A signed plan is an endpoint.
Work does not have to start with a person at a console. Your CRM, your data pipeline, your internal app or a schedule can start a plan that a person already signed, and the run is governed exactly the same way.
Five steps, and nothing new to trust.
| Step | What happens |
|---|---|
| Sign the plan once | A person signs it in the console. The API can only start plans that are signed and unchanged: edit the plan or a specialist and the call is refused until someone signs again. |
| Mint a key | A key belongs to one tenant and carries only the permissions you give it. It can expire on a date and be restricted to your own network ranges, and it is stored hashed. |
| Post the inputs | The plan declares what it needs; your call sends those fields and your own record id. Send the same request twice with the same key and you get the same run back, never a second one. |
| Watch it, or wait | Poll one address for status, cost and structured results, or follow the live progress. Your record id comes back on everything. |
| Collect the work | Download what the run produced, or have it delivered: a webhook, a signed callback into your system, object storage, a shared drive, or a chat channel. A failed delivery retries and can be re-sent. |
The API triggers work; it never builds it. Packs, plans and specialists are made in the console and approved by people: nothing can be installed or changed through a key.
The same limits a person gets.
It stops rather than warns.
A dollar ceiling per run and per tenant, a cap on concurrent runs, and a turn limit per step. You can halt a run you started.
One tenant, one workspace.
A key reaches only its own tenant’s workspace and plans. Another tenant’s run reads as missing, never as forbidden.
Attributable afterwards.
Every triggered run lands in the same ledger as a run a person started: who or what started it, what it cost, what it produced, and where it was delivered.
Bring the system you want it to start from.
A CRM record, a row in a warehouse, a file landing in a folder. We wire one trigger with you, and you watch the run come back.