Developers

One API call between a proposed agent action and its consequences

Agent proposes action → one Asyrx API call → risk intelligence returned → enterprise remains in control. Asyrx never authorizes, executes or blocks the action; it returns the intelligence your systems use to decide.

Start the quickstart API reference Request sandbox access

The integration pattern

Asyrx sits between your agent's intent and your execution layer. Your orchestration code proposes the action, receives an assessment, and applies your own policy to the recommendation.

01
Your agent decides it wants to take a consequential action.
02
Before executing, your orchestration layer POSTs the proposed action to Asyrx.
03
Asyrx returns action risk, blast radius, risk factors and a recommended control.
04
Your system enforces its own policy — proceed, require approval, reduce scope or decline.

Canonical endpoint

There is a single assessment endpoint. Authenticate with a bearer API key issued to your organization.

Endpoint

POST https://asyrx.com/api/v1/actions/assess

Request body

{
  "agent_id": "agt_customer_operations_01",
  "target_system": "salesforce",
  "action_type": "crm.records.export",
  "environment": "production",
  "records_affected": 84000,
  "entities_affected": 84000,
  "data_classification": "confidential",
  "destination": "external_analytics",
  "reversibility": "partially_reversible"
}

Response (abridged)

{
  "assessment_id": "asm_…",
  "action_risk": { "score": 60, "level": "moderate", "confidence": 0.77 },
  "blast_radius": { "score": 97, "level": "critical" },
  "risk_factors": [
    "NOVEL_DESTINATION",
    "HIGH_ENTITY_COUNT",
    "SENSITIVE_DATA_EXPORT",
    "PRODUCTION_ENVIRONMENT"
  ],
  "recommended_control": { "type": "SECONDARY_APPROVAL_RECOMMENDED" },
  "recommendations": [
    "VERIFY_DESTINATION",
    "VERIFY_SCOPE",
    "CONFIRM_PRODUCTION_ENVIRONMENT"
  ]
}

Authentication uses Authorization: Bearer <api_key>. Keys are environment-scoped and issued per organization. Sandbox and production access are approval-only — there is no public self-service signup.

Documentation

Every page in the developer portal, in reading order.

Quickstart

Send your first Action Assessment.

API Reference

Request and response schemas.

Code Examples

cURL, JavaScript and Python.

Errors

Status codes and recovery guidance.

API Playground

Test actions in your approved Enterprise Sandbox.

SDK Starter

Integration patterns for common languages.

OpenAPI

Machine-readable API specification.

Webhooks

Receive assessment and review events.

Operational guarantees

What the API promises about versioning, retries and availability.

Versioning: The API version is v1 and is returned on every response as api_version and the asyrx-api-version header. Additive fields are not breaking changes.
Idempotency: Send an Idempotency-Key header to safely retry. A replayed request returns the original assessment with asyrx-idempotent-replay: true.
Rate limits: Every response carries asyrx-ratelimit-limit, asyrx-ratelimit-remaining and asyrx-ratelimit-reset. Exceeding a limit returns 429 RATE_LIMITED with retry_after_seconds.
Fail-safe posture: If Asyrx cannot complete an assessment it returns an explicit error or an incomplete status. It never returns a false low score and never blocks your action.
Environments: production, staging, sandbox and development. Keys are bound to a mode, and test-mode traffic is stored separately from live traffic.
Request tracing: Every request and error carries a request_id, also returned in the asyrx-request-id header. Quote it in support requests.

Building a platform?

Embed Asyrx Action Risk and Blast Radius intelligence directly into your AI-agent, automation, SaaS, security or enterprise software through an OEM API integration.

Explore OEM Integration