SwiftAPI Authority Documentation

System Overview

AI Agent
   │
   ▼
SwiftAPI Trust Authority (swiftapi.ai)
   │  ── issues signed attestations
   ▼
Mandatory Enforcement Point (K8s Admission, Proxy, Gateway)
   │
   ▼
Execution Allowed or Denied
        

SwiftAPI does not execute actions. It does not run agents. It does not bypass enforcement. It issues verifiable permission artifacts that external enforcement points validate before allowing execution.

Quick Start (Python SDK)

The recommended way to integrate SwiftAPI is via the official Python SDK. It handles cryptographic verification, fail-closed logic, and revocation checks automatically.

1. Installation

pip install swiftapi-python

2. Integration (The "Golden Loop")

Wrap your dangerous functions in the Enforcement guard. This ensures no action runs without a signed attestation from the Authority.

from swiftapi import SwiftAPI, Enforcement

# Initialize with your Authority Key
api = SwiftAPI(key="swiftapi_live_...")
guard = Enforcement(api)

def destructive_action():
    # This code is effectively dead unless SwiftAPI unlocks it
    print("Dropping production database...")

# Execute with Governance
try:
    guard.run(
        func=destructive_action,
        action="database_drop",
        intent="Schema cleanup script"
    )
except Exception as e:
    print(f"BLOCKED: {e}")
    # Output: "Blocked by policy 'no_database_drop'"

Why use the SDK?

• Automatic Ed25519 Verification: The SDK locally validates the cryptographic signature of every attestation before allowing execution.
• Double-Check Protocol: It automatically performs a real-time revocation check to prevent replay attacks.
• Fail-Closed: If the network is down or the key is invalid, execution is physically impossible.

View on PyPI

Drop-in OpenAI Replacement

Change one import. Every inference call is now attested. No other code changes required.

Before (unattested)

from openai import OpenAI
client = OpenAI(api_key="sk-...")

After (attested)

from swiftapi import OpenAI
client = OpenAI(
    swiftapi_key="swiftapi_live_...",
    openai_key="sk-..."
)

You bring both keys. SwiftAPI governs. OpenAI executes. The SDK attests each call with the trust authority, then calls OpenAI directly with your own key. Your credits. Your model. SwiftAPI just decides whether it happens.

response = client.chat.completions.create(
    model="gpt-4o",
    messages=[{"role": "user", "content": "Hello"}]
)
print(response.choices[0].message.content)
# If policy denies: empty string (void)
# If approved: normal completion from OpenAI

If the authority denies the action, the response content is an empty string. No error. No exception. Void. The action never happened. Your OpenAI key is never sent to SwiftAPI.

Drop-in Anthropic Replacement

Same pattern. Change one import. Every Claude call is now attested.

Before (unattested)

from anthropic import Anthropic
client = Anthropic(api_key="sk-ant-...")

After (attested)

from swiftapi import Anthropic
client = Anthropic(
    swiftapi_key="swiftapi_live_...",
    anthropic_key="sk-ant-..."
)

You bring both keys. SwiftAPI governs. Anthropic executes. The SDK attests each call with the trust authority, then calls Anthropic directly with your own key. Your credits. Your model. SwiftAPI just decides whether it happens.

response = client.messages.create(
    model="claude-sonnet-4-5-20250929",
    max_tokens=1024,
    messages=[{"role": "user", "content": "Hello"}]
)
print(response.content[0].text)
# If policy denies: empty string (void)
# If approved: normal completion from Anthropic

If the authority denies the action, the response content is an empty string. No error. No exception. Void. The action never happened. Your Anthropic key is never sent to SwiftAPI.

Authority Keys

Authority keys grant the ability to exercise governance over the trust authority.

Scopes

Each authority key is granted specific scopes that define its capabilities.

A key without the required scope cannot exercise that authority under any circumstance.

Enforcement Model

SwiftAPI enforcement is mandatory when integrated with a Mandatory Enforcement Point (MEP) such as:

• Kubernetes Validating Admission Controller
• Network Egress Proxy
• API Gateway
• Sidecar or runtime hook

In a correctly deployed environment, execution physically cannot occur without a valid SwiftAPI attestation.

Attestations

Attestations are cryptographically signed tokens that authorize specific actions.

Governance Events

All governance events are logged and cryptographically signed:

• Verification attempts (success and failure)
• Denial events with reasons
• Policy changes (proposals, approvals, activations)
• Grant creation and revocation
• Attestation revocations
• Key issuance and revocation

All governance events are cryptographically signed and non-repudiable.

What SwiftAPI Is Not

• An AI agent framework
• A prompt safety system
• A monitoring or logging tool
• A policy suggestion engine
• A runtime sandbox
• An execution environment

SwiftAPI is exclusively a trust authority. It issues verifiable governance artifacts. Enforcement is delegated to external systems.

Obtaining Authority

Authority keys with verify scope are issued instantly at getswiftapi.com/request.

For enterprise access with custom policies, HSM-backed keys, and additional scopes, contact the authority operator directly.

Endpoints Reference

Public Endpoints

Protected Endpoints (Require Authority Key)

All protected endpoints require the X-SwiftAPI-Authority header with a valid key.