Developer Preview

Agent Bootstrap

Give an AI agent the smallest safe context needed to consume the API.

Start from the governed 0.1.0 contract, use scoped bundles and generated examples, and keep alpha access material out of prompts unless your execution environment is private and approved. Access is admitted during alpha. Credentials and tenant selection instructions are issued privately after approval and smoke proof.

Bootstrap Packet

Surface Use it for
llms.txt Agent-readable map of the current developer-preview API surfaces.
Agent contract index Generated operation safety, tenant-context, retry, SDK, bundle, and first-flow classifications.
Alpha auth, tenant-context, and retry contract Generated public policy for admitted-alpha access, private access-pack material, backend-held tokens, tenant authority, and retry defaults.
Raw OpenAPI JSON Complete machine-readable contract for API tools, code generation, and schema inspection.
Bootstrap bundle Health, admitted tenant discovery, and tenant-context setup.
Parties bundle Identity, contact, relationship, and party context for read journeys.
Policies bundle Policy and product read journeys.
Claims bundle Claim list, detail, and output-document journeys.
Five Acts example Dry-run SDK flow and public-safe scenario facts.
Postman and Insomnia collections Generated imports using placeholder variables for token, tenant context, base URL, and correlation id.

Ready-To-Copy Prompt

Use this prompt with an AI coding agent before you give it private credentials or tenant-owned payloads. 

You are helping me build against the Axiom developer-preview API.

Start with these public surfaces:
- Developer site: https://developers.afr-dev.axiom.express
- Agent map: https://developers.afr-dev.axiom.express/llms.txt
- Agent contract index: https://developers.afr-dev.axiom.express/api/reference/0.1.1/agent-index.json
- Alpha auth, tenant-context, and retry contract: https://developers.afr-dev.axiom.express/api/reference/0.1.1/contracts/alpha-auth-tenant-context-retry-0.1.0.json
- API reference: https://developers.afr-dev.axiom.express/api/reference/0.1.1/
- OpenAPI JSON: https://developers.afr-dev.axiom.express/api/reference/0.1.1/openapi.json
- Five Acts example: https://developers.afr-dev.axiom.express/api/examples/five-acts/

Tasks:
1. Start with GET /v1/health, then authenticate through the issued private access pack.
2. Call GET /v1/me/tenants before choosing a tenant.
3. Call POST /v1/me/tenant-context with the selected tenant_id placeholder before tenant-scoped calls.
4. Identify the smallest first read journey I can build.
5. Load only the full OpenAPI or scoped bundle needed for that journey.
6. Load the alpha auth, tenant-context, and retry contract before writing token, tenant-context, retry, or SDK wrapper code.
7. Explain the auth and tenant-context sequence without inventing credentials.
8. Show the SDK or HTTP calls I should make using placeholders only.
9. List every missing field, unavailable workflow, or ambiguous response shape as a named application gap.
10. Do not infer uniform envelopes, pagination, tenant authority, or workflow behaviour where the contract does not prove it.
11. If webhook receivers are in scope, use only the documented HMAC rule: X-Webhook-Signature is sha256=<hex> over X-Webhook-Timestamp + "." + raw request body bytes, reject stale or mismatched signatures before processing, and build idempotent receivers because webhook delivery is at-least-once and unordered.
12. Produce feedback that includes endpoint, contract version, SDK lane, expected request shape, expected response shape, and the exact doc location that was unclear.

Do not include secrets, bearer tokens, tenant-context tokens, real tenant data, or private customer data in generated code, logs, or feedback.

Safe Execution Rules

  • Use placeholders until an approved private access pack is issued.
  • Keep bearer tokens and tenant-context tokens on the backend.
  • Do not give browser applications confidential Axiom credentials, bearer tokens, or tenant-context tokens.
  • Use X-Tenant-Context only with a server-minted tenant context token.
  • Do not treat a tenant id in a path, payload, filename, or prompt as tenant authority.
  • Do not configure automatic retries for mutations unless a future contract explicitly proves idempotency and retry safety.
  • Do not add event_types, event schemas, routing rules, ordering keys, or replay policy to webhook endpoint registration unless a future contract publishes those fields.
  • Do not infer async ingress event_type values, payload schemas, or promotion rules from examples; 202 Accepted means durable boundary acceptance only.
  • Do not invent webhook event subscriptions, exactly-once delivery, ordering guarantees, replay APIs, or stable event schemas beyond the published contract.
  • Run the Five Acts example in dry-run mode before live calls.
  • Record missing behaviour as an application gap instead of fabricating data or UI state.

Feedback Packet

When an agent reports a problem, include only sanitized support evidence: 

contract_version: 0.1.0
api_family: /v1
surface_used: quickstart | api-reference | scoped-bundle | collection | sdk-example
endpoint: GET /v1/health
timestamp_utc: <time>
http_status: <status>
correlation_id: <sanitized correlation id>
sdk_lane: typescript | python | raw-http | api-tool
expected: <what the docs led you to expect>
actual: <what happened, without secrets or tenant data>
blocked_by: missing-example | unclear-schema | auth-question | tenant-context-question | unavailable-workflow | runtime-mismatch