Identity · Trust · Attestation

Verify before you delegate. Trust infrastructure for the agent economy

Cross-platform identity, trust scoring, and capability attestation for AI agents. One API call to verify any agent, on any platform.

No signup: Try the dashboard opens a live demo fleet (20 agents, read-only).

How it works

Identity you earn, not claim

Four primitives. Everything an agent needs to be trusted by an agent it has never met.

01 · REGISTER

Register

Give your agent a portable identity that works across Bedrock, Azure, Claude, and any custom framework.

02 · ATTEST

Attest

Every completed task builds a verified track record. Trust scores are computed from outcomes, not claims.

03 · PASSPORT

Passport

A signed, portable credential that travels across platforms. Identity, verified capabilities, and trust score in one document, refreshed daily.

04 · VERIFY

Verify

Before coordinating, check any agent's passport in one call. Real-time. Cryptographically provable.

Assay doesn't just score agents. It gives platforms the allow/deny decision for every cross-org agent interaction.

Beyond the single-agent check, Assay forms multi-agent work cells — describe the team you need in plain language and get a readiness verdict, seat by seat, before you dispatch it rather than after a failure. And trust is tuned to your industry: six presets (manufacturing, pharma, logistics, energy, financial services, plus a default) weight it differently, and any org can override the parameters for its own model.

Why Assay

Trust you can actually check

Most "agent reputation" is self-reported, staked, or voted on. Assay is none of those.

Computed from outcomes

Trust scores computed from verified operational outcomes, not self-reported, not token-staked, not voted on.

Platform-agnostic

Works with any agent framework, any cloud provider, any deployment model. No lock-in, no SDK required.

Proven at scale

Used in production across 16,000+ verified operations. The attestation model is battle-tested, not theoretical.

Not behavioral monitoring

Microsoft ASSERT watches what agents do internally. Datadog tracks agent latency. Assay is different. It computes trust from verified operational outcomes across organizational boundaries. Not what the agent said it would do. What it actually did, verified by counterparties who worked with it.

Pricing

Start free. Scale by tier.

Evaluate free, then move to a tier when your agent fleet grows. Subscriptions include monthly call allowances; overages bill at pay-as-you-go rates.

Assay Open
Free
50 calls/month. 3 agents. Full API access. Evaluate the trust engine on your agents.
Get API Key
Popular
Assay Pro
$349 / month
5,000 calls/month. 25 agents. Agent Passports. Platform integration templates. For teams building cross-org agent workflows.
Start Pro →
Assay Business
$1,499 / month
50,000 calls/month. Unlimited agents. Private namespaces. Priority latency. Webhooks. Audit export. For production agent fleets.
Start Business →
Assay Enterprise
Contact us
Unlimited everything. Custom trust models. Industry presets. Guaranteed SLA. SSO/SAML. On-prem option. For platforms embedding Assay.
Talk to us →

Pay as you go

Open-tier usage past the free allowance, and overages on any subscription.

Verification$0.25 / call
Trust lookup$0.10 / call
Attestation$0.10 / call
Discovery$0.05 / call
Registration$0.25 / call
Passport issuancefree
Passport verification (verifier pays)$0.25 / call

First 50 calls free. No credit card to start. Subscription tiers include call allowances, overages billed at pay-as-you-go rates.

The API

Five endpoints. JSON in, JSON out.

A small, sharp surface. Nothing to install. Call it from any language.

POST
/v1/agents/register
POST
/v1/verify
GET
/v1/agents/:id/trust
POST
/v1/agents/:id/attest
GET
/v1/discover
verify.sh
# Verify an agent before you delegate work to it
curl -s https://assay.foundrynet.io/v1/verify \
  -H "Authorization: Bearer $ASSAY_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "agent_id": "agt_9f3c...",
       "claimed_capabilities": ["maintenance"],
       "min_trust_threshold": 0.75 }'

# → response
{
  "verified": true,
  "trust_score": 0.83,
  "capabilities_confirmed": ["maintenance"],
  "attestation_count": 142,
  "last_attestation_age_seconds": 3600
}

Portable agent cards. JSON. No special infrastructure required. Attestation chain available for audit.

Platform integrations

Works with every agent platform

Ready-to-use integration templates. Each one is a working walkthrough against the live Assay API, with real curl commands and a try-it-now sandbox flow.

Industry Trust Models

Different industries, different trust dynamics

Pharma penalizes failures heavily because a bad maintenance job has regulatory consequences. Logistics weights recent performance because last week matters more than last year. Choose a preset or customize the parameters, it's all configuration, no custom code.

Manufacturing

Balanced baseline with a firmer failure penalty, steady, counterparty-verified work is what earns trust on the floor.

Pharma

Failures hit hardest and recency decays fast: a clean record last quarter doesn't excuse a bad batch this week. Regulatory-grade.

Logistics

Heavily recency-weighted and fast-moving, last week's on-time performance matters far more than last year's, with a higher volume of small jobs.

Energy

Strong failure penalty and counterparty bonus, high-consequence assets where independent verification carries real weight.

Financial Services

Demands the most independent verification and reacts quickly to change, trust must be continuously re-earned, not assumed.

Custom

Start from any preset and override individual parameters for your org. See /v1/admin/trust-presets for what's tunable.

Documentation

The full lifecycle, endpoint by endpoint

Register an agent, attest its work, issue a portable passport, and let anyone verify it: six calls, JSON in and out. Base URL https://assay.foundrynet.io.

Authentication. Registration is open. Attestations require a key: pass your aid_ key as X-API-Key, or an OAuth Bearer token. Reads (trust, verify, discover) are public.

1 · Register an agent (public)

Mint an identity and its API key. Trust starts at a neutral 0.5.

register.sh
# POST /v1/agents/register
curl -s https://assay.foundrynet.io/v1/agents/register \
  -H "Content-Type: application/json" \
  -d '{ "name": "maint-bot",
       "owner_org": "acme",
       "capabilities": ["maintenance"] }'

# -> 200
{
  "agent_id": "agt_9f3c...",
  "api_key": "aid_Pw4l...",   // keep this secret
  "agent_card": { "trust_score": 0.5 }
}

2 · Attest work (requires X-API-Key)

Record an outcome. Successes lift trust; a failure costs more than a success earns. Unauthenticated or unrecognized keys are rejected with 401.

attest.sh
# POST /v1/agents/:id/attest
curl -s https://assay.foundrynet.io/v1/agents/agt_9f3c.../attest \
  -H "X-API-Key: $ASSAY_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "task_type": "maintenance", "outcome": "success" }'

# -> 200
{ "attestation_id": "att_4b39...",
  "updated_trust_score": 0.58 }

3 · Read the trust profile (public)

trust.sh
# GET /v1/agents/:id/trust
curl -s https://assay.foundrynet.io/v1/agents/agt_9f3c.../trust

# -> 200
{ "overall_score": 0.58,
  "breakdown": [ { "capability": "maintenance",
                  "score": 0.58, "attestation_count": 3 } ] }

4 · Issue a signed passport (public)

A signed Agent Passport: identity, verified capabilities, trust score, attestation summary, and a cryptographic signature. 24-hour expiry, cache and refresh daily. Free.

passport.sh
# GET /v1/agents/:id/passport
curl -s https://assay.foundrynet.io/v1/agents/agt_9f3c.../passport

# -> 200
{
  "agent_id": "agt_9f3c...",
  "name": "maint-bot",
  "issuer": "assay.foundrynet.io",
  "issued_at": "2026-07-23T18:00:00+00:00",
  "expires_at": "2026-07-24T18:00:00+00:00",
  "trust_score": 0.58,
  "capabilities_verified": { "maintenance": 0.58 },
  "total_attestations": 3,
  "counterparty_verifications": 1,
  "first_fix_rate": 0.67,
  "verification_url": "https://assay.foundrynet.io/v1/verify",
  "signature": "a1b2c3..."   // HMAC-SHA256, proves it wasn't tampered with
}

5 · Verify before you delegate (public)

verify.sh
# POST /v1/verify
curl -s https://assay.foundrynet.io/v1/verify \
  -H "Content-Type: application/json" \
  -d '{ "agent_id": "agt_9f3c...",
       "claimed_capabilities": ["maintenance"],
       "min_trust_threshold": 0.5 }'

# -> 200
{ "verified": true, "trust_score": 0.58,
  "capabilities_confirmed": ["maintenance"] }

6 · Discover agents by capability (public)

discover.sh
# GET /v1/discover?capability=maintenance&min_trust_score=0.5
curl -s "https://assay.foundrynet.io/v1/discover?capability=maintenance"

# -> 200, agents sorted by trust, highest first
{ "count": 1,
  "agents": [ { "agent_card": { "agent_id": "agt_9f3c..." },
                "trust_score": 0.58 } ] }

Full request/response schemas at /openapi.json; machine-readable card at /.well-known/agent.json.

Get your API key

Your first 50 calls are free. Generate a key now and make your first verify call in under two minutes.

No credit card. The key is shown once, so copy it somewhere safe.

Add credits

After your 50 free calls, calls draw from prepaid credits. Top up in seconds. No subscription, no minimums.