Conformance Status
Every surface in this documentation is one of two statuses. This page collects them all in one place.
Live now means you can call it today and get a real response. Preview means the shape is committed — the endpoint, request/response contract, and SDK signatures are finalized — but the surface is not yet deployed. No endpoint is implied live unless it is listed as live below.
Live — no authentication required
These endpoints are deployed and verifiable by any party today.
| Surface | Endpoint | Notes |
|---|---|---|
| OCSS Trust List | GET https://prodapi.phosra.com/.well-known/ocss/trust-list | Signed JSON document. Verify against the published root key root-prod-2026-06. Production accreditation entries are added through OCSS governance. |
| OCSS succession record | GET https://prodapi.phosra.com/.well-known/ocss/succession | Ed25519-signed steward-of-record record and anti-capture covenant. |
| Health check | GET https://prodapi.phosra.com/health | Simple liveness check. |
Live — authentication required
These endpoints are deployed and require a phosra_-prefixed API key or session bearer token.
| Surface | Auth | Notes |
|---|---|---|
Developer orgs (/api/v1/developers/orgs) | phosra_ API key | Create, read, update, delete developer organizations. |
API keys (/api/v1/developers/orgs/{orgId}/keys) | phosra_ API key | Provision, revoke, and rotate phosra_-prefixed keys. |
Usage rollups (/api/v1/developers/orgs/{orgId}/usage) | phosra_ API key | Hourly request rollups per org. |
Advisor agents (/api/v1/advisors) | Session bearer | Register and consult advisor agents; declare OCSS payload keys for federation. |
MCP tokens (/api/v1/mcp-tokens) | Session bearer | Mint and revoke Model Context Protocol authentication tokens. |
| §9.4 attestation export | phosra_ API key | Signed CSV of conformance evidence per OCSS §9.4, suitable for regulatory submission. |
The base URL for all management operations is https://prodapi.phosra.com/api/v1.
Preview — committed shape, not yet deployed
The surfaces below are not live. The request/response shape is committed and will not change without a versioned notice. Do not build production flows that call these endpoints today — they will return 404.
| Surface | Planned path | Notes |
|---|---|---|
| Decision check | POST /api/v1/check | Age signal in, signed tier decision + receipt out. The shape is illustrated in the quickstart and /for/developers — it is a committed design, not a live 200. Ships with the self-serve developer funnel. |
| Full self-serve API key provisioning | POST /api/v1/developers/orgs (public, without prior handshake) | The management API above is live; the fully automated self-serve sign-up funnel without a direct handshake is a later milestone. |
@phosra/sdk-dev npm package | npm install @phosra/sdk-dev | Package is authored and the API is committed. Not yet published to npm. Ships with the self-serve funnel. |
@phosra/sdk-dev/protocol re-export | npm install @phosra/sdk-dev | The /protocol subpath is @openchildsafety/ocss verbatim. Unpublished as a package; import directly from @openchildsafety/ocss in the meantime. |
@phosra/mcp npm package | npx @phosra/mcp | MCP server for agent integrations. Shape committed; package not yet published. Ships with the self-serve funnel. |
OCSS conformance surfaces (open standard, not Phosra-specific)
These surfaces are defined by the OCSS specification. Phosra implements them; the standard's stewardship body owns the spec.
| Surface | Status | Notes |
|---|---|---|
| Trust List well-known endpoint | Live | See above. |
| Succession record well-known endpoint | Live | See above. |
| Ed25519 signed write receipts | Preview | Shape committed; the /v1/check endpoint that issues them ships with the funnel. |
| Ed25519 signed enforcement receipts (§8.3.8) | Preview | Issued when a rule decision is confirmed applied at an enforcement endpoint. |
Two-layer sealed envelope (harm_context, §3A.3) | Preview | Router-blind lane. Shape committed; deployment gated on the full enforcement funnel. |
| §9.4 attestation export | Live | Signed CSV evidence export. See live surfaces above. |
| Conformance suite | External | Owned by the OCSS stewardship body at openchildsafety.com. Not a Phosra-hosted surface. |
How status changes
When a preview surface ships, the table above is updated and the relevant page in this documentation gains a "Live" label. Changes that affect the request/response contract are versioned (e.g. /api/v2/check). The introduction page always reflects the current live/preview split in its <Note> block.
Questions
If you are building against a preview surface and need early access to the developer funnel, reach out at [email protected].