One daemon, several surfaces
The API, MCP interface, CLI, SDKs, and operator console all use the same daemon. Custom branding changes the console's appearance, not how controls work. Policy, capability registrations, and application credentials remain in the daemon. Operators use the operator console served by the AAES process on a separate listener.
Terminology. A record is a sealed journal entry. A receipt is the API object describing decision and effect evidence; a read view is its JSON projection. An export is the bundle supplied to the offline verifier: an API response is not automatically a complete verification export. A grant is authorization material, not proof of execution.
Start an evaluation
Request the package, install on a test host, and run one bounded workflow you can check.
HTTP API
Decide actions, request access, and read receipts through the OpenAPI 3.1 contract. /v1/action records a decision and, when allowed, mints a grant; it does not execute the downstream action.
MCP
Connect over stdio or HTTP. Discover built-in tools followed by the capabilities this caller may use. HTTP tools/call sends an operator-issued bearer token.
CLI
Operate with aaesctl, verify exported journals offline, and manage local tenant registries with aaescp.
SDKs
Integrate with Go, Python, or TypeScript from the evaluation archive. The SDK methods page lists authorization scope for each entry point.
White label
Set operator-console colors, type, and logo per tenant, or build your own UI on the OpenAPI contract and SDKs.
Connect to your daemon
AAES_ENDPOINT identifies the daemon address configured by platformd -listen. The default is http://127.0.0.1:8090. The daemon does not terminate TLS by default. AAES_TOKEN holds an operator-issued bearer token. The credential resolves the tenant, so callers do not pick a tenant on API calls. There is no hosted API-key dashboard.
Once your operator provides a running deployment and a token, set both environment variables and read the capabilities this caller may use:
curl -sS "$AAES_ENDPOINT/v1/capabilities" -H "Authorization: Bearer $AAES_TOKEN"Capabilities describe what the caller may use. The catalogue describes what the caller may ask for. Refusals are JSON with a reason and, when the daemon can identify the smallest satisfying change, a remedy.
Public docs and the evaluation package
Start with the evaluation guide and download the OpenAPI 3.1 contract without sign-in. The SDK methods page lists language entry points and authorization scope. Request package access for binaries, aaesctl, SDKs, release-verification public keys, and setup notes. Remaining setup notes ship with the evaluation package.