Axiru API.
A REST API and an MCP server for outflow governance. Submit refunds, credits, and adjustments for evaluation (USDC transfer intents in early access). Receive sealed decisions with the matched policy version, the approver routing decision, and the audit ledger ID for the receipt.
What you can do with the Axiru API
POST /api/v1/decisions
Submit a refund, credit, or adjustment intent for evaluation (USDC transfer intents in early access). Receive allowed, pending_approval, or denied, with the matched rule, policy version, and audit ledger ID.
MCP server (/api/mcp)
Hosted remote MCP server (Streamable HTTP) at https://www.axiru.com/api/mcp. Any MCP client can connect; no local install. Tools: axiru.check_spend_policy, axiru.request_spend_approval, axiru.get_spend_receipt, axiru.get_agent_budget, axiru.list_open_approvals, axiru.approve_request, axiru.reject_request, axiru.list_ledger_records, axiru.get_setup_state, axiru.get_active_policy, axiru.list_policy_templates, axiru.install_starter_policy. Bearer-token authenticated.
Outbound webhooks (planned)
Planned: subscribe to decision and approval lifecycle events with HMAC-signed payloads. Not yet available; today, poll the decisions API or export the ledger.
Decision ledger exports
Ledger exports: CSV and JSON downloads with chain-tip verification headers (Splunk file ingest compatible). The same hash-chained record that powers in-app replay.
What every endpoint shares
One auth model, one idempotency contract, one error envelope, one versioning rule. Documented up front so you only have to learn it once.
- Base URL
- https://www.axiru.com/api/v1
- Authentication
- Bearer token. Issued from /dashboard/settings, scoped to a workspace.
- Idempotency
- Pass idempotency_key in the request body. Replays within 24 hours return the original decision verbatim.
- Rate limits
- 100 req/min default. Contact support to raise limits.
- Content type
- application/json. UTF-8 required.
- Error model
- Standard HTTP status codes plus a typed error envelope with code, message, and request_id.
- Versioning
- API version pinned via the URL (/api/v1). Breaking changes ship as /api/v2 with a 12-month sunset on /api/v1.
Built for autonomous outflows
Every endpoint is callable by humans, scripts, or AI agents. The MCP server is the canonical way for AI agents to interact with the platform: it surfaces the same approvals, audit ledger, and policy evaluations as the dashboard, but in a form agents can reason about and act on directly. The API is an enforcement point, not an advisory check: on governed rails the payment credential stays server-side behind the API, the agent never holds it, and a denied decision leaves the agent nothing to execute with.
For humans and scripts
Use the REST API directly. Standard bearer-token auth, JSON in, JSON out, idempotency by key.
For AI agents
Point your agent at the hosted remote MCP server (Streamable HTTP) at https://www.axiru.com/api/mcp. No local install: any MCP client can connect, and tools, schemas, and auth are discoverable from /.well-known/agent.json.
Build outflow governance into your stack.
REST for humans and scripts. MCP for autonomous agents. Same policy, same ledger, same audit trail.
Start in shadow mode first. Move to live enforcement later.