ORSTYDE
Sign in Analyze a product
Developers · API

A small API with strict guarantees.

A versioned REST API described by OpenAPI 3.1. Every commercial call is idempotent, every event is signed, and every answer is traceable.

OpenAPI document Capabilities
quickstart · shell
# 1. free preview + machine-readable quote
curl -X POST https://…/v1/agent/analyses \
  -H "Authorization: Bearer $ORSTYDE_KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{"product":{"features":["bluetooth"]},"markets":["US","EU"]}'

# 2. purchase with the quote (payment methods: see capabilities)
curl -X POST https://…/v1/agent/orders \
  -H "Authorization: Bearer $ORSTYDE_KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -d '{"quote_id":"qt_…","payment_method":"…"}'

Idempotency

Every commercial POST requires Idempotency-Key. The same key and the same body replay the stored response (Idempotent-Replayed: true). Different arguments get a 409. A concurrent duplicate gets 409 idempotency_in_progress with Retry-After.

Orders

Every order follows an explicit state machine: created → payment_pending → paid → executing → delivered. Each response carries a machine-readable next_action.

Webhooks

Webhooks are signed with Orstyde-Signature: t=…,v1=HMAC-SHA256 and timestamped. Reject events older than 5 minutes and deduplicate on Orstyde-Event-Id.

Errors

Errors are always JSON (error.code, message, request_id). They never contain a stack trace. Quote the request id to support.

Limits

The rate limit is … requests per minute per key, shared across instances. Responses include X-RateLimit-Remaining.

Ledger

GET /v1/agent/ledger returns your commercial events in a hash chain, together with the chain verification result.

Verify a webhook (Python)

import hashlib, hmac, time

def verify(secret, raw_body, header, tolerance=300):
    parts = dict(p.split("=", 1) for p in header.split(","))
    ts = int(parts["t"])
    if abs(time.time() - ts) > tolerance:      # replay protection
        return False
    mac = hmac.new(secret.encode(), f"{ts}.".encode() + raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(mac, parts["v1"])

Endpoints

OperationStatusRESTScopeIdempotency
Loading…