Loading…
Every endpoint is verdicted by the policy engine and written to the ledger. Build a buyer agent in an afternoon.
APIPath is always request → mandate verify → policy engine → (ALLOW only) payment adapter. The model never touches money.
Creates a signed mandate for a demo buyer (₹2,000, handloom + gifts). Use the token as a Bearer header or in request bodies.
/api/mandate/issueMint a signed buyer mandate (demo helper).
Request
curl -X POST "http://localhost:3000/api/mandate/issue" -H "Content-Type: application/json" -d '{ "agent_id": "buyer-agent-demo", "user_ref": "priya@example.com", "spend_cap_paise": 200000, "category_scope": ["handloom", "gifts"], "ttl_seconds": 3600 }'Response
{ "ok": true, "token": "<jwt>", "mandate": { "id": "mnd_…", "cap": "₹2,000", "scope": "handloom, gifts", "expires_at": "…" } }/api/agent/discover?q=gift+for+mom&k=5Search the catalog. Optional Bearer mandate narrows results to its scope.
Request
curl "http://localhost:3000/api/agent/discover?q=gift+for+mom&k=5" -H "Authorization: Bearer <jwt>"
Response
{ "ok": true, "search_mode": "embedding", "results": [ { "sku": { "id": "sku_cotton-handloom-saree", "name": "Cotton Handloom Saree", "price_paise": 149900 }, "score": 5.21, "sellable": true } ] }/api/agent/offerPrice a basket and get the verdict without the chat.
Request
curl -X POST "http://localhost:3000/api/agent/offer" -H "Content-Type: application/json" -d '{ "mandate_token": "<jwt>", "sku_ids": ["sku_cotton-handloom-saree", "sku_matching-blouse-piece"], "qty": 1 }'Response
{ "ok": true, "offer": { "id": "off_…", "total_paise": 184900 }, "verdict": { "decision": "ALLOW", "reason_code": "OK", "human_reason": "₹1,849 is inside every rule…", "policy_checks": [ … ] } }/api/agent/negotiateOne buyer message → one seller reply with every verdict the turn produced.
Request
curl -X POST "http://localhost:3000/api/agent/negotiate" -H "Content-Type: application/json" -d '{ "mandate_token": "<jwt>", "message": "anniversary gift for mom, budget ₹2000", "lang": "en" }'Response
{ "ok": true, "session_id": "ses_…", "reply": "…", "events": [ { "action": "offer", "verdict": { "decision": "ALLOW" }, "amount_paise": 184900, "offer_id": "off_…" } ], "offer": { … }, "order": null, "mode": "openai" }/api/agent/checkoutTurn an accepted offer into an order; ALLOW issues the payment link, GATE parks it for the owner.
Request
curl -X POST "http://localhost:3000/api/agent/checkout" -H "Content-Type: application/json" -d '{ "mandate_token": "<jwt>", "offer_id": "off_…" }'Response
{ "ok": true, "verdict": { "decision": "ALLOW" }, "order": { "id": "ord_…", "status": "AWAITING_PAYMENT" }, "payment_url": "https://rzp.io/…" }/api/webhook/razorpayRazorpay → AgentGate. Signature is verified on the raw body before anything is parsed.
Request
curl -X POST "http://localhost:3000/api/webhook/razorpay" -H "Content-Type: application/json" -d '{}'Response
{ "ok": true, "duplicate": false, "order": { "id": "ord_…", "status": "PAID" } }/api/ledger?view=shopkeeper&limit=50The book, newest first; shopkeeper view adds one plain sentence per entry.
Request
curl "http://localhost:3000/api/ledger?view=shopkeeper&limit=50" -H "Authorization: Bearer <jwt>"
Response
{ "ok": true, "chain": { "count": 42, "intact": true, "head_hash": "…" }, "entries": [ { "verdict": "PAID", "amount_paise": 184900, "human_reason": "…", "plain": "₹1,849 आ गए — payment ho gayi…" } ] }/api/statsRevenue via AI, upsell, guarded actions, ledger integrity, modes, latest evidence.
Request
curl "http://localhost:3000/api/stats" -H "Authorization: Bearer <jwt>"
Response
{ "ok": true, "stats": { "revenue_paise": 184900, "upsell_paise": 35000, "actions_guarded": 3, "ledger_intact": true }, "eval": { "breaches": 0, "attacks": 40 }, "modes": { "llm": "openai", "payments": "razorpay", "voice": "sarvam" } }Three tools that proxy this API for Claude Desktop and other MCP clients — search, offer, checkout. They never bypass the engine.
{
"mcpServers": {
"agentgate": {
"command": "cmd",
"args": ["/c", "npx", "tsx", "K:/hacks/razorpay/mcp/server.ts"],
"env": { "AGENTGATE_URL": "http://localhost:3000" }
}
}
}Point a test-mode webhook at /api/webhook/razorpay for payment_link.paid and payment.failed with your RAZORPAY_WEBHOOK_SECRET. Without a public URL the app reconciles awaiting orders from Razorpay's own record on every poll.
ngrok http 3000 # Razorpay Dashboard → Webhooks → https://<ngrok>/api/webhook/razorpay # events: payment_link.paid, payment.failed · secret: RAZORPAY_WEBHOOK_SECRET