Civitas Consent Manager API

v1.0.0 — Algorand-powered consent management

Quick Start

1
Register with your Algorand wallet
Provide your organization name, email, and your existing Algorand wallet address. You keep full control of your private keys.
curl -X POST https://civitas-api.civitasv.workers.dev/v1/register \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Your Org",
    "email": "dev@yourorg.com",
    "algorandAddress": "YOUR_ALGORAND_ADDRESS..."
  }'
Response:
{
  "apiKey": "cv_live_abc123...",
  "algorandAddress": "YOUR_ALGORAND_ADDRESS...",
  "message": "Save your API key securely..."
}
2
Save your API key
Your API key starts with cv_live_ and is only shown once. Store it securely. If lost, you'll need to register a new account.
3
Get whitelisted
Contact the Civitas admin to whitelist your Algorand address. This is required before you can create consent requests.
4
Build transactions
Call /v1/consent/request to build unsigned transactions. The API returns base64-encoded transactions for you to sign.
curl -X POST https://civitas-api.civitasv.workers.dev/v1/consent/request \
  -H "Authorization: Bearer cv_live_abc123..." \
  -H "Content-Type: application/json" \
  -d '{
    "userAddress": "ALGO_USER_ADDRESS...",
    "docType": 0,
    "reason": "KYC verification",
    "durationHours": 24
  }'
Response:
{
  "transactions": ["base64_txn_1...", "base64_txn_2..."],
  "groupId": "base64_group_id...",
  "requestId": 1,
  "message": "Sign these transactions..."
}
5
Sign & submit
Sign the transactions with your wallet (using algosdk, Pera, Defly, etc.) and submit the signed transactions back:
curl -X POST https://civitas-api.civitasv.workers.dev/v1/consent/submit \
  -H "Authorization: Bearer cv_live_abc123..." \
  -H "Content-Type: application/json" \
  -d '{
    "signedTransactions": ["base64_signed_txn_1...", "base64_signed_txn_2..."]
  }'
Response:
{
  "txId": "ALGO_TX_ID...",
  "status": "submitted"
}

Signing Example (JavaScript)

Use algosdk to decode, sign, and re-encode the transactions:
import algosdk from 'algosdk';

// 1. Get unsigned transactions from the API
const res = await fetch('/v1/consent/request', { ... });
const { transactions } = await res.json();

// 2. Decode and sign each transaction
const account = algosdk.mnemonicToSecretKey('your mnemonic...');
const signedTxns = transactions.map(txnB64 => {
  const txnBytes = Buffer.from(txnB64, 'base64');
  const txn = algosdk.decodeUnsignedTransaction(txnBytes);
  const signed = txn.signTxn(account.sk);
  return Buffer.from(signed).toString('base64');
});

// 3. Submit signed transactions
await fetch('/v1/consent/submit', {
  method: 'POST',
  headers: {
    'Authorization': 'Bearer cv_live_...',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({ signedTransactions: signedTxns })
});
Non-custodial: Your private keys never leave your wallet. The API only builds unsigned transactions.
Authentication: All endpoints marked Auth require the header Authorization: Bearer cv_live_...
Rate Limit: 60 requests per minute per API key.
Base URL: https://civitas-api.civitasv.workers.dev
Content-Type: application/json for all POST requests.

Registration

POST
/v1/register Public
Register with your Algorand address. Body: name, email, algorandAddress. Returns API key (shown once).

Consent Management

POST
/v1/consent/request Auth
Build unsigned transactions for a consent request. Returns base64-encoded transactions to sign. Body: userAddress, docType, reason, durationHours.
POST
/v1/consent/submit Auth
Submit signed transactions to the Algorand network. Body: signedTransactions (array of base64 signed txns).
GET
/v1/consent Auth
List all consent requests submitted by your organization.
GET
/v1/consent/:id Auth
Get details of a specific consent request by ID.
GET
/v1/consent/:id/valid Auth
Check if a consent request is currently active and valid.

Identity

GET
/v1/identity/:address Auth
List all identity documents (Aadhaar, PAN, Voter ID) for a wallet address.
GET
/v1/identity/:address/:docType Auth
Check a specific identity document. docType: 0=Aadhaar, 1=PAN, 2=Voter ID.

Organization

GET
/v1/org/profile Auth
Get your organization profile and whitelist status.
GET
/v1/org/usage Auth
View your recent API usage logs.

Agent Surface (Phase 1)

GET
/v1/agent/grants/:user Auth
List this agent's grants for a specific user.
GET
/v1/agent/read/:requestId/:field Auth
Read a single approved field; records an access log entry.
GET
/v1/agent/memory/:user Auth
Read this agent's non-PII memory facts for a user.
POST
/v1/agent/memory/:user Auth
Append/replace a memory fact.
POST
/v1/agent/step-up/request Auth
Request user approval for a sensitive irreversible action.
GET
/v1/agent/step-up/:id Auth
Poll step-up status: awaiting / approved / declined.
POST
/v1/agent/step-up/:id/decide Auth
Record the user's approve/decline decision. Returns 409 if already decided.