SDK and CLI reference

Status and license. The SDK is built from the v0.2 specification and published on npm as @delegus/sdk, alongside @delegus/core (the protocol engine) and @delegus/conformance (the vectors and CLI); all are Apache-2.0. This reference is generated from the source on the main branch, which can be ahead of the version on the registry; the version at the top of this page is the source version. The Delegus service is not open source. The integration surface is the one the integrate page shows.

Client#

The one object a relying party or a Principal talks to Delegus through.

Delegusclass#

packages/sdk/src/client.ts

class Delegus {
  new (opts?: DelegusOptions): Delegus
  transport: Transport
  // The RP's own public base URL (for Proof binding and the MCP tool URI); not a secret.
  publicBaseUrl: string | null
  // GET /me: what this client's API key resolves to (subject, role, settings).
  me(): Promise<JsonObject>
  // GET /healthz: true when Delegus reports every backing service reachable.
  health(): Promise<{ ok: boolean; env?: string; did?: string; }>
  apiKeys: { list: (subject?: string) => Promise<JsonObject>; create: (label?: string, subject?: string) => Promise<JsonObject>; revoke: (keyId: string, subject?: string) => Promise<JsonObject>; }
  // An OpenID AuthZEN Policy Enforcement Point in front of an MCP server: an
  // Express-style (req, res, next) middleware that verifies every JSON-RPC
  // `tools/call` with Delegus and fails closed. Needs `publicBaseUrl` set.
  mcp(opts?: McpOptions): McpMiddleware
  // POST /verify. Returns the signed Receipt for ALLOW and DENY alike.
  verify(req: VerifyRequest): Promise<Receipt>
  // OpenID AuthZEN Access Evaluation over /verify (for PEPs such as MCP servers):
  // subject {type:"agent", id, properties:{grant, proof}}, action {name, properties}, resource {type, id}.
  // `decision` is true only for ALLOW; `context.reason` is the Delegus reason, `context.receipt` the signed receipt.
  evaluate(req: { subject: { type: string; id: string; properties?: JsonObject; }; action: { name: string; properties?: JsonObject; }; resource: { type: string; id: string; properties?: JsonObject; }; context?: JsonObject; }): Promise<{ decision: boolean; context: JsonObject; }>
  outcomes: { report: (receiptId: string, event: OutcomeEvent) => Promise<JsonObject>; }
  decisions: { get: (receiptId: string) => Promise<{ receipt: Receipt; outcomes: JsonObject[]; }>; list: (opts?: ListOptions & { rp?: string; keyId?: string; decision?: "ALLOW" | "DENY"; reason?: string; principal?: string; grantId?: string; }) => Promise<Page<JsonObject>>; }
  // GET /decisions/export as NDJSON rows (decision summary + full receipt + outcome ledger); one page, cursor in `next_cursor`.
  decisionsExport(opts?: ListOptions & { rp?: string; keyId?: string; decision?: "ALLOW" | "DENY"; reason?: string; principal?: string; grantId?: string; }): Promise<Page<JsonObject>>
  // GET /decisions/stats: decisions and outcomes rolled up per Principal.
  decisionsStats(opts?: { since?: string; until?: string; rp?: string; principal?: string; }): Promise<JsonObject>
  // The Principal directory (§2.1 trust network): who is registered and verified, since when, with which keys. Any live key.
  principals: { list: (opts?: { kind?: "managed" | "hosted"; state?: "verified" | "unverified"; orgId?: string; limit?: number; cursor?: string; }) => Promise<Page<JsonObject>>; get: (did: string) => Promise<JsonObject>; }
  grants: { list: (opts?: ListOptions & { principal?: string; agent?: string; state?: "active" | "revoked"; }) => Promise<Page<JsonObject>>; }
  // GET /usage: verifies per UTC day (`byKey` adds a per-API-key breakdown).
  usage(opts?: { since?: string; until?: string; rp?: string; principal?: string; keyId?: string; byKey?: boolean; }): Promise<JsonObject>
  // GET /audit: newest first; own actions for a subject key, the org and its members for an org key, everything for admin.
  audit(opts?: ListOptions & { actor?: string; action?: string; target?: string; }): Promise<Page<JsonObject>>
  orgs: { create: (opts: { slug: string; name: string; }) => Promise<Org>; selfServe: (opts: { slug: string; name: string; adminEmail: string; clientIp?: string; }) => Promise<SelfServeBundle>; selfServeStarter: (rpDid: string) => Promise<SelfServeStarter>; selfServeFirstReceipt: (rpDid: string) => Promise<Receipt>; entitlement: (orgId: string) => Promise<Entitlement>; setEntitlement: (orgId: string, e: EntitlementRequest) => Promise<Entitlement>; get: (orgId: string) => Promise<Org & { members: JsonObject[]; }>; addMember: (orgId: string, did: string) => Promise<JsonObject>; apiKeys: { list: (orgId: string) => Promise<JsonObject>; create: (orgId: string, role: "read" | "admin", label?: string) => Promise<JsonObject>; revoke: (orgId: string, keyId: string) => Promise<JsonObject>; }; principal: (did: string) => Principal; }
  // Principal onboarding (admin token, or an org:admin key, which onboards into its own org). `org` here is the managed-Principal DID path `did:web:<domain>:org:<slug>`; the customer account is `orgs`.
  org: { create: (opts: { slug: string; signer?: Signer; keyId?: string; orgId?: string; }) => Promise<CreatedOrg>; register: (opts: { did: string; kid?: string; signer?: Signer; orgId?: string; }) => Promise<{ principal: Principal; apiKey: string; verification: JsonObject; didDocumentResolved: boolean; }>; }
  relyingParties: { create: (opts: { slug?: string; did?: string; name?: string; proofWindowSeconds?: number; orgId?: string; }) => Promise<{ did: string; apiKey: string; client: Delegus; }>; get: (did: string) => Promise<JsonObject>; update: (did: string, patch: { name?: string; proofWindowSeconds?: number; verifyRateLimitPerMinute?: number; }) => Promise<JsonObject>; }
  checkpoints: { get: (day?: string | "latest") => Promise<JsonObject>; leaves: (day: string) => Promise<string[]>; verify: (day?: string | "latest", keys?: Readonly<Record<string, Uint8Array<ArrayBufferLike>>> | undefined) => Promise<{ ok: boolean; day: string; root: string; treeSize: number; detail?: string; checkpoint?: Checkpoint; }>; contains: (day: string, receiptIds: readonly string[]) => Promise<{ present: string[]; missing: string[]; }>; }
  evidence: { get: (hash: string) => Promise<Uint8Array | null>; }
  // The service DID document's keys by kid (receipt and status-list keys). Only
  // methods of the document's own DID count (`<doc.id>#…`, controller absent or
  // `doc.id`), so a receipt's kid is bound to that DID; which fragment may sign
  // what (`#receipt-<n>`, `#status-<n>`) is checked at verification. Against the
  // production API the document must be `did:web:delegus.ai`.
  serviceKeys(): Promise<TrustedKeys>
  receipts: { verify: (receiptJws: string, keys: Readonly<Record<string, Uint8Array<ArrayBufferLike>>>, did?: string) => ReceiptVerification; inclusion: (receiptId: string, keys?: Readonly<Record<string, Uint8Array<ArrayBufferLike>>> | undefined) => Promise<{ ok: boolean; pending?: boolean; day: string; root?: string; detail?: string; }>; reverify: (input: { receipt: Receipt | string; grant: string; proof: string; action: unknown; keys?: Readonly<Record<string, Uint8Array<ArrayBufferLike>>>; proofWindowSeconds?: number; }) => Promise<ReverifyResult>; }
}

PRODUCTION_APIconst#

packages/sdk/src/client.ts

const PRODUCTION_API: "https://api.delegus.ai"

PRODUCTION_SERVICE_DIDconst#

packages/sdk/src/client.ts

The production service DID (spec §2.0); its document is served at PRODUCTION_API/.well-known/did.json.

const PRODUCTION_SERVICE_DID: "did:web:delegus.ai"

CreatedOrginterface#

packages/sdk/src/client.ts

interface CreatedOrg {
  principal: Principal
  did: string
  kid: string
  apiKey: string
  signer: Signer
}

DelegusOptionsinterface#

packages/sdk/src/client.ts

interface DelegusOptions {
  // RP or Principal API key (`dk_rp_…` / `dk_principal_…`).
  apiKey?: string | undefined
  // Delegus admin token, for onboarding calls.
  adminToken?: string | undefined
  // Self-serve provision key (console only): POST /orgs/self-serve, the starter calls, and org entitlements.
  provisionKey?: string | undefined
  // API origin; default production.
  baseUrl?: string | undefined
  // The origin Agents address this RP at (§4.3). RPs behind proxies MUST set
  // it so htu binding checks see the URL the Agent targeted.
  publicBaseUrl?: string | undefined
  fetch?: FetchLike | undefined
  timeoutMs?: number | undefined
}

Entitlementinterface#

packages/sdk/src/client.ts

The engine's view of an org's plan: the stored row (null fields when none is stored) and what the gate would decide now.

interface Entitlement {
  org_id: string
  // Whether a row exists. With enforcement on, no row means no plan.
  stored: boolean
  production: "allowed" | "blocked" | null
  production_until: string | null
  check_cap: number | null
  cap_since: string | null
  reason: "trial" | "paid" | "past_due_grace" | "canceled" | "comp" | "none" | null
  as_of: string | null
  updated_at: string | null
  // Production checks counted since cap_since (at most check_cap); null without a cap.
  production_checks_since_cap: number | null
  // A staff, self-test or canary tenant that never needs a plan.
  comp: boolean
  // What the gate would decide for the next production check now.
  effective: "allowed" | "blocked"
  // Why it would be refused; null when allowed.
  effective_detail: string | null
  // Whether this deployment refuses (true) or only logs (false) a blocked production check.
  enforced: boolean
  // PUT only: whether this push was stored.
  applied?: boolean | undefined
}

EntitlementRequestinterface#

packages/sdk/src/client.ts

An org's production entitlement, as the console pushes it (PUT /orgs/{org_id}/entitlement).

interface EntitlementRequest {
  production: "allowed" | "blocked"
  // Production checks stop at this instant; null for no end.
  production_until: string | null
  // At most this many production checks since cap_since; null for no cap.
  check_cap: number | null
  cap_since: string | null
  reason: "trial" | "paid" | "past_due_grace" | "canceled" | "comp" | "none"
  // The console's change time: an older push never overwrites a newer one.
  as_of: string
}

ListOptionsinterface#

packages/sdk/src/client.ts

interface ListOptions {
  limit?: number | undefined
  cursor?: string | undefined
  since?: string | undefined
  until?: string | undefined
}

Orginterface#

packages/sdk/src/client.ts

An organization: a customer account owning Principals and relying parties.

interface Org {
  org_id: string
  slug: string
  name: string
  created_at: string
}

OutcomeEventinterface#

packages/sdk/src/client.ts

interface OutcomeEvent {
  type: "fulfilled" | "cancelled" | "dispute_opened" | "dispute_resolved" | "chargeback_received" | "chargeback_reversed" | "loss_reported"
  occurred_at: string
  evidence_ref?: string | undefined
  note?: string | undefined
  correction_of?: string | undefined
  resolution?: "agent_at_fault" | "agent_not_at_fault" | "indeterminate" | undefined
  loss_amount?: number | undefined
  currency?: string | undefined
  reporter_signature?: string | undefined
}

Pageinterface#

packages/sdk/src/client.ts

interface Page {
  items: T[]
  // Pass back as `cursor` for the next page; null on the last page.
  next_cursor: string | null
}

SelfServeBundleinterface#

packages/sdk/src/client.ts

POST /orgs/self-serve: a whole new tenant plus its first-ALLOW material.

interface SelfServeBundle {
  org: Org
  // org:admin key — keep server-side; never show the customer.
  org_admin_key: string
  relying_party: { did: string; name: string; profile: string; proof_window_seconds: number; }
  // The customer's first verify key (dk_rp_…), shown once.
  rp_verify_key: string
  starter: SelfServeStarter
}

SelfServeStarterinterface#

packages/sdk/src/client.ts

A ready-to-verify sample from the shared sandbox Principal, bound to one relying party. POST grant/proof/action to /verify with the RP's key.

interface SelfServeStarter {
  grant: string
  proof: string
  action: JsonObject
  grant_id: string
  // When the Proof leaves the RP's proof window; ask for a fresh starter after this.
  expires_at: string
  verify_url: string
  verify_curl: string
}

VerifyRequestinterface#

packages/sdk/src/client.ts

interface VerifyRequest {
  grant: string
  proof: string
  action: unknown
  // The request the RP received. When given, the SDK checks the Proof's
  // htm/htu against it before calling Delegus (§4.3) and throws
  // ProofBindingError on mismatch. `path` is joined to `publicBaseUrl`.
  request?: { method: string; url?: string; path?: string; } | undefined
}

Principal#

A company that issues Grants to its agents.

Principalclass#

packages/sdk/src/principal.ts

class Principal {
  new (opts: PrincipalOptions): Principal
  did: string
  kid: string | null
  signer: Signer | null
  grant: { create: (req: GrantRequest) => Promise<IssuedGrant>; revoke: (grantId: string) => Promise<{ grant_id: string; revoked_at: string; }>; }
  agents: { register: (did: string) => Promise<void>; disable: (did: string) => Promise<{ revoked_grants: string[]; }>; }
  keys: { retire: (kid: string) => Promise<{ kid: string; state: "retired" | "compromised"; }>; compromise: (kid: string) => Promise<void>; }
  // Run domain verification now and return the state and instructions.
  verifyDomain(): Promise<JsonObject>
  status(): Promise<JsonObject>
}

Capabilityinterface#

packages/sdk/src/principal.ts

interface Capability {
  action: "commerce:purchase" | "api:call"
  constraints: JsonObject
  resources?: string[] | undefined
}

GrantRequestinterface#

packages/sdk/src/principal.ts

interface GrantRequest {
  // Agent DID (did:key).
  agent: string
  // 1–16 Capabilities (§3.3).
  authority: Capability[]
  // RFC 3339 UTC; default now (whole seconds).
  validFrom?: string | undefined
  // RFC 3339 UTC; default validFrom + 30 days; at most 90 days after validFrom.
  validUntil?: string | undefined
  // RP DIDs; absent = any registered RP.
  audience?: string[] | undefined
}

IssuedGrantinterface#

packages/sdk/src/principal.ts

interface IssuedGrant {
  id: string
  // The Grant compact JWS to hand to the Agent.
  jws: string
  credentialStatus: JsonObject
  validFrom: string
  validUntil: string
}

PrincipalOptionsinterface#

packages/sdk/src/principal.ts

interface PrincipalOptions {
  did: string
  // `did:web:…#key-n` of `signer`; required to create Grants.
  kid?: string | undefined
  signer?: Signer | undefined
  apiKey: string
  transport: Transport
  now?: (() => number) | undefined
  // `apiKey` is an org:admin key of the Principal's org: name the Principal on every call (`?principal=<did>`). Grants cannot be created this way.
  viaOrgKey?: boolean | undefined
}

Agent#

The key that signs a Proof for each request.

Agentclass#

packages/sdk/src/agent.ts

class Agent {
  new (signer: Signer): Agent
  did: string
  kid: string
  signer: Signer
  // Sign a Proof (§4) binding this key to one request, one RP, one Grant.
  sign(req: ProofRequest): Promise<string>
  // The two request headers the RP forwards to /verify (§4.4).
  headers(req: ProofRequest): Promise<{ "Delegus-Grant": string; "Delegus-Proof": string; }>
  // The Delegus-Grant / Delegus-Proof headers for an MCP `tools/call`: the
  // Proof binds to the same tool URI the delegus.mcp() middleware derives
  // (`<endpoint>/tools/<name>`), method POST.
  mcpHeaders(req: { grant: string; endpoint: string; tool: string; rpDid: string; iat?: number; jti?: string; }): Promise<{ "Delegus-Grant": string; "Delegus-Proof": string; }>
  // New Agent with an in-memory Ed25519 key (dev default).
  static create(): Agent
}

ProofRequestinterface#

packages/sdk/src/agent.ts

interface ProofRequest {
  // The Grant compact JWS (its `id` is taken from it) or a bare Grant id.
  grant: string
  // The RP DID the Proof is for (`aud`).
  audience: string
  // The HTTP request the Agent is about to make.
  method: string
  url: string
  // The Action, built with `actions.*` from the same wire fields the RP will use.
  action: unknown
  // Override the clock (seconds since epoch); default now.
  iat?: number | undefined
  // Override the nonce (22–64 base64url chars); default 16 random bytes.
  jti?: string | undefined
}

Actions#

Helpers that build the action object the relying party describes.

actionsconst#

packages/sdk/src/actions.ts

const actions = {
  // `commerce:purchase`: amount in minor units (integer), ISO 4217 currency.
  purchase(fields: { resource: string; amount: number; currency: string; }): Action
  // `api:call`: uppercase HTTP method, absolute http(s) resource URI.
  apiCall(fields: { method: string; resource: string; }): Action
}

Keys and signers#

Where private keys live. The signer interface is pluggable: memory for development, KMS or an HSM in production.

MemorySignerclass#

packages/sdk/src/keys.ts

class MemorySigner {
  new (seed: Uint8Array): MemorySigner
  // Raw 32-byte Ed25519 public key.
  publicKey: Uint8Array<ArrayBufferLike>
  // PureEdDSA over exactly `data`; 64 bytes.
  sign(data: Uint8Array): Uint8Array
  toJwk(): Ed25519Jwk
  static generate(): MemorySigner
  static fromSeed(seed: Uint8Array): MemorySigner
  static fromJwk(jwk: unknown): MemorySigner
}

didKeyOffunction#

packages/sdk/src/keys.ts

function didKeyOf(s: Signer): string

publicKeyMultibasefunction#

packages/sdk/src/keys.ts

function publicKeyMultibase(s: Signer): string

Ed25519Jwkinterface#

packages/sdk/src/keys.ts

Ed25519 private key as a JWK (RFC 8037): the portable at-rest form.

interface Ed25519Jwk {
  kty: "OKP"
  crv: "Ed25519"
  x: string
  d: string
}

Signerinterface#

packages/sdk/src/keys.ts

interface Signer {
  // Raw 32-byte Ed25519 public key.
  publicKey: Uint8Array<ArrayBufferLike>
  // PureEdDSA over exactly `data`; 64 bytes.
  sign(data: Uint8Array): Uint8Array | Promise<Uint8Array>
}

Errors#

Everything the SDK throws.

DelegusApiErrorclass#

packages/sdk/src/errors.ts

A non-2xx answer from the Delegus API: { error, message } plus the HTTP status.

class DelegusApiError {
  new (status: number, code: string, message: string): DelegusApiError
  name: string
  status: number
  code: string
  message: string
  stack?: string | undefined
  cause?: unknown
}

DelegusErrorclass#

packages/sdk/src/errors.ts

class DelegusError {
  new (message?: string): DelegusError
  new (message?: string, options?: ErrorOptions): DelegusError
  name: string
  message: string
  stack?: string | undefined
  cause?: unknown
}

PlanRequiredErrorclass#

packages/sdk/src/errors.ts

HTTP 402 PLAN_REQUIRED: production checks need a plan for this account. Not a DENY: the check was refused before evaluation, no receipt was issued, and the Proof was not spent. Sandbox checks keep working.

class PlanRequiredError {
  new (status: number, code: string, message: string): PlanRequiredError
  name: string
  status: number
  code: string
  message: string
  stack?: string | undefined
  cause?: unknown
}

ProofBindingErrorclass#

packages/sdk/src/errors.ts

The Proof's htm/htu do not bind to the request the RP actually received (§4.3).

class ProofBindingError {
  new (expected: { method: string; url: string; }, proof: { htm: string; htu: string; }): ProofBindingError
  name: "ProofBindingError"
  expected: { method: string; url: string; }
  proof: { htm: string; htu: string; }
  message: string
  stack?: string | undefined
  cause?: unknown
}

Transport#

HTTP plumbing, replaceable for tests.

Transportclass#

packages/sdk/src/transport.ts

class Transport {
  new (opts: TransportOptions): Transport
  baseUrl: string
  json(method: string, path: string, opts?: { token?: string | null; body?: unknown; headers?: Record<string, string>; }): Promise<JsonValue>
  // A request whose body is text (NDJSON, CSV, plain); errors are the API's JSON errors.
  raw(method: string, path: string, opts?: { token?: string | null; }): Promise<{ status: number; text: string; headers: Headers; }>
  bytes(path: string): Promise<Uint8Array | null>
}

FetchLiketype#

packages/sdk/src/transport.ts

type FetchLike = (input: string, init: RequestInit) => Promise<Response>

Types from @delegus/core#

Re-exported so an integrator never needs to import core directly.

Receiptinterface#

packages/core/src/receipt.ts

interface Receipt {
  // Non-detached compact JWS over JCS(body).
  receipt: string
  receipt_version: "delegus-receipt-v1"
  receipt_id: string
  decision: Decision
  reason: ReasonCode | null
  evaluated_at: string
  relying_party: string
  principal?: { id: string; verification: "domain" | "unverified"; } | undefined
  agent?: string | undefined
  grant_id?: string | undefined
  grant_hash: `sha256:${string}`
  proof_hash: `sha256:${string}`
  request_hash?: `sha256:${string}` | undefined
  authority?: Capability | null | undefined
  expires_at?: string | undefined
  evidence: ReceiptEvidence
  protocol: { result: LayerResult; profile: ProfileId; profile_hash: Sha256Ref; checks: Record<string, CheckOutcome>; }
  trust: { result: LayerResult; policy_version: ProfileSpec["policy"]; checks: Record<string, CheckOutcome>; }
}

ReverifyResultinterface#

packages/core/src/receipt.ts

interface ReverifyResult {
  // Signature valid, every supplied artifact matches its pinned hash, and the protocol result is reproduced.
  ok: boolean
  signature: "valid" | "invalid"
  detail?: string | undefined
  hashes?: Record<"grant" | "proof" | "request" | "did_document" | "status_credential" | "profile" | "trust_config", HashComparison> | undefined
  // Whether `protocol`, `decision` and `reason` were reproduced, and what differed.
  reproduced?: { protocol: boolean; decision: boolean; differences: string[]; } | undefined
  receipt?: ReceiptBody | undefined
  recomputed?: ReceiptBody | undefined
}

TrustedKeystype#

packages/core/src/status.ts

Raw Ed25519 public keys by kid.

type TrustedKeys = { readonly [x: string]: Uint8Array<ArrayBufferLike>; }

The `delegus` CLI#

The same operations from a shell, for onboarding and for scripts. The text below is the binary's own help output, captured at build time.

delegus --help

Usage: delegus <command> [options]

  Delegus verifies an AI agent's delegated authority to act (spec v0.2).
  Every command prints one JSON object on stdout. Exit 0 on success
  (ALLOW), 1 on error, 2 when a decision is DENY or a receipt does not
  reverify.

Commands:
  conformance          Run the Delegus v0.2 conformance vectors (needs @delegus/conformance installed)
  doctor               Check the API, your key and its subject; the first thing to run on day one
  key list             List the API keys of your subject (ids and labels only)
  key create           Issue an additional API key for your subject (rotation step 1); the key is printed once
  key revoke           Revoke one of your subject's API keys by its id (rotation step 2, or a leaked key)
  keygen               Generate an Ed25519 key and write it as a private JWK (mode 0600)
  org init             Create an organization account (owns Principals and relying parties; holds dashboard keys) (admin token)
  org show             Show an organization and its members (org key or admin token)
  org add-member       Attach an existing Principal or relying party to an organization (admin token)
  org key-create       Issue an org key with role read or admin, printed once (org:admin key or admin token)
  org key-list         List an organization's keys (ids and labels only)
  org key-revoke       Revoke an organization key by its id (org:admin key or admin token)
  org create           Create a managed Principal at Delegus whose signing key is --key (admin token, or an org:admin key)
  org register         Register a customer-hosted Principal (did:web) and get its domain-verification instructions (admin token, or an org:admin key)
  org verify           Run domain verification for a Principal now and print its state (Principal key)
  rp create            Create a Relying Party, managed (--slug) or hosted (--did), and print its API key once (admin token, or an org:admin key)
  agent create         Generate an Agent key (did:key) and write it as a private JWK (mode 0600)
  agent register       Add an Agent to the Principal's inventory (Principal key)
  agent disable        Kill switch: revoke every Grant naming the Agent (Principal key)
  grant create         Issue a Grant: allocate its status entry at Delegus, sign it locally with --key (Principal key)
  grant revoke         Revoke a Grant; returns once every later /verify anywhere will deny it (Principal key)
  key retire           Retire a Principal signing key (rotation): existing Grants stay valid, new Grants must use an active key (Principal key)
  key compromise       Mark a Principal key compromised: every Grant it signed denies immediately (Principal key)
  proof sign           Sign a Proof with an Agent key, binding one Grant, one RP and one request
  verify               POST /verify as a Relying Party; prints the signed Receipt, exit 0 for ALLOW and 2 for DENY (RP key)
  outcome report       Append an Outcome Attestation to a decision (RP key, the RP in the receipt)
  decision get         Fetch a decision: its receipt and outcome ledger (RP key, the RP in the receipt)
  principal list       Principal directory: who is registered and verified, since when, with which keys (any key)
  principal show       One Principal from the directory (full record for its own key, its org or admin)
  decision list        List decisions newest first (RP key: own; org key: the org's relying parties; admin: any)
  decision export      Export decisions with full receipts and outcome ledgers (NDJSON to stdout, or --csv); follows cursors until done or --limit rows
  decision stats       Decisions and outcomes rolled up per Principal over a range (default last 30 days)
  receipt verify       Reverify a receipt offline-style: signature, pinned hashes and the reproduced protocol result (no key needed)
  receipt inclusion    Prove a receipt is in its day's signed Merkle checkpoint (audit path to the root, root signature from the DID document; no key needed)
  checkpoint verify    Third-party check of a day's checkpoint: recompute the Merkle root from the published leaves and verify the signature (no key needed)
  checkpoint contains  Check that receipt ids (from `delegus decision list` or your logs) are leaves of a day's checkpoint
  action purchase      Print the canonical commerce:purchase Action for these wire fields
  action api-call      Print the canonical api:call Action for these wire fields

Global options:
  --api-url <url>        API origin (env DELEGUS_API_URL; default https://api.delegus.ai)
  --api-key <key>        RP or Principal API key (env DELEGUS_API_KEY)
  --admin-token <token>  Delegus admin token for onboarding (env DELEGUS_ADMIN_TOKEN)
  --json-compact         Print the result on one line
  --help, -h             Show help

Environment: DELEGUS_API_URL, DELEGUS_API_KEY, DELEGUS_ADMIN_TOKEN; the flags above override them.
Key files are Ed25519 private JWKs (kty OKP, crv Ed25519, x, d) written with mode 0600.
Arguments shown as <jws|file> or <json|file> take the value itself or the path of a file holding it.

Run 'delegus <command> --help' for the options of one command.

`delegus conformance`#

delegus conformance --help

Usage: delegus conformance [--impl <module>] [--only <id,id>] [--dir <path>]

  Run the Delegus v0.2 conformance vectors (needs @delegus/conformance installed).

Options:
  --impl <module>  Module exporting an Implementation to test instead of @delegus/core
  --only <id,id>   Run only these vector ids
  --dir <path>     A cases/ + sets/ directory other than the shipped vectors

Global options:
  --api-url <url>        API origin (env DELEGUS_API_URL; default https://api.delegus.ai)
  --api-key <key>        RP or Principal API key (env DELEGUS_API_KEY)
  --admin-token <token>  Delegus admin token for onboarding (env DELEGUS_ADMIN_TOKEN)
  --json-compact         Print the result on one line
  --help, -h             Show help

`delegus doctor`#

delegus doctor --help

Usage: delegus doctor

  Check the API, your key and its subject; the first thing to run on day one.

Options:

Global options:
  --api-url <url>        API origin (env DELEGUS_API_URL; default https://api.delegus.ai)
  --api-key <key>        RP or Principal API key (env DELEGUS_API_KEY)
  --admin-token <token>  Delegus admin token for onboarding (env DELEGUS_ADMIN_TOKEN)
  --json-compact         Print the result on one line
  --help, -h             Show help

`delegus key list`#

delegus key list --help

Usage: delegus key list

  List the API keys of your subject (ids and labels only).

Options:

Global options:
  --api-url <url>        API origin (env DELEGUS_API_URL; default https://api.delegus.ai)
  --api-key <key>        RP or Principal API key (env DELEGUS_API_KEY)
  --admin-token <token>  Delegus admin token for onboarding (env DELEGUS_ADMIN_TOKEN)
  --json-compact         Print the result on one line
  --help, -h             Show help

`delegus key create`#

delegus key create --help

Usage: delegus key create [--label <label>]

  Issue an additional API key for your subject (rotation step 1); the key is printed once.

Options:
  --label <label>  A label for the new key

Global options:
  --api-url <url>        API origin (env DELEGUS_API_URL; default https://api.delegus.ai)
  --api-key <key>        RP or Principal API key (env DELEGUS_API_KEY)
  --admin-token <token>  Delegus admin token for onboarding (env DELEGUS_ADMIN_TOKEN)
  --json-compact         Print the result on one line
  --help, -h             Show help

`delegus key revoke`#

delegus key revoke --help

Usage: delegus key revoke --id <key_id>

  Revoke one of your subject's API keys by its id (rotation step 2, or a leaked key).

Options:
  --id <key_id>  The key id from `delegus key list`

Global options:
  --api-url <url>        API origin (env DELEGUS_API_URL; default https://api.delegus.ai)
  --api-key <key>        RP or Principal API key (env DELEGUS_API_KEY)
  --admin-token <token>  Delegus admin token for onboarding (env DELEGUS_ADMIN_TOKEN)
  --json-compact         Print the result on one line
  --help, -h             Show help

`delegus keygen`#

delegus keygen --help

Usage: delegus keygen --out <file> [--force]

  Generate an Ed25519 key and write it as a private JWK (mode 0600).

Options:
  --out <file>  File to write the JWK to
  --force       Overwrite an existing file

Global options:
  --api-url <url>        API origin (env DELEGUS_API_URL; default https://api.delegus.ai)
  --api-key <key>        RP or Principal API key (env DELEGUS_API_KEY)
  --admin-token <token>  Delegus admin token for onboarding (env DELEGUS_ADMIN_TOKEN)
  --json-compact         Print the result on one line
  --help, -h             Show help

`delegus org init`#

delegus org init --help

Usage: delegus org init --slug <slug> --name <name>

  Create an organization account (owns Principals and relying parties; holds dashboard keys) (admin token).

Options:
  --slug <slug>  Account slug (lowercase DNS label)
  --name <name>  Display name

Global options:
  --api-url <url>        API origin (env DELEGUS_API_URL; default https://api.delegus.ai)
  --api-key <key>        RP or Principal API key (env DELEGUS_API_KEY)
  --admin-token <token>  Delegus admin token for onboarding (env DELEGUS_ADMIN_TOKEN)
  --json-compact         Print the result on one line
  --help, -h             Show help

`delegus org show`#

delegus org show --help

Usage: delegus org show --id <org_id>

  Show an organization and its members (org key or admin token).

Options:
  --id <org_id>  The org id from `delegus org init`

Global options:
  --api-url <url>        API origin (env DELEGUS_API_URL; default https://api.delegus.ai)
  --api-key <key>        RP or Principal API key (env DELEGUS_API_KEY)
  --admin-token <token>  Delegus admin token for onboarding (env DELEGUS_ADMIN_TOKEN)
  --json-compact         Print the result on one line
  --help, -h             Show help

`delegus org add-member`#

delegus org add-member --help

Usage: delegus org add-member --id <org_id> --did <did:web>

  Attach an existing Principal or relying party to an organization (admin token).

Options:
  --id <org_id>    The org id
  --did <did:web>  The Principal's or relying party's DID

Global options:
  --api-url <url>        API origin (env DELEGUS_API_URL; default https://api.delegus.ai)
  --api-key <key>        RP or Principal API key (env DELEGUS_API_KEY)
  --admin-token <token>  Delegus admin token for onboarding (env DELEGUS_ADMIN_TOKEN)
  --json-compact         Print the result on one line
  --help, -h             Show help

`delegus org key-create`#

delegus org key-create --help

Usage: delegus org key-create --id <org_id> --role <read|admin> [--label <label>]

  Issue an org key with role read or admin, printed once (org:admin key or admin token).

Options:
  --id <org_id>        The org id
  --role <read|admin>  read: every GET about the org; admin: also onboarding, keys, revocation
  --label <label>      A label for the key

Global options:
  --api-url <url>        API origin (env DELEGUS_API_URL; default https://api.delegus.ai)
  --api-key <key>        RP or Principal API key (env DELEGUS_API_KEY)
  --admin-token <token>  Delegus admin token for onboarding (env DELEGUS_ADMIN_TOKEN)
  --json-compact         Print the result on one line
  --help, -h             Show help

`delegus org key-list`#

delegus org key-list --help

Usage: delegus org key-list --id <org_id>

  List an organization's keys (ids and labels only).

Options:
  --id <org_id>  The org id

Global options:
  --api-url <url>        API origin (env DELEGUS_API_URL; default https://api.delegus.ai)
  --api-key <key>        RP or Principal API key (env DELEGUS_API_KEY)
  --admin-token <token>  Delegus admin token for onboarding (env DELEGUS_ADMIN_TOKEN)
  --json-compact         Print the result on one line
  --help, -h             Show help

`delegus org key-revoke`#

delegus org key-revoke --help

Usage: delegus org key-revoke --id <org_id> --key-id <key_id>

  Revoke an organization key by its id (org:admin key or admin token).

Options:
  --id <org_id>      The org id
  --key-id <key_id>  The key id from `delegus org key-list`

Global options:
  --api-url <url>        API origin (env DELEGUS_API_URL; default https://api.delegus.ai)
  --api-key <key>        RP or Principal API key (env DELEGUS_API_KEY)
  --admin-token <token>  Delegus admin token for onboarding (env DELEGUS_ADMIN_TOKEN)
  --json-compact         Print the result on one line
  --help, -h             Show help

`delegus org create`#

delegus org create --help

Usage: delegus org create --slug <slug> --key <file> [--key-id <id>] [--org <org_id>]

  Create a managed Principal at Delegus whose signing key is --key (admin token, or an org:admin key).

Options:
  --slug <slug>   Principal slug (DID did:web:<domain>:org:<slug>)
  --key <file>    Principal key file from `delegus keygen`
  --key-id <id>   Key id fragment (default key-1)
  --org <org_id>  Attach to this organization (admin token; an org:admin key always uses its own)

Global options:
  --api-url <url>        API origin (env DELEGUS_API_URL; default https://api.delegus.ai)
  --api-key <key>        RP or Principal API key (env DELEGUS_API_KEY)
  --admin-token <token>  Delegus admin token for onboarding (env DELEGUS_ADMIN_TOKEN)
  --json-compact         Print the result on one line
  --help, -h             Show help

`delegus org register`#

delegus org register --help

Usage: delegus org register --did <did:web> [--org <org_id>]

  Register a customer-hosted Principal (did:web) and get its domain-verification instructions (admin token, or an org:admin key).

Options:
  --did <did:web>  The Principal's DID
  --org <org_id>   Attach to this organization (admin token)

Global options:
  --api-url <url>        API origin (env DELEGUS_API_URL; default https://api.delegus.ai)
  --api-key <key>        RP or Principal API key (env DELEGUS_API_KEY)
  --admin-token <token>  Delegus admin token for onboarding (env DELEGUS_ADMIN_TOKEN)
  --json-compact         Print the result on one line
  --help, -h             Show help

`delegus org verify`#

delegus org verify --help

Usage: delegus org verify --did <did:web>

  Run domain verification for a Principal now and print its state (Principal key).

Options:
  --did <did:web>  The Principal's DID

Global options:
  --api-url <url>        API origin (env DELEGUS_API_URL; default https://api.delegus.ai)
  --api-key <key>        RP or Principal API key (env DELEGUS_API_KEY)
  --admin-token <token>  Delegus admin token for onboarding (env DELEGUS_ADMIN_TOKEN)
  --json-compact         Print the result on one line
  --help, -h             Show help

`delegus rp create`#

delegus rp create --help

Usage: delegus rp create [--slug <slug>] [--did <did:web>] [--name <name>] [--proof-window <seconds>] [--org <org_id>]

  Create a Relying Party, managed (--slug) or hosted (--did), and print its API key once (admin token, or an org:admin key).

Options:
  --slug <slug>             Managed RP slug (exactly one of --slug, --did)
  --did <did:web>           Hosted RP DID (exactly one of --slug, --did)
  --name <name>             Display name
  --proof-window <seconds>  Proof freshness window
  --org <org_id>            Attach to this organization (admin token; an org:admin key always uses its own)

Global options:
  --api-url <url>        API origin (env DELEGUS_API_URL; default https://api.delegus.ai)
  --api-key <key>        RP or Principal API key (env DELEGUS_API_KEY)
  --admin-token <token>  Delegus admin token for onboarding (env DELEGUS_ADMIN_TOKEN)
  --json-compact         Print the result on one line
  --help, -h             Show help

`delegus agent create`#

delegus agent create --help

Usage: delegus agent create --out <file> [--force]

  Generate an Agent key (did:key) and write it as a private JWK (mode 0600).

Options:
  --out <file>  File to write the JWK to
  --force       Overwrite an existing file

Global options:
  --api-url <url>        API origin (env DELEGUS_API_URL; default https://api.delegus.ai)
  --api-key <key>        RP or Principal API key (env DELEGUS_API_KEY)
  --admin-token <token>  Delegus admin token for onboarding (env DELEGUS_ADMIN_TOKEN)
  --json-compact         Print the result on one line
  --help, -h             Show help

`delegus agent register`#

delegus agent register --help

Usage: delegus agent register --principal <did:web> --did <did:key>

  Add an Agent to the Principal's inventory (Principal key).

Options:
  --principal <did:web>  The Principal's DID (did:web)
  --did <did:key>        The Agent's DID

Global options:
  --api-url <url>        API origin (env DELEGUS_API_URL; default https://api.delegus.ai)
  --api-key <key>        RP or Principal API key (env DELEGUS_API_KEY)
  --admin-token <token>  Delegus admin token for onboarding (env DELEGUS_ADMIN_TOKEN)
  --json-compact         Print the result on one line
  --help, -h             Show help

`delegus agent disable`#

delegus agent disable --help

Usage: delegus agent disable --principal <did:web> --did <did:key>

  Kill switch: revoke every Grant naming the Agent (Principal key).

Options:
  --principal <did:web>  The Principal's DID (did:web)
  --did <did:key>        The Agent's DID

Global options:
  --api-url <url>        API origin (env DELEGUS_API_URL; default https://api.delegus.ai)
  --api-key <key>        RP or Principal API key (env DELEGUS_API_KEY)
  --admin-token <token>  Delegus admin token for onboarding (env DELEGUS_ADMIN_TOKEN)
  --json-compact         Print the result on one line
  --help, -h             Show help

`delegus grant create`#

delegus grant create --help

Usage: delegus grant create --principal <did:web> --key <file> --kid <kid> --agent <did:key> --authority <json|file> [--valid-from <iso>] [--valid-until <iso>] [--audience <did,did>]

  Issue a Grant: allocate its status entry at Delegus, sign it locally with --key (Principal key).

Options:
  --principal <did:web>    The Principal's DID (did:web)
  --key <file>             Principal key file
  --kid <kid>              Verification method of --key in the Principal's DID document (did:web:…#key-n)
  --agent <did:key>        The Agent the Grant is for
  --authority <json|file>  JSON array of capabilities: [{action, constraints, resources?}]
  --valid-from <iso>       RFC 3339 UTC, whole seconds (default now)
  --valid-until <iso>      RFC 3339 UTC, whole seconds (default validFrom + 30 days; at most 90)
  --audience <did,did>     Comma-separated RP DIDs (default any registered RP)

Global options:
  --api-url <url>        API origin (env DELEGUS_API_URL; default https://api.delegus.ai)
  --api-key <key>        RP or Principal API key (env DELEGUS_API_KEY)
  --admin-token <token>  Delegus admin token for onboarding (env DELEGUS_ADMIN_TOKEN)
  --json-compact         Print the result on one line
  --help, -h             Show help

`delegus grant revoke`#

delegus grant revoke --help

Usage: delegus grant revoke --principal <did:web> --id <urn:delegus:grant:…>

  Revoke a Grant; returns once every later /verify anywhere will deny it (Principal key).

Options:
  --principal <did:web>       The Principal's DID (did:web)
  --id <urn:delegus:grant:…>  The Grant id

Global options:
  --api-url <url>        API origin (env DELEGUS_API_URL; default https://api.delegus.ai)
  --api-key <key>        RP or Principal API key (env DELEGUS_API_KEY)
  --admin-token <token>  Delegus admin token for onboarding (env DELEGUS_ADMIN_TOKEN)
  --json-compact         Print the result on one line
  --help, -h             Show help

`delegus key retire`#

delegus key retire --help

Usage: delegus key retire --principal <did:web> --kid <kid>

  Retire a Principal signing key (rotation): existing Grants stay valid, new Grants must use an active key (Principal key).

Options:
  --principal <did:web>  Your Principal DID
  --kid <kid>            The key's DID URL

Global options:
  --api-url <url>        API origin (env DELEGUS_API_URL; default https://api.delegus.ai)
  --api-key <key>        RP or Principal API key (env DELEGUS_API_KEY)
  --admin-token <token>  Delegus admin token for onboarding (env DELEGUS_ADMIN_TOKEN)
  --json-compact         Print the result on one line
  --help, -h             Show help

`delegus key compromise`#

delegus key compromise --help

Usage: delegus key compromise --principal <did:web> --kid <kid>

  Mark a Principal key compromised: every Grant it signed denies immediately (Principal key).

Options:
  --principal <did:web>  The Principal's DID (did:web)
  --kid <kid>            The compromised key (did:web:…#key-n)

Global options:
  --api-url <url>        API origin (env DELEGUS_API_URL; default https://api.delegus.ai)
  --api-key <key>        RP or Principal API key (env DELEGUS_API_KEY)
  --admin-token <token>  Delegus admin token for onboarding (env DELEGUS_ADMIN_TOKEN)
  --json-compact         Print the result on one line
  --help, -h             Show help

`delegus proof sign`#

delegus proof sign --help

Usage: delegus proof sign --key <file> --grant <jws|file|id> --rp <did:web> --method <M> --url <url> --action <json|file> [--iat <seconds>] [--jti <nonce>]

  Sign a Proof with an Agent key, binding one Grant, one RP and one request.

Options:
  --key <file>           Agent key file
  --grant <jws|file|id>  The Grant JWS, a file holding it, or a bare Grant id
  --rp <did:web>         The Relying Party the Proof is for (aud)
  --method <M>           HTTP method of the request
  --url <url>            Absolute http(s) URL of the request
  --action <json|file>   The Action (see `delegus action …`)
  --iat <seconds>        Issued-at override, seconds since the epoch (default now)
  --jti <nonce>          Nonce override, 22–64 base64url chars (default 16 random bytes)

Global options:
  --api-url <url>        API origin (env DELEGUS_API_URL; default https://api.delegus.ai)
  --api-key <key>        RP or Principal API key (env DELEGUS_API_KEY)
  --admin-token <token>  Delegus admin token for onboarding (env DELEGUS_ADMIN_TOKEN)
  --json-compact         Print the result on one line
  --help, -h             Show help

`delegus verify`#

delegus verify --help

Usage: delegus verify --grant <jws|file> --proof <jws|file> --action <json|file> [--method <M>] [--url <url>]

  POST /verify as a Relying Party; prints the signed Receipt, exit 0 for ALLOW and 2 for DENY (RP key).

Options:
  --grant <jws|file>    The Grant the Agent presented
  --proof <jws|file>    The Proof the Agent presented
  --action <json|file>  The Action built from the request
  --method <M>          With --url: check the Proof binds to this request before calling Delegus
  --url <url>           With --method: the URL the request arrived at

Global options:
  --api-url <url>        API origin (env DELEGUS_API_URL; default https://api.delegus.ai)
  --api-key <key>        RP or Principal API key (env DELEGUS_API_KEY)
  --admin-token <token>  Delegus admin token for onboarding (env DELEGUS_ADMIN_TOKEN)
  --json-compact         Print the result on one line
  --help, -h             Show help

`delegus outcome report`#

delegus outcome report --help

Usage: delegus outcome report --receipt <drc_…> --type <type> [--occurred-at <iso>] [--note <text>] [--evidence-ref <ref>] [--resolution <r>] [--loss-amount <int>] [--currency <CCY>] [--correction-of <id>]

  Append an Outcome Attestation to a decision (RP key, the RP in the receipt).

Options:
  --receipt <drc_…>     The receipt id
  --type <type>         One of fulfilled, cancelled, dispute_opened, dispute_resolved, chargeback_received, chargeback_reversed, loss_reported
  --occurred-at <iso>   RFC 3339 UTC (default now)
  --note <text>         Free-text note
  --evidence-ref <ref>  Reference to the reporter's evidence
  --resolution <r>      One of agent_at_fault, agent_not_at_fault, indeterminate
  --loss-amount <int>   Loss in minor units
  --currency <CCY>      ISO 4217 currency of --loss-amount
  --correction-of <id>  The attestation this one corrects

Global options:
  --api-url <url>        API origin (env DELEGUS_API_URL; default https://api.delegus.ai)
  --api-key <key>        RP or Principal API key (env DELEGUS_API_KEY)
  --admin-token <token>  Delegus admin token for onboarding (env DELEGUS_ADMIN_TOKEN)
  --json-compact         Print the result on one line
  --help, -h             Show help

`delegus decision get`#

delegus decision get --help

Usage: delegus decision get --receipt <drc_…>

  Fetch a decision: its receipt and outcome ledger (RP key, the RP in the receipt).

Options:
  --receipt <drc_…>  The receipt id

Global options:
  --api-url <url>        API origin (env DELEGUS_API_URL; default https://api.delegus.ai)
  --api-key <key>        RP or Principal API key (env DELEGUS_API_KEY)
  --admin-token <token>  Delegus admin token for onboarding (env DELEGUS_ADMIN_TOKEN)
  --json-compact         Print the result on one line
  --help, -h             Show help

`delegus principal list`#

delegus principal list --help

Usage: delegus principal list [--kind <managed|hosted>] [--state <verified|unverified>] [--limit <n>] [--cursor <did>]

  Principal directory: who is registered and verified, since when, with which keys (any key).

Options:
  --kind <managed|hosted>        Filter
  --state <verified|unverified>  Filter
  --limit <n>                    Page size (≤ 200)
  --cursor <did>                 next_cursor from the previous page

Global options:
  --api-url <url>        API origin (env DELEGUS_API_URL; default https://api.delegus.ai)
  --api-key <key>        RP or Principal API key (env DELEGUS_API_KEY)
  --admin-token <token>  Delegus admin token for onboarding (env DELEGUS_ADMIN_TOKEN)
  --json-compact         Print the result on one line
  --help, -h             Show help

`delegus principal show`#

delegus principal show --help

Usage: delegus principal show --did <did:web>

  One Principal from the directory (full record for its own key, its org or admin).

Options:
  --did <did:web>  The Principal's DID (did:web)

Global options:
  --api-url <url>        API origin (env DELEGUS_API_URL; default https://api.delegus.ai)
  --api-key <key>        RP or Principal API key (env DELEGUS_API_KEY)
  --admin-token <token>  Delegus admin token for onboarding (env DELEGUS_ADMIN_TOKEN)
  --json-compact         Print the result on one line
  --help, -h             Show help

`delegus decision list`#

delegus decision list --help

Usage: delegus decision list [--rp <did:web>] [--decision <ALLOW|DENY>] [--reason <code>] [--since <iso>] [--until <iso>] [--limit <n>] [--cursor <receipt_id>]

  List decisions newest first (RP key: own; org key: the org's relying parties; admin: any).

Options:
  --rp <did:web>           One relying party
  --decision <ALLOW|DENY>  Filter
  --reason <code>          DENY reason filter
  --since <iso>            evaluated_at ≥
  --until <iso>            evaluated_at <
  --limit <n>              Page size (≤ 200)
  --cursor <receipt_id>    next_cursor from the previous page

Global options:
  --api-url <url>        API origin (env DELEGUS_API_URL; default https://api.delegus.ai)
  --api-key <key>        RP or Principal API key (env DELEGUS_API_KEY)
  --admin-token <token>  Delegus admin token for onboarding (env DELEGUS_ADMIN_TOKEN)
  --json-compact         Print the result on one line
  --help, -h             Show help

`delegus decision export`#

delegus decision export --help

Usage: delegus decision export [--rp <did:web>] [--since <iso>] [--until <iso>] [--decision <ALLOW|DENY>] [--csv] [--limit <n>]

  Export decisions with full receipts and outcome ledgers (NDJSON to stdout, or --csv); follows cursors until done or --limit rows.

Options:
  --rp <did:web>           One relying party
  --since <iso>            evaluated_at ≥
  --until <iso>            evaluated_at <
  --decision <ALLOW|DENY>  Filter
  --csv                    CSV instead of NDJSON (one API page of up to 5000 rows)
  --limit <n>              Stop after this many rows (NDJSON)

Global options:
  --api-url <url>        API origin (env DELEGUS_API_URL; default https://api.delegus.ai)
  --api-key <key>        RP or Principal API key (env DELEGUS_API_KEY)
  --admin-token <token>  Delegus admin token for onboarding (env DELEGUS_ADMIN_TOKEN)
  --json-compact         Print the result on one line
  --help, -h             Show help

`delegus decision stats`#

delegus decision stats --help

Usage: delegus decision stats [--rp <did:web>] [--principal <did:web>] [--since <iso>] [--until <iso>]

  Decisions and outcomes rolled up per Principal over a range (default last 30 days).

Options:
  --rp <did:web>         One relying party
  --principal <did:web>  One Principal
  --since <iso>          inclusive
  --until <iso>          exclusive

Global options:
  --api-url <url>        API origin (env DELEGUS_API_URL; default https://api.delegus.ai)
  --api-key <key>        RP or Principal API key (env DELEGUS_API_KEY)
  --admin-token <token>  Delegus admin token for onboarding (env DELEGUS_ADMIN_TOKEN)
  --json-compact         Print the result on one line
  --help, -h             Show help

`delegus receipt verify`#

delegus receipt verify --help

Usage: delegus receipt verify --receipt <json|jws|file> --grant <jws|file> --proof <jws|file> --action <json|file> [--proof-window <seconds>]

  Reverify a receipt offline-style: signature, pinned hashes and the reproduced protocol result (no key needed).

Options:
  --receipt <json|jws|file>  The receipt JSON as printed by `delegus verify`, or its JWS
  --grant <jws|file>         The Grant the RP presented
  --proof <jws|file>         The Proof the RP presented
  --action <json|file>       The Action the RP presented
  --proof-window <seconds>   The RP's Proof window at the time (default 60)

Global options:
  --api-url <url>        API origin (env DELEGUS_API_URL; default https://api.delegus.ai)
  --api-key <key>        RP or Principal API key (env DELEGUS_API_KEY)
  --admin-token <token>  Delegus admin token for onboarding (env DELEGUS_ADMIN_TOKEN)
  --json-compact         Print the result on one line
  --help, -h             Show help

`delegus receipt inclusion`#

delegus receipt inclusion --help

Usage: delegus receipt inclusion --id <drc_…>

  Prove a receipt is in its day's signed Merkle checkpoint (audit path to the root, root signature from the DID document; no key needed).

Options:
  --id <drc_…>  The receipt id

Global options:
  --api-url <url>        API origin (env DELEGUS_API_URL; default https://api.delegus.ai)
  --api-key <key>        RP or Principal API key (env DELEGUS_API_KEY)
  --admin-token <token>  Delegus admin token for onboarding (env DELEGUS_ADMIN_TOKEN)
  --json-compact         Print the result on one line
  --help, -h             Show help

`delegus checkpoint verify`#

delegus checkpoint verify --help

Usage: delegus checkpoint verify [--day <YYYY-MM-DD>]

  Third-party check of a day's checkpoint: recompute the Merkle root from the published leaves and verify the signature (no key needed).

Options:
  --day <YYYY-MM-DD>  UTC day (default: the latest closed day)

Global options:
  --api-url <url>        API origin (env DELEGUS_API_URL; default https://api.delegus.ai)
  --api-key <key>        RP or Principal API key (env DELEGUS_API_KEY)
  --admin-token <token>  Delegus admin token for onboarding (env DELEGUS_ADMIN_TOKEN)
  --json-compact         Print the result on one line
  --help, -h             Show help

`delegus checkpoint contains`#

delegus checkpoint contains --help

Usage: delegus checkpoint contains --day <YYYY-MM-DD> --ids <id,id|file>

  Check that receipt ids (from `delegus decision list` or your logs) are leaves of a day's checkpoint.

Options:
  --day <YYYY-MM-DD>  UTC day
  --ids <id,id|file>  Comma-separated receipt ids, or a file with one per line

Global options:
  --api-url <url>        API origin (env DELEGUS_API_URL; default https://api.delegus.ai)
  --api-key <key>        RP or Principal API key (env DELEGUS_API_KEY)
  --admin-token <token>  Delegus admin token for onboarding (env DELEGUS_ADMIN_TOKEN)
  --json-compact         Print the result on one line
  --help, -h             Show help

`delegus action purchase`#

delegus action purchase --help

Usage: delegus action purchase --resource <r> --amount <int> --currency <CCY>

  Print the canonical commerce:purchase Action for these wire fields.

Options:
  --resource <r>    What is bought
  --amount <int>    Amount in minor units
  --currency <CCY>  ISO 4217 currency

Global options:
  --api-url <url>        API origin (env DELEGUS_API_URL; default https://api.delegus.ai)
  --api-key <key>        RP or Principal API key (env DELEGUS_API_KEY)
  --admin-token <token>  Delegus admin token for onboarding (env DELEGUS_ADMIN_TOKEN)
  --json-compact         Print the result on one line
  --help, -h             Show help

`delegus action api-call`#

delegus action api-call --help

Usage: delegus action api-call --method <M> --resource <url>

  Print the canonical api:call Action for these wire fields.

Options:
  --method <M>      HTTP method (uppercased)
  --resource <url>  Absolute http(s) resource URI

Global options:
  --api-url <url>        API origin (env DELEGUS_API_URL; default https://api.delegus.ai)
  --api-key <key>        RP or Principal API key (env DELEGUS_API_KEY)
  --admin-token <token>  Delegus admin token for onboarding (env DELEGUS_ADMIN_TOKEN)
  --json-compact         Print the result on one line
  --help, -h             Show help

Client#

Delegusclass#

PRODUCTION_APIconst#

PRODUCTION_SERVICE_DIDconst#

CreatedOrginterface#

DelegusOptionsinterface#

Entitlementinterface#

EntitlementRequestinterface#

ListOptionsinterface#

Orginterface#

OutcomeEventinterface#

Pageinterface#

SelfServeBundleinterface#

SelfServeStarterinterface#

VerifyRequestinterface#

Principal#

Principalclass#

Capabilityinterface#

GrantRequestinterface#

IssuedGrantinterface#

PrincipalOptionsinterface#

Agent#

Agentclass#

ProofRequestinterface#

Actions#

actionsconst#

Keys and signers#

MemorySignerclass#

didKeyOffunction#

publicKeyMultibasefunction#

Ed25519Jwkinterface#

Signerinterface#

Errors#

DelegusApiErrorclass#

DelegusErrorclass#

PlanRequiredErrorclass#

ProofBindingErrorclass#

Transport#

Transportclass#

FetchLiketype#

Types from @delegus/core#

Receiptinterface#

ReverifyResultinterface#

TrustedKeystype#

The delegus CLI#

delegus conformance#

delegus doctor#

delegus key list#

delegus key create#

delegus key revoke#

delegus keygen#

delegus org init#

delegus org show#

delegus org add-member#

delegus org key-create#

delegus org key-list#

delegus org key-revoke#

delegus org create#

delegus org register#

delegus org verify#

delegus rp create#

delegus agent create#

delegus agent register#

delegus agent disable#

delegus grant create#

delegus grant revoke#

delegus key retire#

delegus key compromise#

delegus proof sign#

delegus verify#

delegus outcome report#

delegus decision get#

delegus principal list#

delegus principal show#

delegus decision list#

delegus decision export#

delegus decision stats#

delegus receipt verify#

delegus receipt inclusion#

The `delegus` CLI#

`delegus conformance`#

`delegus doctor`#

`delegus key list`#

`delegus key create`#

`delegus key revoke`#

`delegus keygen`#

`delegus org init`#

`delegus org show`#

`delegus org add-member`#

`delegus org key-create`#

`delegus org key-list`#

`delegus org key-revoke`#

`delegus org create`#

`delegus org register`#

`delegus org verify`#

`delegus rp create`#

`delegus agent create`#

`delegus agent register`#

`delegus agent disable`#

`delegus grant create`#

`delegus grant revoke`#

`delegus key retire`#

`delegus key compromise`#

`delegus proof sign`#

`delegus verify`#

`delegus outcome report`#

`delegus decision get`#

`delegus principal list`#

`delegus principal show`#

`delegus decision list`#

`delegus decision export`#

`delegus decision stats`#

`delegus receipt verify`#

`delegus receipt inclusion`#

`delegus checkpoint verify`#

`delegus checkpoint contains`#

`delegus action purchase`#

`delegus action api-call`#