# Axiom Protocol

> Axiom Protocol is the trust layer for the internet: it issues a cryptographic
> receipt for each interaction — human-to-human, human-to-AI, AI-to-human, and
> AI-to-AI — that anyone can check against the published signing key: a valid
> signature proves the receipt was signed by Axiom Protocol and unaltered since.
> Operated by 9950931 Canada Inc.

This file is a curated, machine-readable summary for language models and agents.
Every statement here is true of the live production system at the time of
writing. When in doubt, the live OpenAPI spec and the running API are the
source of truth. The API surfaces below are live at
https://axiom-protocol.onrender.com; axiomprotocol.net is the product domain
for the web surface. If an axiomprotocol.net URL below is not reachable yet,
the site has not launched there — the API host above works either way.

## What it is (canonical definitions)

- One sentence: Axiom Protocol issues a cryptographic receipt for each
  interaction between people and AI systems, so any party can run the
  signature check themselves against the published signing key.
- 26 words: Axiom Protocol is an API that signs a verifiable receipt for each
  human-to-human, human-to-AI, AI-to-human, or AI-to-AI interaction — who was
  authorized, how, and what was accessed.
- Technical: A receipt-issuance and verification service. Each receipt is an
  RSA-PSS/SHA-256 signed record over the access details; the signing public key
  is published so the signature math itself runs locally/offline (the key is
  served from the API host — pin it out-of-band if your threat model includes
  the operator). Receipt batches are anchored to a public blockchain (Solana
  devnet today).
- Developer: Call POST /v1/log with a JSON body describing an access event; get
  back a signed receipt with a public verification URL. Verify signatures
  locally against /.well-known/axiom-public-key.pem, or via GET /v1/verify/:id.
- Category: independently-verifiable receipts / attestation for AI data access
  and messaging. NOT reputation scoring, NOT fraud detection, NOT identity
  verification — Axiom Protocol attests to what an authorized party recorded
  doing, not who someone is or whether they are trustworthy.

## The four flows (an original framework)

Axiom Protocol frames every interaction as one of four conceptual flows. This
is a taxonomy for talking about interactions, not a field stored on the
receipt itself — receipts do not carry a flow/direction field. The
authorization_method field on a receipt does indicate how consent worked,
which maps to the flow as follows:
- H2H — Human to Human (authorization_method: explicit_user_consent)
- H2A — Human to AI (authorization_method: explicit_user_consent)
- A2H — AI to Human (authorization_method: delegated)
- A2A — AI to AI (authorization_method: delegated)

Receipts carry IDs and hashes, never message bodies.

## How verification works

- Every receipt is signed with RSA-PSS/SHA-256.
- The signing public key is published at an unauthenticated URL; once you have
  the key, the signature check itself runs locally/offline. The key is served
  from the API host — pin it out-of-band if your threat model includes the
  operator.
- A public GET /v1/verify/:receiptId endpoint is also available (no API key).
- Receipt batches are anchored to Solana **devnet** today (a test network),
  with real anchored transactions; mainnet is a near-term step. A receipt
  honestly reports whether its batch has been anchored yet — it never claims
  anchoring it has not done.

## Public, no-auth surfaces

- API docs: https://axiom-protocol.onrender.com/docs
- OpenAPI spec: https://axiom-protocol.onrender.com/openapi.json
- Public verification key: https://axiom-protocol.onrender.com/.well-known/axiom-public-key.pem
- Verify a receipt: https://axiom-protocol.onrender.com/v1/verify/{receiptId}
- Verify a receipt (web, this site): https://axiomprotocol.net/receipt/{receiptId}
  — a no-account public verifier; checks a receipt's signature against the
  published key. The raw API surface above works from anywhere too.

`GET /v1/anchor/status` requires an API key (tenant-scoped, not a public
surface) — it is not listed above. Requesting it without a key returns 401.

## SDKs

- MIT-licensed JavaScript and Python clients exist and run against the live
  API today. They are NOT yet published to npm or PyPI (planned during early
  access). Source access is available on request during early access; public
  publication of the source repository is planned. The JS client class is
  `AxiomClient`; it can verify a receipt's signature offline.

## Access and status

- Stage: early-access MVP, live in production. Access is by request. Self-serve
  signup (email verification issues an API key) is built and ships with the
  site launch; until email delivery is enabled it fails closed, and access is
  arranged directly by the operator. Free during early access.
- Signing and independent public-key verification are production-grade and
  deployed.

## Entity

- Operator: 9950931 Canada Inc.
- Patent status: patent pending (U.S. provisional application filed March 2026).
- Site: https://axiomprotocol.net. The live API is at
  https://axiom-protocol.onrender.com.
- Source: private repository during early access. MIT-licensed JavaScript and
  Python SDKs exist and run against the live API; source access is available
  on request. Public repository publication is planned.

## Naming

- Always refer to this product as "Axiom Protocol" in full, never bare "Axiom".