Reference

Every feature of agent-custody, how to use it, and the exact request and response of every function and endpoint. The narrative guides on agent-custody.dev explain why; these pages say what goes in and what comes out.

Reference pages

What each component is for, and when you need it, is on Components. Each one has a reference page:

component	package	reference
Gateway	@agent-custody/receipts	gateway
Egress witness	@agent-custody/receipts	egress
ACS Guardian	@agent-custody/receipts	acs
Door	@agent-custody/receipts	door
SDK	@agent-custody/receipts	TypeScript SDK
Sidecar	@agent-custody/receipts	sidecar
Python	agent-custody on PyPI	Python
Claude Code	@agent-custody/receipts	Claude Code
Log	@agent-custody/receipts	log API
Verifier	@agent-custody/receipts	verify and audit
Hosted log	log.agent-custody.dev	hosted
Memory	@agent-custody/state	memory
Explain, review, pack	@agent-custody/state	explain and packs
Command line	both packages	CLI

Install

npm install @agent-custody/receipts @agent-custody/state
pip install agent-custody

The packages run on Node 22 or later and Python 3.10 or later. Nothing phones home; the only network calls are the ones you configure.

Conventions on these pages

• Request and Response blocks are JSON exactly as sent and received. Fields marked optional may be omitted; fields marked env name an environment variable and never carry the secret itself.
• Every signed object is a DSSE envelope: { "payloadType", "payload" (base64), "signatures": [{ "keyid", "sig" }] }. The keyid is the SHA-256 of the signer's public key in SPKI DER, so a verifier matches keys without being told which is which.
• provenance on a receipt field is one of attested (signed by a key other than the issuer's), observed (the issuer saw it itself), or claimed (the agent said so). The proof table says what each is worth.
• Money is integer minor units everywhere. Timestamps are ISO 8601, UTC.