Conformance Status

Every surface in this documentation is one of two statuses. This page collects them all in one place.

Live now means you can call it today and get a real response. Preview means the shape is committed — the endpoint, request/response contract, and SDK signatures are finalized — but the surface is not yet deployed. No endpoint is implied live unless it is listed as live below.

Live — no authentication required

These endpoints are deployed and verifiable by any party today.

Surface	Endpoint	Notes
OCSS Trust List	`GET https://prodapi.phosra.com/.well-known/ocss/trust-list`	Signed JSON document. Verify against the production root key `root-prod-bootstrap-2026-07`, public X `824vsCATBxyUiA-znpGx01N48NNs_3gPE3M7f7vIEaI` — pin the public X, not the key id. Carries real accreditation entries (10 as of 2026-07-26), added through OCSS governance. The older id `root-prod-2026-06` belonged to a retired census and fails closed against every current document.
OCSS succession record	`GET https://prodapi.phosra.com/.well-known/ocss/succession`	Ed25519-signed steward-of-record record and anti-capture covenant.
Phosra Link environment manifest	`GET` or `HEAD https://prodapi.phosra.com/.well-known/phosra/environment-manifest-v1`	Signed production discovery document with issuer, trust, endpoints, expiry, and SDK minimums.
Phosra Link client directory	`GET` or `HEAD https://prodapi.phosra.com/api/v1/link/clients/{providerDid}`	Public lookup for an already-registered Link participant. No credential issuance or secret material.
Health check	`GET https://prodapi.phosra.com/health`	Simple liveness check.

Live — authentication required

These endpoints are deployed and require a phosra_-prefixed API key or session bearer token.

Surface	Auth	Notes
Self-serve signup funnel (dashboard.phosra.com/signup)	None to start (WorkOS AuthKit)	Live. Fresh signup → auto-provisioned developer org → first `phosra_` key from the dashboard or one API call. No pre-existing key or handshake. See Create your account & get keys.
Developer orgs (`/api/v1/developers/orgs`)	WorkOS session bearer	Create, read, update, delete developer organizations.
API keys (`/api/v1/developers/orgs/{orgId}/keys`)	WorkOS session bearer	Provision, revoke, and rotate `phosra_`-prefixed keys.
Usage rollups (`/api/v1/developers/orgs/{orgId}/usage`)	WorkOS session bearer	Hourly request rollups per org.
Advisor agents (`/api/v1/advisors`)	Session bearer	Register and consult advisor agents; declare OCSS payload keys for federation.
MCP tokens (`/api/v1/mcp-tokens`)	Session bearer	Mint and revoke Model Context Protocol authentication tokens.
§9.4 attestation export	`phosra_` API key	Signed CSV of conformance evidence per OCSS §9.4, suitable for regulatory submission.

The base URL for all management operations is https://prodapi.phosra.com/api/v1.

Restricted Link authority operations

The production authority also exposes operator-only registration and credential issuance at PUT /api/v1/admin-ops/link/clients/{providerDid} and POST /api/v1/admin-ops/link/credentials. These routes are live, but they are restricted superadmin operations—not public developer onboarding. Never place their authorization material or an issued credential in browser code, examples, topology, screenshots, or logs.

Live now — sandbox census (`https://phosra-api-sandbox-production.up.railway.app`)

These OCSS protocol surfaces are deployed and return real signed responses today on the production sandbox census — the stable, partner-facing testing endpoint. They are RFC-9421 DID-signed; you must be on the sandbox Trust List (see Onboarding — self-serve, no email required). This is a sandbox (test keys, self-serve, provisional) — it is not the live accredited network for production traffic.

Surface	Endpoint	Notes
Rule write + signed receipt	`POST /api/v1/policies/{policyId}/rules`	Router-signed write receipt; verifiable to the trust-list root.
Enforcement confirmation (§8.3.8)	`POST /api/v1/enforcement-confirmations`	Signed enforcement receipt; satisfies the record-in-signed-audit MUST.
Platform registration	`POST /api/v1/platforms/{did}/endpoints`	Self-scoped (`caller.DID` must equal `{did}`); returns `endpoint_id_label` + `connect_secret` once. See Platform Registration.
Binding-leg endpoint mint	`POST /api/v1/enforcement-endpoints`	Consent-first label mint. `audience_did` is the resolver the binding is compiled for — the profile poll below must be signed by that same DID.
Signed enforcement profile	`GET /api/v1/enforcement-profiles/{endpoint_id}`	Carries ALL rule categories including engagement rules (`addictive_pattern_block`, `infinite_scroll_block`, etc.). §9.3(b) resolver-bound: the GET must be RFC-9421-signed by the binding’s `audience_did`; any other signer gets a no-leak 404.
Counterparty directory	`GET /api/v1/directory`	Public, key-material-free index of Trust-List DIDs by role + capabilities, enclave-enriched. Discovery only — keys resolve from the signed trust-list.
Sealed harm_context (§3A.3)	`POST /api/v1/harm-context`	Router-blind sealed envelope.
Consent attestation ingest (§8.3.2)	`POST /api/v1/webhooks/inbound/app-store`	Sealed inbound consent signal; verifiable write receipt returned.
Enclave challenge nonce	`POST /api/v1/enclaves/challenge`	Issues a one-shot 32-byte anti-replay nonce for Nitro attestation; RFC-9421-gated.
Enclave register + owner-upsert	`POST /api/v1/enclaves`	Self-register; re-register with same DID → re-point (owner-upsert) instead of 409; RFC-9421-gated. `attested:true` is hardware-gated (Nitro); `standin` is the live tier.
Active enclave discovery	`GET /api/v1/enclaves/active?provider_did=…`	Content-free public registry lookup; returns `{ payload_pubkey_jwk, signing_pubkey, mode, attested, revoked }`.
Minimization attestation	`POST /api/v1/minimization-attestation`	Solo per-epoch conservation check; RFC-9421-gated. Receipt carries `conservation_check: "self_report"`, `two_attestor: false`. Never “verifiable deletion” — solo mode proves count consistency only.
Consent-scoped enclave discovery	`GET /api/v1/children/{child_ref}/enclaves`	Returns active enclaves for which the caller has a live `consent_attestation` standing for `child_ref`; RFC-9421-gated.
Routing manifest (post-hoc fan-out)	`POST /api/v1/routing-manifests`	Content-free post-hoc record filed after fan-out; never a precondition for delivery. RFC-9421-gated.
Compliance bundle	`POST /api/v1/compliance-bundles`	Verifies routing-manifest receipts against the Trust List and issues a TSA-anchored Merkle bundle receipt. RFC-9421-gated. Use `verifyComplianceBundle` client-side to recompute the Merkle root independently.
Signed Trust List	`GET /.well-known/ocss/trust-list`	Root-signed; cold-verifiable by any party.
Sandbox connect test (provider counterparty)	`POST /api/v1/sandbox/test-connect`	Sandbox-only. RFC-9421 signed as your DID; runs the EXT-04 §3.2 provider ceremony against your own `{platform_did, webhook_url, connect_secret}` using a seeded test child (Mia). Returns `endpoint_id_label` + `profile_url` → `200`. `404` off-sandbox.
Sandbox self-serve consent mint	`POST /api/v1/sandbox/consent-attestations`	Sandbox-only. A self-registered provisional DID mints a TEST `consent_attestation` for itself over a seeded sandbox child — no `OCSS_CONSENT_ATTESTATION_APPS` edit. RFC-9421 signed → `201`. `404` off-sandbox.
Sandbox reference OAuth consent surface	`GET /oauth/authorize` · `POST /oauth/token` · `GET /oauth/profiles`	Sandbox-only. Reference parent-consent provider on the census host root (not `/api/v1`). `authorize` renders a seeded consent page (Mia/Leo/Ava); `?decision=approve` → `302 redirect_uri?code=&state=` (machine-automatable, no HTML scraping). Stateless (`sbxauth_`/`sbxtok_`). `404` off-sandbox.

Live — production census

There is one production census, and https://prodapi.phosra.com is its name. PHOSRA_ENV=production, isolated database, its own signed Trust List with interim verifying-agency Touchstone (did:ocss:touchstone). Accredited parties (e.g. did:ocss:notflix, did:ocss:custo) write signed, consent-backed rules against real platforms here today. Verify against the production root key root-prod-bootstrap-2026-07 (root pub X 824vsCATBxyUiA-znpGx01N48NNs_3gPE3M7f7vIEaI, pinned out-of-band — verified against the census, never fetched from it). https://phosra-api-prod-bootstrap-production.up.railway.app is the same service reached by its Railway origin name, not a second host: /health, /.well-known/ocss/trust-list, /.well-known/ocss/succession and the environment manifest are byte-identical on both, and both serve the census surfaces below. Earlier revisions of this page claimed prodapi.phosra.com was a control plane that 404s the census routes — that was true of an earlier topology and is no longer true. Prefer prodapi.phosra.com; the Railway name keeps working for already-configured integrators.

Certificate caveat, verified 2026-07-26. Railway’s edge intermittently answers prodapi.phosra.com with its *.up.railway.app wildcard certificate instead of the custom-domain certificate — roughly 1 handshake in 4 in a 60-request sample, surfacing as SSL: no alternative certificate subject name matches target host name. It is an edge certificate-state issue on a recently-moved domain, not a DNS or service fault, and a retry usually succeeds. If you need a clean run right now, use https://phosra-api-prod-bootstrap-production.up.railway.app — same census, same root, and 60/60 clean in the same sample.

Surface	Endpoint	Notes
Provider connect config	`GET /api/v1/providers/{did}/connect`	Two-layer resolve (Trust List + product connect registry). Live on `prodapi` (verified `200`).
Binding-leg endpoint mint	`POST /api/v1/enforcement-endpoints`	Consent-first label mint; resolver-bound.
Rule write + signed receipt	`POST /api/v1/policies/{policyId}/rules`	Router-signed write receipt; verifiable to `root-prod-bootstrap-2026-07`.
Signed enforcement profile	`GET /api/v1/enforcement-profiles/{endpoint_id}`	§9.3(b) resolver-bound; RFC-9421-signed poll.
Consent attestation ingest (§8.3.2)	`POST /api/v1/webhooks/inbound/app-store`	Sealed inbound consent; verifiable write receipt returned.
Counterparty directory	`GET /api/v1/directory`	Public, key-material-free index of Trust-List DIDs.
Signed Trust List	`GET /.well-known/ocss/trust-list`	Root-signed (`root-prod-bootstrap-2026-07`); carries the accredited entries.

Full coordinates and the “these hosts are NOT your census” list: Production Accreditation → Production census coordinates.

Live — npm packages

These packages are published to npm and installable today.

Package	Version	Install
`@openchildsafety/ocss`	current	`npm install @openchildsafety/ocss`
`@openchildsafety/bundle`	0.1.0	`npm install @openchildsafety/bundle`
`@phosra/sdk`	0.1.0	`npm install @phosra/sdk`
`@phosra/mcp`	0.4.0	`npx @phosra/mcp`
`@phosra/link`	current	`npm install @phosra/link`
`@phosra/cli`	0.2.0	`npm install @phosra/cli`
`@phosra/gatekeeper`	current	`npm install @phosra/gatekeeper`
`@phosra/provider`	0.1.0	`npm install @phosra/provider`
`@phosra/classify`	0.1.1	`npm install @phosra/classify`
`@openchildsafety/provider-harness`	0.1.3	`npm install @openchildsafety/provider-harness` (CLI: `npx -p @openchildsafety/provider-harness provider-harness`)

@phosra/sdk-dev — the planned unified wrapper that combines @phosra/sdk and @openchildsafety/ocss under one package — is not yet published. Install the individual packages above until it ships.

Trust-layer SDKs (server-side enclave routing)

Published to npm (@phosra/provider@0.1.0, @phosra/classify@0.1.1). Full guide: Server-Side Enclave Routing.

Package	Role
`@phosra/provider`	enclave-side: `verifyAndOpen` (verify RFC-9421 sig to Trust List root, decrypt JWE); `createEpochAccumulator` / `closeEpoch` / `submitMinimizationAttestation`
`@phosra/classify`	platform-side: `classify` (single provider, seal-direct), `classifyMulti` (fan-out, separate JWE per enclave), `verifyComplianceBundle` (client-side Merkle + Ed25519)
`@openchildsafety/provider-harness`	conformance CLI (0.1.3): subcommands `run` / `attest` / `sign` / `verify`; 7 assertions A1–A7 (4 pass, 3 pending); targets the bundled reference enclave (`--enclave ref`) or your live endpoint (`--enclave-url <https url>`); label “self-tested; production accreditor pending”. Run: `npx -p @openchildsafety/provider-harness provider-harness run --enclave-url https://your-enclave.example` (the `-p` form — bare `npx @openchildsafety/provider-harness` is unreliable, an npx scoped-bin quirk)

Preview — committed shape, not yet deployed on the production control plane

isAllowed() is not a server surface — it is local by design, and it is live today. isAllowed({ category, signal }) runs entirely in-process inside public @phosra/gatekeeper@0.7.0 against the cached, signed enforcement profile fetched once via the §9.3(b) read (GET /api/v1/enforcement-profiles/{endpoint_id}). Zero network latency, fail-closed when the cache is absent. isAllowed() IS the decision call — there is no hosted POST /check equivalent and none is planned. It is neither “preview” nor a deployed endpoint. The Railway qualification candidate vendors 0.8.7 pending npm publication. See Platform Quickstart.

The @phosra/sdk-dev surfaces below are not yet published — the shape is committed and will not change without a versioned notice; install the individual packages today. This does not apply to the OCSS census surfaces (provider connect, enforcement-endpoints, rule writes, enforcement profiles, consent ingest): those are live in production on prodapi.phosra.com — verified GET /api/v1/providers/did:ocss:notflix/connect → 200 and POST /api/v1/enforcement-endpoints → 405 (registered, wrong method), against a bogus-path control that returns plain-text 404 page not found. See Live — production census above.

Surface	Planned path	Notes
`@phosra/sdk-dev` unified wrapper	(planned — not yet published)	A planned convenience package that would bundle `@phosra/sdk` + the `@openchildsafety/ocss` re-export under one install. Publicly released individual packages remain installable at their registry versions; the Golden Link / Gatekeeper / OCSS packages are now published on public npm. The self-serve control-plane API-key funnel is live, but it does not issue Golden v3 credentials.
`@phosra/sdk-dev/protocol` re-export	`import from "@phosra/sdk-dev/protocol"`	The `/protocol` subpath would re-export `@openchildsafety/ocss` verbatim. It is unavailable until the wrapper ships. Import public `@openchildsafety/ocss` directly today.

OCSS conformance surfaces (open standard, not Phosra-specific)

These surfaces are defined by the OCSS specification. Phosra implements them; the standard’s stewardship body owns the spec.

Surface	Status	Notes
Trust List well-known endpoint	Live	See above.
Succession record well-known endpoint	Live	See above.
Ed25519 signed write receipts	Live on sandbox census	Issued by `POST /api/v1/policies/{policyId}/rules`; router-signed, verifiable to the trust-list root. See sandbox census table above.
Ed25519 signed enforcement receipts (§8.3.8)	Live on sandbox census	Issued by `POST /api/v1/enforcement-confirmations`. See sandbox census table above.
Two-layer sealed envelope (`harm_context`, §3A.3)	Live on sandbox census	Router-blind lane; `POST /api/v1/harm-context`. See sandbox census table above.
§9.4 attestation export	Live	Signed CSV evidence export. See live surfaces above.
Conformance suite	External	Owned by the OCSS stewardship body at openchildsafety.com. Not a Phosra-hosted surface.

How status changes

When a preview surface ships, the table above is updated and the relevant page in this documentation gains a “Live” label. Changes that affect the request/response contract are versioned (e.g. /api/v2/…). The introduction page always reflects the current live/preview split in its <Note> block.

Questions

The developer funnel needs no early access — create your account and mint a key self-serve. For anything else preview-related, reach out at developers@phosra.com.

Get Started

Concepts

Guides

Cookbook

Partner Integration

Phosra Link (secret-free)

OCSS Conformance

Platform

Live — no authentication required

Live — authentication required

Restricted Link authority operations

Live now — sandbox census (`https://phosra-api-sandbox-production.up.railway.app`)

Live — production census

Live — npm packages

Trust-layer SDKs (server-side enclave routing)

Preview — committed shape, not yet deployed on the production control plane

OCSS conformance surfaces (open standard, not Phosra-specific)

How status changes

Questions

​Live — no authentication required

​Live — authentication required

​Restricted Link authority operations

​Live now — sandbox census (https://phosra-api-sandbox-production.up.railway.app)

​Live — production census

​Live — npm packages

​Trust-layer SDKs (server-side enclave routing)

​Preview — committed shape, not yet deployed on the production control plane

​OCSS conformance surfaces (open standard, not Phosra-specific)

​How status changes

​Questions

Live — no authentication required

Live — authentication required

Restricted Link authority operations

Live now — sandbox census (`https://phosra-api-sandbox-production.up.railway.app`)

Live — production census

Live — npm packages

Trust-layer SDKs (server-side enclave routing)

Preview — committed shape, not yet deployed on the production control plane

OCSS conformance surfaces (open standard, not Phosra-specific)

How status changes

Questions