Signed declarations of HTTP API exchanges for agent handoffs. Free preparation and verification; receipt issuance costs 0.002 USDC via x402 on Base. Start and connect: https://datoka.dev/api. Signatures attest declared data, not independent truth.
Scored across 4 tools
The four tools map to a clear pipeline: fetch trust keys, prepare (dry-run), issue (paid), verify. The prepare_api_exchange vs issue_api_receipt boundary is the only fuzzy one, but descriptions explicitly contrast 'returns commitment without issuing or paying' against actually buying a receipt.
All four follow a strict verb_api_noun snake_case pattern (get_api_public_keys, issue_api_receipt, prepare_api_exchange, verify_api_receipt), with verbs that accurately describe the action. No style deviations.
Four tools is appropriately lean for a focused receipt issuance/verification service, and each earns its place in the trust-to-verify lifecycle. It sits at the lower edge but is well-scoped rather than thin.
The surface covers the full lifecycle: trust anchor (public keys), pre-flight validation (prepare), issuance (issue), and independent verification (verify). Minor gaps like listing/retrieving previously issued receipts or revocation handling are not exposed but are workable around.
Return issuer public keys. Establish issuer trust independently before offline verification.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
| Name | Required | Description |
|---|---|---|
| keys | Yes | |
| issuer | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly, idempotent, non-destructive and closed-world, so the safety profile is covered. The description adds the intent (trust establishment for offline verification) but no caching, freshness, or key-rotation behavior, so it goes only modestly beyond the structured hints.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, zero waste, with the operation front-loaded and the cautionary purpose second. Nothing is padded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be explained, and the description supplies the purpose and workflow context. It is adequate, though it could note key freshness or rotation for a trust-anchoring endpoint.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so the baseline is 4. There is nothing to disambiguate and the empty schema is self-explanatory.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: 'Return issuer public keys'. An agent can tell it is a retrieval operation for keys, distinct from the issue/prepare/verify siblings, though it never names those siblings explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'Establish issuer trust independently before offline verification' implies the workflow position (run this before verify_api_receipt), but it does not name a sibling tool or state explicit when-not conditions. Usage must be inferred from the phrasing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Buy a portable signed commitment to a declared API exchange when a recipient needs independently verifiable receipt integrity: response handoff, archived decision input, or change investigation. Costs 0.002 USDC per receipt via x402 when enabled; verification is free. A local log may suffice for disposable data. Requires caller-approved budget. Keep event, idempotency key and original payment unchanged on retry. Attests a client declaration, not provider origin, content truth or independent observation.
| Name | Required | Description | Default |
|---|---|---|---|
| event | Yes | Commitment-only HTTP exchange declaration built locally with the SDK. No raw URLs, headers or bodies. | |
| idempotencyKey | Yes | One stable key per purchase, saved before payment. Keep it, the event and original payment authorization unchanged on retries. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the annotations, it discloses cost (0.002 USDC per receipt via x402), that verification is free, that a caller-approved budget is required, that inputs/payment must be unchanged on retry, and the crucial trust caveat that it attests a client declaration rather than provider origin or content truth. This is exactly the kind of context annotations cannot carry.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Dense but front-loaded: the core action and cost come first, then prerequisites and caveats. Some clauses are stacked tightly, but every sentence carries distinct information (use cases, cost, budget, retry rule, trust limit).
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a paid, idempotent mutation with a deep nested schema, the description covers cost, authorization, retry discipline and the trust boundary. The only real gap is that it never characterizes the returned receipt (there is no output schema), leaving the agent to infer what 'buy' produces.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline is 3, but the description adds real semantic value: the idempotency key and event must be held stable across retries with the original payment authorization, which is not derivable from the schema's pattern/description alone.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description gives a specific verb+resource (buy a portable signed commitment / receipt) and grounds it in concrete scenarios (response handoff, archived decision input, change investigation). It does not name sibling tools like prepare_api_exchange or verify_api_receipt, so differentiation is implied rather than explicit.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It states clear use contexts and even a when-not condition (a local log may suffice for disposable data), plus prerequisites (caller-approved budget). It stops short of pointing the agent at the alternative sibling tools (e.g. verify_api_receipt for free verification), which would make routing unambiguous.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Free validation before buying a receipt. Supply an event built locally with the SDK from real captured bytes; never fabricate hashes. Returns the commitment without issuing a receipt or paying. Use when retaining verifiable evidence of an API response for a handoff or archive.
| Name | Required | Description | Default |
|---|---|---|---|
| event | Yes | Commitment-only HTTP exchange declaration built locally with the SDK. No raw URLs, headers or bodies. |
| Name | Required | Description |
|---|---|---|
| chain | Yes | |
| event | Yes | Commitment-only HTTP exchange declaration built locally with the SDK. No raw URLs, headers or bodies. |
| commitment | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true and destructiveHint=false, so safety is covered. The description adds real behavioral context beyond that: the call is free, issues no receipt, requires no payment, and the input must be SDK-built from real captured bytes ('never fabricate hashes'). It stops short of describing what the returned commitment actually is or whether validation can fail.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Four short sentences, front-loaded with the cost/value proposition ('Free validation before buying a receipt'), then input constraints, then return behavior, then the use case. Efficient, with only mild redundancy between the 'commitment' and 'no receipt' statements.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present the description need not explain return values, and annotations cover the safety profile. It supplies the cost model, the no-side-effect guarantee, and the input-integrity constraint, which is what an agent needs to decide and invoke correctly. Minor gap: no hint about validation-failure behavior.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with rich nested field descriptions, so the baseline is 3. The description earns an extra point by adding construction guidance the schema cannot convey in one place: the event must be built locally with the SDK from real captured bytes rather than hand-crafted.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific action (free validation of an exchange declaration producing a commitment) and explicitly distinguishes itself from the paid path ('Returns the commitment without issuing a receipt or paying'), which maps directly onto the sibling issue_api_receipt. An agent can tell it apart from issue_api_receipt and verify_api_receipt without opening either schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives a clear when-to-use ('when retaining verifiable evidence of an API response for a handoff or archive') and positions itself as the free pre-step before buying a receipt, implicitly routing to issue_api_receipt. It does not explicitly state when not to use it versus verify_api_receipt, so it falls short of full alternative coverage.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Free signature and declaration verification. To try before buying, read datoka-api://demo-receipt or /demo/receipt.json and pass the returned JSON here. No wallet needed for public verification. Verifies issuer, scope and event commitment; compare original response bytes locally with the SDK or /verify/.
| Name | Required | Description | Default |
|---|---|---|---|
| event | Yes | Commitment-only HTTP exchange declaration built locally with the SDK. No raw URLs, headers or bodies. | |
| receipt | Yes | Unmodified signed receipt returned by issuance or the public synthetic demo; verify against trusted issuer keys. |
| Name | Required | Description |
|---|---|---|
| apiId | Yes | Caller-chosen API identifier; not a certified provider identity. |
| scope | Yes | |
| valid | Yes | |
| receiptId | Yes | |
| exchangeId | Yes | Stable identifier for one declared HTTP exchange. |
| attestation | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly, idempotent, non-destructive and closed-world, so the safety profile is covered. The description adds genuinely new behavior: verification is free, requires no wallet, consumes a locally built commitment-only declaration, and defers raw-byte comparison to the SDK or /verify/. It does not describe failure modes (what an invalid signature yields).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Four short sentences, each carrying a distinct fact (what it verifies, the demo path, the no-wallet condition, the byte-comparison alternative), with the purpose front-loaded. Slightly dense but no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return-value explanation is not required, and annotations cover the safety profile. The description supplies the pricing/auth context (free, no wallet) and the demo entry point. It omits how to obtain trusted issuer keys and how to interpret an invalid result.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and both parameters (event, receipt) are heavily documented in the schema with nested field semantics, so the baseline is 3. The description only implies the receipt input via 'pass the returned JSON here' and adds no field-level guidance beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('signature and declaration verification') and names what is checked (issuer, scope, event commitment), which separates it from issue_api_receipt and prepare_api_exchange. It does not explicitly name the siblings, but the verify-vs-issue-vs-prepare distinction is unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives a concrete entry condition ('to try before buying, read datoka-api://demo-receipt'), states no wallet is needed for public verification, and points to an alternative byte-comparison path (SDK or /verify/). It stops short of saying when this tool is not appropriate or that trusted issuer keys must come from get_api_public_keys.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
issue_api_receipt17 fields changedInput schema / properties / event / descriptionAdded value: +"Commitment-only HTTP exchange declaration built locally with the SDK. No raw URLs, headers or bodies."Input schema / properties / event / properties / attestation / descriptionAdded value: +"The caller declares the exchange; Datoka does not independently observe it."Input schema / properties / event / properties / bodyEncoding / descriptionAdded value: +"Hash application bytes after HTTP decoding, without JSON reserialization."Input schema / properties / event / properties / completedAt / descriptionAdded value: +"Declared UTC completion with milliseconds; must be at or after startedAt."Input schema / properties / event / properties / headerEncoding / descriptionAdded value: +"Use the SDK header selection and JCS canonicalization before hashing."Input schema / properties / event / properties / method / descriptionAdded value: +"Actual HTTP method of the locally captured exchange, for example GET."Input schema / properties / event / properties / requestBodyHash / anyOfPrevious value: -[
- {
- "additionalProperties": false,
- "properties": {
- "algorithm": {
- "const": "sha256",
- "type": "string"
- },
- "digest": {
- "pattern": "^[a-f0-9]{64}$",
- "type": "string"
- }
- },
- "required": [
- "algorithm",
- "digest"
- ],
- "type": "object"
- },
- {
- "type": "null"
- }
-]New value: +[
+ {
+ "additionalProperties": false,
+ "properties": {
+ "algorithm": {
+ "const": "sha256",
+ "description": "Digest algorithm; always sha256.",
+ "type": "string"
+ },
+ "digest": {
+ "description": "SHA-256 of exact locally captured bytes, encoded as 64 lowercase hexadecimal characters.",
+ "pattern": "^[a-f0-9]{64}$",
+ "type": "string"
+ }
+ },
+ "required": [
+ "algorithm",
+ "digest"
+ ],
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+]Input schema / properties / event / properties / requestHeadersHash / properties / algorithm / descriptionAdded value: +"Digest algorithm; always sha256."Input schema / properties / event / properties / requestHeadersHash / properties / digest / descriptionAdded value: +"SHA-256 of exact locally captured bytes, encoded as 64 lowercase hexadecimal characters."Input schema / properties / event / properties / responseBodyHash / anyOfPrevious value: -[
- {
- "additionalProperties": false,
- "properties": {
- "algorithm": {
- "const": "sha256",
- "type": "string"
- },
- "digest": {
- "pattern": "^[a-f0-9]{64}$",
- "type": "string"
- }
- },
- "required": [
- "algorithm",
- "digest"
- ],
- "type": "object"
- },
- {
- "type": "null"
- }
-]New value: +[
+ {
+ "additionalProperties": false,
+ "properties": {
+ "algorithm": {
+ "const": "sha256",
+ "description": "Digest algorithm; always sha256.",
+ "type": "string"
+ },
+ "digest": {
+ "description": "SHA-256 of exact locally captured bytes, encoded as 64 lowercase hexadecimal characters.",
+ "pattern": "^[a-f0-9]{64}$",
+ "type": "string"
+ }
+ },
+ "required": [
+ "algorithm",
+ "digest"
+ ],
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+]Input schema / properties / event / properties / responseHeadersHash / properties / algorithm / descriptionAdded value: +"Digest algorithm; always sha256."Input schema / properties / event / properties / responseHeadersHash / properties / digest / descriptionAdded value: +"SHA-256 of exact locally captured bytes, encoded as 64 lowercase hexadecimal characters."Input schema / properties / event / properties / startedAt / descriptionAdded value: +"Declared UTC start with milliseconds, for example 2026-10-07T08:00:00.000Z."Input schema / properties / event / properties / status / descriptionAdded value: +"Actual HTTP response status, including error responses; for example 200 or 404."Input schema / properties / event / properties / targetHash / properties / algorithm / descriptionAdded value: +"Digest algorithm; always sha256."Input schema / properties / event / properties / targetHash / properties / digest / descriptionAdded value: +"SHA-256 of exact locally captured bytes, encoded as 64 lowercase hexadecimal characters."Input schema / properties / event / properties / version / descriptionAdded value: +"Declaration format version; preserve this literal."prepare_api_exchange34 fields changedInput schema / properties / event / descriptionAdded value: +"Commitment-only HTTP exchange declaration built locally with the SDK. No raw URLs, headers or bodies."Input schema / properties / event / properties / attestation / descriptionAdded value: +"The caller declares the exchange; Datoka does not independently observe it."Input schema / properties / event / properties / bodyEncoding / descriptionAdded value: +"Hash application bytes after HTTP decoding, without JSON reserialization."Input schema / properties / event / properties / completedAt / descriptionAdded value: +"Declared UTC completion with milliseconds; must be at or after startedAt."Input schema / properties / event / properties / headerEncoding / descriptionAdded value: +"Use the SDK header selection and JCS canonicalization before hashing."Input schema / properties / event / properties / method / descriptionAdded value: +"Actual HTTP method of the locally captured exchange, for example GET."Input schema / properties / event / properties / requestBodyHash / anyOfPrevious value: -[
- {
- "additionalProperties": false,
- "properties": {
- "algorithm": {
- "const": "sha256",
- "type": "string"
- },
- "digest": {
- "pattern": "^[a-f0-9]{64}$",
- "type": "string"
- }
- },
- "required": [
- "algorithm",
- "digest"
- ],
- "type": "object"
- },
- {
- "type": "null"
- }
-]New value: +[
+ {
+ "additionalProperties": false,
+ "properties": {
+ "algorithm": {
+ "const": "sha256",
+ "description": "Digest algorithm; always sha256.",
+ "type": "string"
+ },
+ "digest": {
+ "description": "SHA-256 of exact locally captured bytes, encoded as 64 lowercase hexadecimal characters.",
+ "pattern": "^[a-f0-9]{64}$",
+ "type": "string"
+ }
+ },
+ "required": [
+ "algorithm",
+ "digest"
+ ],
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+]Input schema / properties / event / properties / requestHeadersHash / properties / algorithm / descriptionAdded value: +"Digest algorithm; always sha256."Input schema / properties / event / properties / requestHeadersHash / properties / digest / descriptionAdded value: +"SHA-256 of exact locally captured bytes, encoded as 64 lowercase hexadecimal characters."Input schema / properties / event / properties / responseBodyHash / anyOfPrevious value: -[
- {
- "additionalProperties": false,
- "properties": {
- "algorithm": {
- "const": "sha256",
- "type": "string"
- },
- "digest": {
- "pattern": "^[a-f0-9]{64}$",
- "type": "string"
- }
- },
- "required": [
- "algorithm",
- "digest"
- ],
- "type": "object"
- },
- {
- "type": "null"
- }
-]New value: +[
+ {
+ "additionalProperties": false,
+ "properties": {
+ "algorithm": {
+ "const": "sha256",
+ "description": "Digest algorithm; always sha256.",
+ "type": "string"
+ },
+ "digest": {
+ "description": "SHA-256 of exact locally captured bytes, encoded as 64 lowercase hexadecimal characters.",
+ "pattern": "^[a-f0-9]{64}$",
+ "type": "string"
+ }
+ },
+ "required": [
+ "algorithm",
+ "digest"
+ ],
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+]Input schema / properties / event / properties / responseHeadersHash / properties / algorithm / descriptionAdded value: +"Digest algorithm; always sha256."Input schema / properties / event / properties / responseHeadersHash / properties / digest / descriptionAdded value: +"SHA-256 of exact locally captured bytes, encoded as 64 lowercase hexadecimal characters."Input schema / properties / event / properties / startedAt / descriptionAdded value: +"Declared UTC start with milliseconds, for example 2026-10-07T08:00:00.000Z."Input schema / properties / event / properties / status / descriptionAdded value: +"Actual HTTP response status, including error responses; for example 200 or 404."Input schema / properties / event / properties / targetHash / properties / algorithm / descriptionAdded value: +"Digest algorithm; always sha256."Input schema / properties / event / properties / targetHash / properties / digest / descriptionAdded value: +"SHA-256 of exact locally captured bytes, encoded as 64 lowercase hexadecimal characters."Input schema / properties / event / properties / version / descriptionAdded value: +"Declaration format version; preserve this literal."Output schema / properties / event / descriptionAdded value: +"Commitment-only HTTP exchange declaration built locally with the SDK. No raw URLs, headers or bodies."Output schema / properties / event / properties / attestation / descriptionAdded value: +"The caller declares the exchange; Datoka does not independently observe it."Output schema / properties / event / properties / bodyEncoding / descriptionAdded value: +"Hash application bytes after HTTP decoding, without JSON reserialization."Output schema / properties / event / properties / completedAt / descriptionAdded value: +"Declared UTC completion with milliseconds; must be at or after startedAt."Output schema / properties / event / properties / headerEncoding / descriptionAdded value: +"Use the SDK header selection and JCS canonicalization before hashing."Output schema / properties / event / properties / method / descriptionAdded value: +"Actual HTTP method of the locally captured exchange, for example GET."Output schema / properties / event / properties / requestBodyHash / anyOfPrevious value: -[
- {
- "additionalProperties": false,
- "properties": {
- "algorithm": {
- "const": "sha256",
- "type": "string"
- },
- "digest": {
- "pattern": "^[a-f0-9]{64}$",
- "type": "string"
- }
- },
- "required": [
- "algorithm",
- "digest"
- ],
- "type": "object"
- },
- {
- "type": "null"
- }
-]New value: +[
+ {
+ "additionalProperties": false,
+ "properties": {
+ "algorithm": {
+ "const": "sha256",
+ "description": "Digest algorithm; always sha256.",
+ "type": "string"
+ },
+ "digest": {
+ "description": "SHA-256 of exact locally captured bytes, encoded as 64 lowercase hexadecimal characters.",
+ "pattern": "^[a-f0-9]{64}$",
+ "type": "string"
+ }
+ },
+ "required": [
+ "algorithm",
+ "digest"
+ ],
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+]Output schema / properties / event / properties / requestHeadersHash / properties / algorithm / descriptionAdded value: +"Digest algorithm; always sha256."Output schema / properties / event / properties / requestHeadersHash / properties / digest / descriptionAdded value: +"SHA-256 of exact locally captured bytes, encoded as 64 lowercase hexadecimal characters."Output schema / properties / event / properties / responseBodyHash / anyOfPrevious value: -[
- {
- "additionalProperties": false,
- "properties": {
- "algorithm": {
- "const": "sha256",
- "type": "string"
- },
- "digest": {
- "pattern": "^[a-f0-9]{64}$",
- "type": "string"
- }
- },
- "required": [
- "algorithm",
- "digest"
- ],
- "type": "object"
- },
- {
- "type": "null"
- }
-]New value: +[
+ {
+ "additionalProperties": false,
+ "properties": {
+ "algorithm": {
+ "const": "sha256",
+ "description": "Digest algorithm; always sha256.",
+ "type": "string"
+ },
+ "digest": {
+ "description": "SHA-256 of exact locally captured bytes, encoded as 64 lowercase hexadecimal characters.",
+ "pattern": "^[a-f0-9]{64}$",
+ "type": "string"
+ }
+ },
+ "required": [
+ "algorithm",
+ "digest"
+ ],
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+]Output schema / properties / event / properties / responseHeadersHash / properties / algorithm / descriptionAdded value: +"Digest algorithm; always sha256."Output schema / properties / event / properties / responseHeadersHash / properties / digest / descriptionAdded value: +"SHA-256 of exact locally captured bytes, encoded as 64 lowercase hexadecimal characters."Output schema / properties / event / properties / startedAt / descriptionAdded value: +"Declared UTC start with milliseconds, for example 2026-10-07T08:00:00.000Z."Output schema / properties / event / properties / status / descriptionAdded value: +"Actual HTTP response status, including error responses; for example 200 or 404."Output schema / properties / event / properties / targetHash / properties / algorithm / descriptionAdded value: +"Digest algorithm; always sha256."Output schema / properties / event / properties / targetHash / properties / digest / descriptionAdded value: +"SHA-256 of exact locally captured bytes, encoded as 64 lowercase hexadecimal characters."Output schema / properties / event / properties / version / descriptionAdded value: +"Declaration format version; preserve this literal."verify_api_receipt18 fields changedInput schema / properties / event / descriptionAdded value: +"Commitment-only HTTP exchange declaration built locally with the SDK. No raw URLs, headers or bodies."Input schema / properties / event / properties / attestation / descriptionAdded value: +"The caller declares the exchange; Datoka does not independently observe it."Input schema / properties / event / properties / bodyEncoding / descriptionAdded value: +"Hash application bytes after HTTP decoding, without JSON reserialization."Input schema / properties / event / properties / completedAt / descriptionAdded value: +"Declared UTC completion with milliseconds; must be at or after startedAt."Input schema / properties / event / properties / headerEncoding / descriptionAdded value: +"Use the SDK header selection and JCS canonicalization before hashing."Input schema / properties / event / properties / method / descriptionAdded value: +"Actual HTTP method of the locally captured exchange, for example GET."Input schema / properties / event / properties / requestBodyHash / anyOfPrevious value: -[
- {
- "additionalProperties": false,
- "properties": {
- "algorithm": {
- "const": "sha256",
- "type": "string"
- },
- "digest": {
- "pattern": "^[a-f0-9]{64}$",
- "type": "string"
- }
- },
- "required": [
- "algorithm",
- "digest"
- ],
- "type": "object"
- },
- {
- "type": "null"
- }
-]New value: +[
+ {
+ "additionalProperties": false,
+ "properties": {
+ "algorithm": {
+ "const": "sha256",
+ "description": "Digest algorithm; always sha256.",
+ "type": "string"
+ },
+ "digest": {
+ "description": "SHA-256 of exact locally captured bytes, encoded as 64 lowercase hexadecimal characters.",
+ "pattern": "^[a-f0-9]{64}$",
+ "type": "string"
+ }
+ },
+ "required": [
+ "algorithm",
+ "digest"
+ ],
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+]Input schema / properties / event / properties / requestHeadersHash / properties / algorithm / descriptionAdded value: +"Digest algorithm; always sha256."Input schema / properties / event / properties / requestHeadersHash / properties / digest / descriptionAdded value: +"SHA-256 of exact locally captured bytes, encoded as 64 lowercase hexadecimal characters."Input schema / properties / event / properties / responseBodyHash / anyOfPrevious value: -[
- {
- "additionalProperties": false,
- "properties": {
- "algorithm": {
- "const": "sha256",
- "type": "string"
- },
- "digest": {
- "pattern": "^[a-f0-9]{64}$",
- "type": "string"
- }
- },
- "required": [
- "algorithm",
- "digest"
- ],
- "type": "object"
- },
- {
- "type": "null"
- }
-]New value: +[
+ {
+ "additionalProperties": false,
+ "properties": {
+ "algorithm": {
+ "const": "sha256",
+ "description": "Digest algorithm; always sha256.",
+ "type": "string"
+ },
+ "digest": {
+ "description": "SHA-256 of exact locally captured bytes, encoded as 64 lowercase hexadecimal characters.",
+ "pattern": "^[a-f0-9]{64}$",
+ "type": "string"
+ }
+ },
+ "required": [
+ "algorithm",
+ "digest"
+ ],
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+]Input schema / properties / event / properties / responseHeadersHash / properties / algorithm / descriptionAdded value: +"Digest algorithm; always sha256."Input schema / properties / event / properties / responseHeadersHash / properties / digest / descriptionAdded value: +"SHA-256 of exact locally captured bytes, encoded as 64 lowercase hexadecimal characters."Input schema / properties / event / properties / startedAt / descriptionAdded value: +"Declared UTC start with milliseconds, for example 2026-10-07T08:00:00.000Z."Input schema / properties / event / properties / status / descriptionAdded value: +"Actual HTTP response status, including error responses; for example 200 or 404."Input schema / properties / event / properties / targetHash / properties / algorithm / descriptionAdded value: +"Digest algorithm; always sha256."Input schema / properties / event / properties / targetHash / properties / digest / descriptionAdded value: +"SHA-256 of exact locally captured bytes, encoded as 64 lowercase hexadecimal characters."Input schema / properties / event / properties / version / descriptionAdded value: +"Declaration format version; preserve this literal."Input schema / properties / receipt / descriptionAdded value: +"Unmodified signed receipt returned by issuance or the public synthetic demo; verify against trusted issuer keys."get_api_public_keys2 fields changedInput schema / $schemaPrevious value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema"Output schema / $schemaPrevious value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema"issue_api_receipt5 fields changedInput schema / $schemaPrevious value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema"Input schema / properties / event / properties / apiId / descriptionAdded value: +"Caller-chosen API identifier; not a certified provider identity."Input schema / properties / event / properties / exchangeId / descriptionAdded value: +"Stable identifier for one declared HTTP exchange."Input schema / properties / event / properties / requestHeadersHash / descriptionAdded value: +"SHA-256 of locally canonicalized selected request headers. Never send raw headers."Input schema / properties / event / properties / responseHeadersHash / descriptionAdded value: +"SHA-256 of locally canonicalized selected response headers."prepare_api_exchange10 fields changedInput schema / $schemaPrevious value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema"Input schema / properties / event / properties / apiId / descriptionAdded value: +"Caller-chosen API identifier; not a certified provider identity."Input schema / properties / event / properties / exchangeId / descriptionAdded value: +"Stable identifier for one declared HTTP exchange."Input schema / properties / event / properties / requestHeadersHash / descriptionAdded value: +"SHA-256 of locally canonicalized selected request headers. Never send raw headers."Input schema / properties / event / properties / responseHeadersHash / descriptionAdded value: +"SHA-256 of locally canonicalized selected response headers."Output schema / $schemaPrevious value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema"Output schema / properties / event / properties / apiId / descriptionAdded value: +"Caller-chosen API identifier; not a certified provider identity."Output schema / properties / event / properties / exchangeId / descriptionAdded value: +"Stable identifier for one declared HTTP exchange."Output schema / properties / event / properties / requestHeadersHash / descriptionAdded value: +"SHA-256 of locally canonicalized selected request headers. Never send raw headers."Output schema / properties / event / properties / responseHeadersHash / descriptionAdded value: +"SHA-256 of locally canonicalized selected response headers."verify_api_receipt8 fields changedInput schema / $schemaPrevious value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema"Input schema / properties / event / properties / apiId / descriptionAdded value: +"Caller-chosen API identifier; not a certified provider identity."Input schema / properties / event / properties / exchangeId / descriptionAdded value: +"Stable identifier for one declared HTTP exchange."Input schema / properties / event / properties / requestHeadersHash / descriptionAdded value: +"SHA-256 of locally canonicalized selected request headers. Never send raw headers."Input schema / properties / event / properties / responseHeadersHash / descriptionAdded value: +"SHA-256 of locally canonicalized selected response headers."Output schema / $schemaPrevious value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema"Output schema / properties / apiId / descriptionAdded value: +"Caller-chosen API identifier; not a certified provider identity."Output schema / properties / exchangeId / descriptionAdded value: +"Stable identifier for one declared HTTP exchange."issue_api_receipt4 fields changedInput schema / properties / event / properties / requestBodyHash / descriptionAdded value: +"SHA-256 of exact application request bytes; null means no body, not an empty body."Input schema / properties / event / properties / responseBodyHash / descriptionAdded value: +"SHA-256 of exact application response bytes after HTTP decoding. Preserve those bytes; do not reserialize JSON."Input schema / properties / event / properties / targetHash / descriptionAdded value: +"SHA-256 of the exact UTF-8 target URL, computed locally. Never invent a digest or send the URL itself."Input schema / properties / idempotencyKey / descriptionAdded value: +"One stable key per purchase, saved before payment. Keep it, the event and original payment authorization unchanged on retries."prepare_api_exchange6 fields changedInput schema / properties / event / properties / requestBodyHash / descriptionAdded value: +"SHA-256 of exact application request bytes; null means no body, not an empty body."Input schema / properties / event / properties / responseBodyHash / descriptionAdded value: +"SHA-256 of exact application response bytes after HTTP decoding. Preserve those bytes; do not reserialize JSON."Input schema / properties / event / properties / targetHash / descriptionAdded value: +"SHA-256 of the exact UTF-8 target URL, computed locally. Never invent a digest or send the URL itself."Output schema / properties / event / properties / requestBodyHash / descriptionAdded value: +"SHA-256 of exact application request bytes; null means no body, not an empty body."Output schema / properties / event / properties / responseBodyHash / descriptionAdded value: +"SHA-256 of exact application response bytes after HTTP decoding. Preserve those bytes; do not reserialize JSON."Output schema / properties / event / properties / targetHash / descriptionAdded value: +"SHA-256 of the exact UTF-8 target URL, computed locally. Never invent a digest or send the URL itself."verify_api_receipt3 fields changedInput schema / properties / event / properties / requestBodyHash / descriptionAdded value: +"SHA-256 of exact application request bytes; null means no body, not an empty body."Input schema / properties / event / properties / responseBodyHash / descriptionAdded value: +"SHA-256 of exact application response bytes after HTTP decoding. Preserve those bytes; do not reserialize JSON."Input schema / properties / event / properties / targetHash / descriptionAdded value: +"SHA-256 of the exact UTF-8 target URL, computed locally. Never invent a digest or send the URL itself."issue_api_receipt1 field changedOutput schema / (root)Previous value: -{
- "$schema": "http://json-schema.org/draft-07/schema#",
- "additionalProperties": false,
- "properties": {
- "event": {
- "additionalProperties": false,
- "properties": {
- "apiId": {
- "pattern": "^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$",
- "type": "string"
- },
- "attestation": {
- "const": "client_declared",
- "type": "string"
- },
- "bodyEncoding": {
- "const": "application_bytes",
- "type": "string"
- },
- "completedAt": {
- "format": "date-time",
- "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d\\.\\d{3}(?:Z))$",
- "type": "string"
- },
- "exchangeId": {
- "pattern": "^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$",
- "type": "string"
- },
- "headerEncoding": {
- "const": "jcs-selected-headers-v1",
- "type": "string"
- },
- "method": {
- "enum": [
- "GET",
- "HEAD",
- "POST",
- "PUT",
- "PATCH",
- "DELETE",
- "OPTIONS"
- ],
- "type": "string"
- },
- "requestBodyHash": {
- "anyOf": [
- {
- "additionalProperties": false,
- "properties": {
- "algorithm": {
- "const": "sha256",
- "type": "string"
- },
- "digest": {
- "pattern": "^[a-f0-9]{64}$",
- "type": "string"
- }
- },
- "required": [
- "algorithm",
- "digest"
- ],
- "type": "object"
- },
- {
- "type": "null"
- }
- ]
- },
- "requestHeadersHash": {
- "additionalProperties": false,
- "properties": {
- "algorithm": {
- "const": "sha256",
- "type": "string"
- },
- "digest": {
- "pattern": "^[a-f0-9]{64}$",
- "type": "string"
- }
- },
- "required": [
- "algorithm",
- "digest"
- ],
- "type": "object"
- },
- "responseBodyHash": {
- "anyOf": [
- {
- "additionalProperties": false,
- "properties": {
- "algorithm": {
- "const": "sha256",
- "type": "string"
- },
- "digest": {
- "pattern": "^[a-f0-9]{64}$",
- "type": "string"
- }
- },
- "required": [
- "algorithm",
- "digest"
- ],
- "type": "object"
- },
- {
- "type": "null"
- }
- ]
- },
- "responseHeadersHash": {
- "additionalProperties": false,
- "properties": {
- "algorithm": {
- "const": "sha256",
- "type": "string"
- },
- "digest": {
- "pattern": "^[a-f0-9]{64}$",
- "type": "string"
- }
- },
- "required": [
- "algorithm",
- "digest"
- ],
- "type": "object"
- },
- "startedAt": {
- "format": "date-time",
- "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d\\.\\d{3}(?:Z))$",
- "type": "string"
- },
- "status": {
- "maximum": 599,
- "minimum": 200,
- "type": "integer"
- },
- "targetHash": {
- "additionalProperties": false,
- "properties": {
- "algorithm": {
- "const": "sha256",
- "type": "string"
- },
- "digest": {
- "pattern": "^[a-f0-9]{64}$",
- "type": "string"
- }
- },
- "required": [
- "algorithm",
- "digest"
- ],
- "type": "object"
- },
- "version": {
- "const": "datoka.api.exchange.v1",
- "type": "string"
- }
- },
- "required": [
- "version",
- "attestation",
- "apiId",
- "exchangeId",
- "method",
- "status",
- "startedAt",
- "completedAt",
- "targetHash",
- "requestBodyHash",
- "responseBodyHash",
- "requestHeadersHash",
- "responseHeadersHash",
- "bodyEncoding",
- "headerEncoding"
- ],
- "type": "object"
- },
- "receipt": {
- "additionalProperties": false,
- "properties": {
- "algorithm": {
- "const": "Ed25519",
- "type": "string"
- },
- "body": {
- "additionalProperties": false,
- "properties": {
- "id": {
- "format": "uuid",
- "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$",
- "type": "string"
- },
- "issuedAt": {
- "format": "date-time",
- "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d\\.\\d{3}(?:Z))$",
- "type": "string"
- },
- "issuer": {
- "pattern": "^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$",
- "type": "string"
- },
- "keyId": {
- "pattern": "^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$",
- "type": "string"
- },
- "previous": {
- "anyOf": [
- {
- "pattern": "^[a-f0-9]{64}$",
- "type": "string"
- },
- {
- "type": "null"
- }
- ]
- },
- "request": {
- "additionalProperties": false,
- "properties": {
- "chain": {
- "pattern": "^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$",
- "type": "string"
- },
- "eventType": {
- "pattern": "^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$",
- "type": "string"
- },
- "scope": {
- "pattern": "^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$",
- "type": "string"
- },
- "subject": {
- "additionalProperties": false,
- "properties": {
- "algorithm": {
- "const": "sha256",
- "type": "string"
- },
- "digest": {
- "pattern": "^[a-f0-9]{64}$",
- "type": "string"
- },
- "encoding": {
- "enum": [
- "jcs",
- "bytes"
- ],
- "type": "string"
- }
- },
- "required": [
- "algorithm",
- "encoding",
- "digest"
- ],
- "type": "object"
- }
- },
- "required": [
- "scope",
- "chain",
- "eventType",
- "subject"
- ],
- "type": "object"
- },
- "sequence": {
- "exclusiveMinimum": 0,
- "maximum": 9007199254740991,
- "type": "integer"
- },
- "version": {
- "const": "datoka.receipt.v1",
- "type": "string"
- }
- },
- "required": [
- "version",
- "id",
- "issuer",
- "keyId",
- "issuedAt",
- "request",
- "sequence",
- "previous"
- ],
- "type": "object"
- },
- "signature": {
- "pattern": "^[A-Za-z0-9_-]{86}$",
- "type": "string"
- }
- },
- "required": [
- "body",
- "algorithm",
- "signature"
- ],
- "type": "object"
- }
- },
- "required": [
- "event",
- "receipt"
- ],
- "type": "object"
-}New value: +nullget_api_public_keysissue_api_receiptprepare_api_exchangeverify_api_receiptSigned declarations of agent execution steps for verifiable handoffs. Free preparation and verification; receipt issuance costs 0.002 USDC via x402 on Base. MCP, REST and A2A. Connect: https://datoka.dev/agent. Signatures do not independently verify execution.
Webhook delivery for agents and workflows, with encrypted queues, retries and signed relay observations. 100 free admissions per hook/day; extra pack: 0.10 USDC for 100. Setup and n8n guide: https://datoka.dev/hooks. Recipients must deduplicate events.
Signed attestations for agents, $0.01/call via x402: URL witness, AI permission, tx finality, JWKS.
Pay-per-call MCP tools for agents, settled with x402 (USDC on Base mainnet). 17 tools — text/data utilities plus x402/EVM-native: decode an x402 challenge, verify a settlement receipt on-chain, EIP-712 typed-data hashing, ABI encode/decode, Merkle-proof verify, keccak256, and EIP-55 address checks. No API keys.
Add one secure layer between your agents and this server.
