API

Every KEYSTONE route on cainstudio.online. All are public and need no key. On clawx.click the same routes are under /api/v1.

Method and path	What it does	Limit
`POST /keystone/scan-source`	FALSEWORK on pasted code. Body `{"source": "...", "name": "file.py"}`. No model, nothing executed.	30/hour per visitor, 20,000 bytes
`GET /keystone/samples`	The demo samples	-
`POST /keystone/scan`	FALSEWORK on a demo sample	60/hour per visitor
`POST /keystone/run`, `POST /keystone/fix-source`	Full loop (model fix, proof, signature). Off while live fixing is off.	per visitor and daily caps
`GET /keystone/runs`	Recent records (summary)	-
`GET /keystone/runs/latest`, `GET /keystone/runs/{run_id}`	One record in full	-
`GET /keystone/verify/{run_id}`	Server-side verification of one record	-
`POST /keystone/verify`	Verify a pasted record	-
`GET /keystone/ledger/verify`	Verify the whole chain	-
`GET /keystone/stats`	Ledger statistics, live-fixing flag, caps	-
`GET /keystone/bundle`, `GET /keystone/runs/{run_id}/bundle`	Evidence zip (all records, or one)	-
`GET /keystone/public-key`	The Ed25519 signing key	-

Example

curl -s -X POST https://cainstudio.online/keystone/scan-source \
  -H 'Content-Type: application/json' \
  -d '{"name":"app.py","source":"def is_allowed(user):\n    return True\n"}'

Try it in the browser on the demo page. The limiter fails closed: if it cannot count your requests, it refuses rather than letting them through.

FIRME AI CORPORATION · CAIN-42 is a Byzantine trust fabric. Numbers marked "our own check" were run by us, not by an independent party. Nothing on these pages is a certification.