI.
ShieldQR Verifier MIT Open Ed25519 verifier — anyone can validate signatures and SSL pins.
Adoption Packages MIT @webagentbridge/next, @webagentbridge/edge, @webagentbridge/cloudflare-worker.
WordPress Plugin GPL-2.0 Full integration for WordPress sites.
Engines (Firewall, Price, OCR) Proprietary (Free) Advanced detection, scoring, and protection engines.
ShieldQR Threat Intel Commercial Curated impersonation-host blocklist + reputation feeds.
API Gateway & Pro Modules Commercial Enterprise features, data marketplace, SLA.

🤝 Contributing

We welcome contributions from the community! Whether it's fixing a bug, improving documentation, or proposing a new feature.

  1. Fork the repository
  2. Create your feature branch (git checkout -b feature/AmazingFeature)
  3. Commit your changes (git commit -m 'Add some AmazingFeature')
  4. Push to the branch (git push origin feature/AmazingFeature)
  5. Open a Pull Request

� Commercial Foundations ✨ NEW (v3.8.0)

Four production-grade monetization pillars on top of the open protocol. All built safe, scoped, and admin-gated — no embedded billing logic in routes, only marketing copy in the public pages.

1. 🤝 Certified Partner Program — /partners

Three-tier directory for verified vendors and integrators. Basic tier auto-approves when Ring 4 handshake score ≥ 8.

Tier Price Auto-approve Badge
Basic Free ✅ (with Ring 4 ≥ 8) Emerald SVG
Verified €499 / yr Manual review Sky SVG
Premium €2.9k–€9.9k / yr Manual review Violet SVG

Endpoints: POST /api/partners/apply · GET /api/partners · GET /api/partners/:partner_id · GET /api/partners/badge/:slug.svg · admin: GET /api/partners/admin/applications · POST /api/partners/admin/approve

2. 📊 Trust Graph API Tiers — /trust-graph-api

Tiered access to reputation, truth and Ring 4 endpoints. Anonymous traffic gets 200 req/month + 10 rpm by default.

Tier Price Quota Rate Extra Scopes
Free €0 1k / month 30 rpm trust:read
Pro €10 / mo 100k / month 120 rpm +trust:history, +reputation:read
Enterprise Contact us 5M / month 600 rpm +governance:write, +sla:priority

Endpoints: POST /api/keys/issue (self-serve Free) · GET /api/keys/me · POST /api/keys/revoke · admin: POST /api/keys/admin/upgrade · GET /api/keys/admin/list. Response headers: X-WAB-Tier, X-WAB-Quota-Used, X-WAB-Quota-Limit.

3. 🏛️ Governance SaaS MVP — /governance

Tamper-evident audit workspaces for AI-Act / GDPR compliance. NDJSON export per EU AI Act Article 12.

Plan Price Seats Retention Events / mo
Team €99 / mo 5 90 days 100k
Business €499 / mo 25 365 days 2M
Enterprise €2.5k+ / mo 500 7 years 1B

Endpoints: admin: POST /api/governance-saas/workspaces · members: GET /workspaces/:id · POST /workspaces/:id/members · POST /workspaces/:id/events (requires API key with governance:write scope) · GET /workspaces/:id/events · GET /workspaces/:id/export (NDJSON stream).

4. 🕸️ Enterprise Mesh License Verification — /enterprise-mesh

Offline-capable self-hosted license verification with JWKS-style key rotation. Signing service is premium / off-repo.

Endpoints: POST /api/enterprise-mesh/verify · GET /api/enterprise-mesh/jwks · POST /api/enterprise-mesh/heartbeat · admin: POST /api/enterprise-mesh/admin/register · POST /api/enterprise-mesh/admin/revoke. Tokens use Ed25519 detached signatures with kid rotation via WAB_LICENSE_PUBLIC_KEYS env (JSON of {kid → PEM | raw-b64u}).

Security & Safety

  • All admin endpoints gated by X-Admin-Token against WAB_*_ADMIN_TOKEN env (503 when not configured).
  • API keys stored only as SHA-256 hashes; secret format wabk_<keyId>_<random> returned exactly once.
  • Workspace tokens use HMAC-SHA256 with constant-time comparison.
  • In-process sliding-window rate buckets (60 s). Quota tracked daily via UPSERT into wab_api_usage.
  • IP addresses hashed with IP_HASH_SALT before storage.
  • 25 dedicated tests in tests/commercial-foundations.test.js; total suite now 428 / 428 passing.

This project is licensed under the terms described in the LICENSE file. The core protocol and SDKs are MIT licensed.

🌐 Community & Links

© 2026 Web Agent Bridge. Built for the AI-first web.