Live demo

These call the real public routes. Credentials are minted only for the demo API's own audience, so nothing here works against any other service.

The public routes run the pre-2026-11-02 engine until the next gateway deploy. Steps 1 to 3 behave the same before and after. The delegation fixes are visible after the deploy.

1. Mint a credential for one read

Expected: decision: ALLOW and a token. Copy the token for the next steps.

2. Ask for something outside the grants

Expected: decision: DENY, no token.

3. A path a Tomcat server would read as /admin

Expected: after the deploy: DENY (before it: ALLOW, one of today's findings).

4. Use the token, then use it again

curl -s https://cainstudio.online/api/v1/broker-keystone/demo-api/orders/A-1042 -H "Authorization: CAIN-Action $TOKEN"   # works
curl -s https://cainstudio.online/api/v1/broker-keystone/demo-api/orders/A-1042 -H "Authorization: CAIN-Action $TOKEN"   # replayed

5. The published key

FIRME AI CORPORATION · CAIN-42 is a Byzantine trust fabric. Numbers marked "our own check" were run by us, not by an independent party. Nothing on these pages is a certification.