DEVELOPER PLANE · API VERSION V1

Released intelligence, with its proof attached.

REST, signed webhooks, TypeScript, and read-only MCP share one trust contract.

LIVE CONTRACT

API VERSIONv1

AUTHBearer

MAX PAGE50

MCP POLICYRead only

01 · REST QUICK STARTfacts:read

Fetch verified current facts

API keys are shown once. Kevlar stores only a SHA-256 hash and visible prefix.

curl "https://kevlar-web.vercel.app/api/v1/facts?entity_id=qs79dceshc71enmf9q6pr6r1q18cyeqb" \
  -H "Authorization: Bearer kv_live_..."

02 · TYPESCRIPT SDK@kevlar/sdk

Parse the exact public schema

The SDK validates every response against the same Zod contract used by the API.

import { KevlarClient } from "@kevlar/sdk";

const kevlar = new KevlarClient({
  baseUrl: "https://kevlar-web.vercel.app/api",
  apiKey: process.env.KEVLAR_API_KEY!,
});

const page = await kevlar.currentFacts("qs79dceshc71enmf9q6pr6r1q18cyeqb");

03 · SIGNED WEBHOOKSHMAC-SHA256

Verify the raw request body

Reject stale timestamps, deduplicate event IDs, and process corrections idempotently.

verifyWebhook({
  payload: rawRequestBody,
  secret: process.env.KEVLAR_WEBHOOK_SECRET!,
  signature: request.headers.get("kevlar-signature")!,
});

04 · MCPEvidence required

Ground agents in released facts

Tools cannot scrape arbitrary pages, reveal secrets, approve repairs, or bypass release policy.

kevlar_current_facts({ entity_id: "..." })
kevlar_fact_history({ entity_id: "...", predicate: "..." })

TRUST FIELDS ON EVERY FACT

State · freshness · sources · evidence · certificate

Quarantined candidates are never returned as normal current facts. Last-known-good and stale results keep their labels.