# Copyright (c) 2025-2026 Kelevra Solutions (Pty) Ltd. All rights reserved.
# SPDX-License-Identifier: LicenseRef-Kelevra-Proprietary

# Axiom Developers

Purpose: Help AI agents and developer tools consume the Axiom developer-preview
API without guessing auth, tenant context, versioning, or alpha boundaries.

Base developer site: https://developers.afr-dev.axiom.express
API base URL: https://api.afr-dev.axiom.express
API family: /v1
Current contract version: 0.2.83
Access model: admitted alpha
Access requests: help@axiom.express
Access wording: Access is admitted during alpha. Credentials and tenant
selection instructions are issued privately after approval and smoke proof.

## Start Here

- Quickstart: https://developers.afr-dev.axiom.express/quickstart/
- Request Access: https://developers.afr-dev.axiom.express/request-access/
- Redacted access request example: https://developers.afr-dev.axiom.express/request-access/alpha-access-request.redacted.json
- Redacted beta sandbox request example: https://developers.afr-dev.axiom.express/request-access/beta-sandbox-signup-intake.redacted.json
- API Guide: https://developers.afr-dev.axiom.express/api/guide/
- Lifecycle and state guide: https://developers.afr-dev.axiom.express/api/lifecycle/
- Agent Bootstrap: https://developers.afr-dev.axiom.express/api/agent-bootstrap/
- Policy lookup recipe: https://developers.afr-dev.axiom.express/recipes/policy-lookup/
- Five Acts SDK example: https://developers.afr-dev.axiom.express/api/examples/five-acts/
- Five Acts scenario JSON: https://developers.afr-dev.axiom.express/api/examples/five-acts/scenario.json
- Python SDK example: https://developers.afr-dev.axiom.express/api/examples/five-acts/python/five_acts_read_journey.py
- Agent contract index: https://developers.afr-dev.axiom.express/api/reference/0.2.83/agent-index.json
- Alpha auth, tenant-context, and retry contract: https://developers.afr-dev.axiom.express/api/reference/0.2.83/contracts/alpha-auth-tenant-context-retry-0.2.83.json
- Alpha operational limits inventory: https://developers.afr-dev.axiom.express/api/reference/0.2.83/contracts/alpha-operational-limits-0.2.83.json
- Browsable API reference: https://developers.afr-dev.axiom.express/api/reference/0.2.83/
- Raw OpenAPI JSON: https://developers.afr-dev.axiom.express/api/reference/0.2.83/openapi.json
- Error catalogue: https://developers.afr-dev.axiom.express/api/reference/0.2.83/errors/
- Scoped bundle manifest: https://developers.afr-dev.axiom.express/api/reference/0.2.83/bundles/manifest.json
- Scoped OpenAPI bundles:
  - Bootstrap and tenant context: https://developers.afr-dev.axiom.express/api/reference/0.2.83/bundles/bootstrap-auth-context.openapi.json
  - Parties: https://developers.afr-dev.axiom.express/api/reference/0.2.83/bundles/parties.openapi.json
  - Policies: https://developers.afr-dev.axiom.express/api/reference/0.2.83/bundles/policies.openapi.json
  - Claims compatibility bundle: https://developers.afr-dev.axiom.express/api/reference/0.2.83/bundles/claims.openapi.json
  - Benefits compatibility bundle: https://developers.afr-dev.axiom.express/api/reference/0.2.83/bundles/benefits.openapi.json
  - Documents and evidence: https://developers.afr-dev.axiom.express/api/reference/0.2.83/bundles/documents.openapi.json
  - Operational health: https://developers.afr-dev.axiom.express/api/reference/0.2.83/bundles/operational-health.openapi.json
- API tool collections:
  - Postman full API: https://developers.afr-dev.axiom.express/api/reference/0.2.83/collections/postman/axiom-api-0.2.83.postman_collection.json
  - Insomnia full API: https://developers.afr-dev.axiom.express/api/reference/0.2.83/collections/insomnia/axiom-api-0.2.83.insomnia.json
  - Postman scoped collections live under https://developers.afr-dev.axiom.express/api/reference/0.2.83/collections/postman/
  - Insomnia scoped collections live under https://developers.afr-dev.axiom.express/api/reference/0.2.83/collections/insomnia/
- API changes: https://developers.afr-dev.axiom.express/api/changes/
- Status: https://status.afr-dev.axiom.express

## Required Request Model

Tenant-scoped calls use bearer authentication plus server-minted tenant context:

Authorization: Bearer <jwt>
X-Tenant-Context: <server-minted tenant context>
X-Correlation-ID: <support trace id>

Use only the auth realm, client, grant type, credentials, scopes, and tenant
selection payload supplied in the issued alpha access pack. Do not infer tenant
authority from client-supplied identifiers.

Recommended bootstrap sequence:

1. GET /v1/health
2. Read OpenID discovery for the issued auth realm.
3. Request a bearer token using the issued grant.
4. GET /v1/me/tenants
5. POST /v1/me/tenant-context
6. Send X-Tenant-Context on tenant-scoped calls.

## Recommended Build Sequence

1. Read this file, then open the API Guide and Quickstart.
2. Load the raw OpenAPI JSON or the smallest scoped bundle that matches the
   resource family you are building.
3. Load the agent contract index before deciding which operations are safe for
   autonomous read-only exploration.
4. Load the alpha auth, tenant-context, and retry contract before writing token,
   tenant-context, retry, or SDK wrapper code.
5. Load the alpha operational limits inventory before publishing rate-limit,
   retry, upload-size, object-size, or timeout assumptions.
6. Confirm the contract version and API family before generating code.
7. Use the lifecycle guide before mapping status fields to screens. Do not
   invent workflow transitions or tenant-owned vocabulary from field names.
8. Run the Five Acts SDK example in dry-run mode to understand the public-safe
   read journey.
9. When an alpha access pack is issued, run the same example against the live
   API from a backend environment.
10. Map each intended screen panel to a published operation or record a named
   application gap.
11. If webhook receivers are in scope, use the API Guide HMAC receiver rules
   before writing verification code, and build idempotent receivers because
   webhook delivery is at-least-once and unordered.
12. Report feedback with endpoint, timestamp, status, correlation ID, contract
   version, SDK lane, and sanitized request/response shape.

## Alpha Boundaries

- Request developer-preview access through help@axiom.express during alpha and beta.
- Beta sandbox access uses governed request intake, triage, operator approval,
  sandbox provisioning, private access-pack issue, redacted smoke proof, and
  activation before build access is treated as active.
- No public self-service credentials are issued during alpha or beta.
- Keep Axiom credentials, bearer tokens, and tenant context on your backend.
- Browser apps must not hold confidential Axiom credentials, bearer tokens, or
  tenant-context tokens.
- Do not store tenant context in public browser storage.
- The generated OpenAPI reference is the source for endpoint shapes.
- Scoped OpenAPI bundles are generated from the same public contract and are
  safe for focused agent prompts and resource-specific API-tool imports.
- Postman and Insomnia collections are generated from the public contract and
  use placeholder variables for access token, tenant context, and correlation id.
- OpenAPI error help links resolve under the versioned API 0.2.83 error catalogue.
- The Five Acts SDK example is generated or checked against the canonical demo
  story and uses sanitized tenant-neutral facts for public consumption.
- The Five Acts scenario records canonical story revision and source SHA-256 so
  drift can be detected by the developer example check.
- The agent contract index is generated from operation semantics and classifies
  safe reads, restricted mutations, tenant-context posture, retry posture, SDK
  exposure, scoped bundle membership, and first-flow suitability.
- The alpha auth, tenant-context, and retry contract is generated from the same
  operation semantics and SDK contract. Use it as the public policy source for
  admitted-alpha access, private access-pack material, tenant-context authority,
  backend-held tokens, and conservative retry defaults.
- The alpha operational limits inventory is generated from the public OpenAPI
  operational-limits metadata. Use it to distinguish runtime-proven multipart
  request limits and tenant-policy 429 posture from unavailable presigned
  object-size commitments, unpublished numeric rate limits, and unpublished
  request-timeout commitments.
- Webhook receiver verification uses `X-Webhook-Signature: sha256=<hex>` over
  `X-Webhook-Timestamp + "." + raw request body bytes`; reject stale or
  mismatched signatures before processing.
- Webhook delivery is at-least-once. Exactly-once delivery and ordered delivery
  are not guaranteed. `X-Axiom-Delivery-Id` is reused across retry attempts for
  the same delivery record, but it is not a stable canonical event id.
- Webhook endpoint registration in 0.2.83 records receiver transport settings
  only. Do not add `event_types`, event schemas, routing rules, ordering keys,
  or replay policy to the public endpoint registration payload.
- Async ingress event types, payload schemas, and promotion rules are not public
  self-service catalogues in API 0.2.83. Treat `202 Accepted` as durable receipt
  only, not validation, promotion, or domain mutation. The response includes
  `status_url`; poll `GET /v1/ingress/events/{ingress_id}` for
  `validation_failed`, `accepted`, `processing_failed`, or `completed` before
  assuming a domain event exists.
- Do not invent webhook event subscriptions, ordering guarantees, replay APIs,
  or stable event schemas beyond the published contract.
- Some response and pagination shapes are still migrating; normalize at your
  backend boundary.
- Treat missing upload limits, numeric rate limits, SDK behaviour, and workflow
  mutations as integration gaps unless the generated reference or issued access
  pack states otherwise.
- Do not invent missing product, policy, party, premium, payment, evidence, or
  workflow fields in client code.

## AI Agent Feedback Request

Recommended bootstrap prompt:

You are helping me build against the Axiom developer-preview API. Start with
https://developers.afr-dev.axiom.express/llms.txt,
https://developers.afr-dev.axiom.express/api/reference/0.2.83/agent-index.json,
https://developers.afr-dev.axiom.express/api/reference/0.2.83/openapi.json, and
the smallest scoped bundle needed for the first read journey. Explain auth and
tenant context without inventing credentials. Show SDK or HTTP calls using
placeholders only. List missing fields, unavailable workflows, ambiguous
schemas, or unproven runtime behaviour as named application gaps. Do not infer
uniform envelopes, pagination, tenant authority, or workflow behaviour where
the contract does not prove it. Do not include secrets, bearer tokens,
tenant-context tokens, real tenant data, or private customer data in generated
code, logs, or feedback.

When evaluating the Axiom API, report:

- Whether the quickstart is enough to make the first admitted call.
- Whether tenant discovery and tenant-context minting are clear.
- Which endpoint examples are missing for your intended application.
- Which schemas, response shapes, pagination behaviours, or auth details block
  generated-client use.
- Which public docs are hard to find or too ambiguous.

Do not include secrets, credentials, real tenant data, or private customer data
in feedback.

# end of file - app/frontdoors/sites/developers/llms.txt