AI Safety & Agents Tier 2 Ready POST /v1/agent-action-receipts/issue

AI Agent Audit Log & Signed Action Receipts API — Tamper-Evident Provenance

Issue and verify tamper-evident HMAC-signed receipts for autonomous AI agent actions. Issue and verify HMAC-SHA256 signed, hash-chained receipts for autonomous AI agent tool calls, approvals, and state mutations.

Additional endpoints in this module: POST /v1/agent-action-receipts/verify

Try It Live in Your Browser · No API Key Required

1. Interactive Sandbox & Sample JSON Output

200 OK · Ready

Editable Request JSON (`POST /v1/agent-action-receipts/issue`)

Live 200 OK Response Envelope

{
  "ok": true,
  "data": {
    "receipt_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkFBUiIsImtpZCI6InYxIn0.eyJ2ZXIiOjEsImp0aSI6ImFhcl82N2M0NjE5ZjdhZjlmN2MxM2Y1ZjgyYmYiLCJpYXQiOjE3OTQ2Nzc5NzcsImV4cCI6bnVsbCwiYWdlbnRfaWQiOiJiaWxsaW5nLWFnZW50LXByb2QiLCJzZXNzaW9uX2lkIjpudWxsLCJ0b29sX25hbWUiOiJzdHJpcGVfcmVmdW5kIiwicG9saWN5X2RlY2lzaW9uIjoiYWxsb3ciLCJpbnB1dF9zaGEyNTYiOiI3NDIzNGU5OGFmZTc0OThmYjVkYWYxZjM2YWMyZDc4YWNjMzM5NDY0Zjk1MDcwM2I4YzAxOTg5MmY5ODJiOTBiIiwib3V0cHV0X3NoYTI1NiI6bnVsbCwicHJldl9oYXNoIjoiZ2VuZXNpcyJ9.aiCMzxg2SK0naMc5COCKuP4Bm711mF1JOU9ufhPqGBA",
    "receipt_hash": "34cfe90866cdbe3baff3334bfb3843856f46799ae6bbb19d91c9490ee4b197dc",
    "kid": "v1",
    "issued_at": "2026-11-14T17:39:37.000Z",
    "expires_at": null,
    "payload": {
      "ver": 1,
      "jti": "aar_67c4619f7af9f7c13f5f82bf",
      "iat": 1794677977,
      "exp": null,
      "agent_id": "billing-agent-prod",
      "session_id": null,
      "tool_name": "stripe_refund",
      "policy_decision": "allow",
      "input_sha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b",
      "output_sha256": null,
      "prev_hash": "genesis"
    }
  },
  "meta": {
    "request_id": "req_aar_01",
    "ms": 1
  }
}

Get API Key on RapidAPI Get API Key on Zyla Hub Download OpenAPI 3.0.3 Spec

2. Quickstart Code Examples

Full TypeScript & Python SDK →

curl -X POST "https://api.tinplate.dev/v1/agent-action-receipts/issue" \
  -H "Content-Type: application/json" \
  -H "X-RapidAPI-Key: YOUR_RAPIDAPI_KEY" \
  -d '{"agent_id":"billing-agent-prod","tool_name":"stripe_refund","action_input":{"charge_id":"ch_9921","amount_cents":4500},"secret":"hmac-signing-secret-at-least-16-chars"}'

import { TinplateClient } from "@tinplate/sdk"; // npm install @tinplate/sdk

const tinplate = new TinplateClient({
  rapidApiKey: process.env.RAPIDAPI_KEY!,
});

const { data, meta } = await tinplate.call("/v1/agent-action-receipts/issue", {
  "agent_id": "billing-agent-prod",
  "tool_name": "stripe_refund",
  "action_input": {
    "charge_id": "ch_9921",
    "amount_cents": 4500
  },
  "secret": "hmac-signing-secret-at-least-16-chars"
});
console.log(`[${meta.ms} ms]`, data);

import requests

response = requests.post(
    "https://api.tinplate.dev/v1/agent-action-receipts/issue",
    headers={
        "Content-Type": "application/json",
        "X-RapidAPI-Key": "YOUR_RAPIDAPI_KEY",
    },
    json={
  "agent_id": "billing-agent-prod",
  "tool_name": "stripe_refund",
  "action_input": {
    "charge_id": "ch_9921",
    "amount_cents": 4500
  },
  "secret": "hmac-signing-secret-at-least-16-chars"
}
)
print(response.json())

const response = await fetch("https://api.tinplate.dev/v1/agent-action-receipts/issue", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "X-RapidAPI-Key": "YOUR_RAPIDAPI_KEY",
  },
  body: JSON.stringify({
  "agent_id": "billing-agent-prod",
  "tool_name": "stripe_refund",
  "action_input": {
    "charge_id": "ch_9921",
    "amount_cents": 4500
  },
  "secret": "hmac-signing-secret-at-least-16-chars"
}),
});
const result = await response.json();
console.log(result);

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "tinplate_agent_action_receipts",
    "arguments": {
      "agent_id": "billing-agent-prod",
      "tool_name": "stripe_refund",
      "action_input": {
        "charge_id": "ch_9921",
        "amount_cents": 4500
      },
      "secret": "hmac-signing-secret-at-least-16-chars"
    }
  }
}

OpenAPI 3.0.3 Schema Contract

Request Parameters & Response Schema Reference

Request Body Parameters (`POST /v1/agent-action-receipts/issue`)

Parameter	Type & Constraints	Description
`agent_id`required	`string` minLen: 1, maxLen: 128	Field 'agent_id'
`session_id`optional	`string` minLen: 1, maxLen: 128	Field 'session_id'
`tool_name`required	`string` minLen: 1, maxLen: 128	Field 'tool_name'
`action_input`optional	`any \| null`	Field 'action_input'
`action_output`optional	`any \| null`	Field 'action_output'
`policy_decision`optional	`"allow" \| "repaired" \| "escalated" \| "blocked"` default: "allow"	Field 'policy_decision'
`prev_receipt_hash`optional	`string` maxLen: 128, default: "genesis"	Field 'prev_receipt_hash'
`secret`required	`string` minLen: 16, maxLen: 512	Field 'secret'
`kid`optional	`string` minLen: 1, maxLen: 64, default: "v1"	Field 'kid'
`ttl_seconds`optional	`integer` min: 60, max: 315360000	Field 'ttl_seconds'
`issued_at_epoch`optional	`integer`	Field 'issued_at_epoch'

Response `data` Object Fields (`200 OK`)

Field	Type	Description
`receipt_token`	`string`	Field 'receipt_token'
`receipt_hash`	`string`	Field 'receipt_hash'
`kid`	`string`	Field 'kid'
`issued_at`	`string`	Field 'issued_at'
`expires_at`	`string \| null`	Field 'expires_at'
`payload`	`object`	Field 'payload'

3. What Agent Action Receipts API Detects & Validates

Canonical JSON serialization and SHA-256 digest of agent inputs, outputs, and human-in-the-loop approvals
HMAC-SHA256 signature generation and constant-time verification via WebCrypto
Hash-chain linking (previous_receipt_hash) to detect deleted or reordered agent steps
Expiration and clock-skew validation on verification

Honest Engineering Boundaries

4. Known Limitations & Test Verification

Release Version: v1.0.7 · Last Verified / Benchmarked: 14 November 2026 · Latency Note: Sub-millisecond figures measure in-Worker V8 compute time (typical client HTTPS network RTT to the nearest Cloudflare PoP is 15–65 ms) · See Full Portfolio Benchmarks & Corpora →

Uses symmetric HMAC-SHA256 with caller-supplied secret; caller is responsible for keeping their signing key confidential.
Tested v1.0.4 (14 November 2026).

5. Marketplace Plans & Payload Quotas

Plan	Monthly Price	Included Requests	Rate Limit	Max Request Payload	Best For
BASIC	$0.00 / month	500 / month (hard limit)	10 req / min	64 KB	Evaluation, local development & CI smoke tests
PRO	$9.99 / month	15,000 / month	60 req / min	128 KB	Solo developers & production apps
ULTRA	$29.99 / month	100,000 / month	300 req / min	256 KB	Growing SaaS & multi-agent pipelines
MEGA	$79.99 / month	500,000 / month	1,000 req / min	256 KB	High-volume enterprise workloads

Subscribe on RapidAPI Subscribe on Zyla Hub Full Pricing Details

6. Frequently Asked Questions

How does hash chaining work across multiple agent steps?

Pass the previous receipt's receipt_hash as previous_receipt_hash when issuing the next receipt to create an immutable chain.

Does Tinplate store the receipts or my signing secret?

No. You store the compact signed receipt token in your own database or logs and verify it anytime via /v1/agent-action-receipts/verify.

Is verification protected against timing side-channels?

Yes, signature comparison uses constant-time comparison.

Zero Payload Logging

7. Data Handling, Privacy & Marketplace Proxy Disclosure

Signing secrets and action payloads exist only in V8 isolate memory during the WebCrypto HMAC operation.

Worker Zero-Logging Guarantee: Cloudflare Workers Observability and invocation logging are disabled in configuration (observability.enabled = false, head_sampling_rate = 0, invocation_logs = false). Payloads are processed strictly in volatile V8 memory and never logged or stored by Tinplate.

Marketplace Proxies vs. Direct Bearer Key: Requests sent via RapidAPI or Zyla API Hub pass through those marketplaces' proxy infrastructure (subject to their respective privacy policies). Security-sensitive workloads requiring end-to-end zero-intermediary processing can connect directly to https://api.tinplate.dev using a Direct Bearer Key (Authorization: Bearer <API_KEY>). Read our full Privacy Notice and OpenAPI 3.0.3 JSON Schema.