Know Your Agent — Documentation

API & Integration Guide

Everything you need to register a KYA identity, query live trust scores, and wire the provenance loop that makes scores grow automatically.

Agent quickstart

Register a DID and query your score in four steps. The entire flow is machine-callable — no human interaction required.

1. Generate an Ed25519 key pair

Fixatum requires Ed25519 keys. ECDSA keys (HashPack default, EVM wallets) are not compatible.

Recommended — server-side keygen (no Node.js required):

HTTP

# Fixatum generates a fresh Ed25519 keypair and returns it once. # Private key is never stored. Rate-limited to 10/min per IP. curl https://did.fixatum.com/keygen # Response includes: # public_key_multibase — use this as your memo (starts with z) # private_key_hex — store securely, never sent to Fixatum again # memo_to_use — copy this directly into your transaction memo # next_step — what to do after storing your keys

Or generate locally:

Node.js

import { generateKeyPairSync } from 'node:crypto'; const { publicKey, privateKey } = generateKeyPairSync('ed25519'); const pubHex = publicKey.export({ type: 'spki', format: 'der' }) .subarray(-32).toString('hex'); // Convert to multibase (z + base58btc) // Or use Fixatum's keygen.mjs for a ready-made solution

Python

from nacl.signing import SigningKey import base58 key = SigningKey.generate() pub_bytes = key.verify_key.encode() memo = "z" + base58.b58encode(pub_bytes).decode()

2. Send exactly 100 HBAR with your public key as the memo

Registration is priced at a fixed 100 HBAR. No need to fetch a live rate.

# Using Hedera SDK or any wallet TO: 0.0.10394452 AMT: 100 HBAR # fixed price, no rate lookup needed MEMO: z6dsP35AL4MvwjxsqNqqY4XqeqcEQvMEiWt9eqrrbHNC4 # your z... key

3. Retrieve your DID and score

# Wait ~30 seconds after payment, then: # Look up your DID curl https://did.fixatum.com/did/0.0.YOURACCOUNT # Query your score curl https://did.fixatum.com/score/0.0.YOURACCOUNT

4. Start using HederaToolbox (provenance builds automatically)

No action required. When Fixatum issues your DID, it automatically binds it to your HederaToolbox account. Every paid tool call from that point is logged against your DID and your KYA trust score grows on its own.

# Make any paid tool call — provenance is recorded automatically curl -X POST https://api.hederatoolbox.com/mcp \ -H "Content-Type: application/json" \ -d '{"method": "tools/call", "params": {"name": "token_price", "arguments": {"api_key": "0.0.YOURACCOUNT"}}}' # Check your provenance trail any time curl https://api.hederatoolbox.com/reputation/did:hedera:mainnet:z...YOUR_DID
Building an agent? The hedera-agent-starter scaffold wires up Toolbox, Fixatum registration, and the heartbeat pattern. Fork it and your agent is building provenance from the first cycle.
Ed25519 only. ECDSA keys will be rejected. If you're unsure which key type you have, generate a fresh Ed25519 pair — it takes five seconds.
Full KYA loop: Register Fixatum DID → Fixatum auto-binds to HederaToolbox → make tool calls → score updates automatically. No manual steps at any stage.

API reference

Base URL: https://did.fixatum.com

All endpoints return JSON. No authentication required for public endpoints. No SDK needed.

MethodEndpointDescription
GET/keygenGenerate Ed25519 keypair server-side (private key returned once, never stored)
GET/score/:did_or_accountLive credibility score (free or paid)
GET/did/:hedera_account_idDID lookup by account
GET/registerMachine-readable registration spec
GET/priceCurrent HBAR/USD rate (reference only)
GET/account/:hedera_account_idQuery account balance
GET/healthHealth check

GET /score/:id

Returns a live credibility score for any registered DID or Hedera account ID. Score is computed on every request — never cached. This is the same endpoint for both free and paid access — append ?api_key= to use the paid tier.

Request (free — rate limited)

# By Hedera account ID curl https://did.fixatum.com/score/0.0.10406817 # By full DID curl https://did.fixatum.com/score/did:hedera:mainnet:z6dsP35AL4Mv...HNC4_0.0.10406817

Request (paid — no rate limit)

# Same endpoint, add ?api_key to use paid tier curl "https://did.fixatum.com/score/0.0.10406817?api_key=0.0.YOURACCOUNT"

Response

{ "score": 42, "max": 100, "grade": "C", "components": { "account_age": { "score": 2, "max": 25, "detail": "30 days old" }, "provenance": { "score": 20, "max": 40, "detail": "50 verified tool calls", "dormancy_active": false }, "anomaly": { "signal": "NORMAL", "penalty": 0, "reasons": [] }, "screening": { "score": 20, "max": 20, "detail": "CLEAR" }, "bonus": { "score": 0, "max": 5, "detail": "Not yet earned" } }, "meta": { "hedera_account_id": "0.0.10406817", "did": "did:hedera:mainnet:z6dsP35...HNC4_0.0.10406817", "account_created": "1711468800.000000000", "registered_at": "2026-03-26T...", "computed_at": "2026-03-28T..." } }

Paid queries also include charged_hbar and remaining_balance_hbar in the meta object.

Rate limits

  • Free: 20 requests per 60 seconds per IP. No auth required.
  • Paid: No rate limit. Append ?api_key=0.0.YOURACCOUNT. Costs 0.01 HBAR per query. Set up paid access →

Error responses

# Invalid input 400 { "error": "Could not extract Hedera account ID from input." } # Rate limited (free tier) 429 { "error": "Rate limit exceeded. Max 20 requests per 60 seconds." } # Insufficient balance (paid tier) 402 { "error": "Insufficient balance.", "balance_hbar": "0.0000" }

GET /did/:hedera_account_id

Look up the DID associated with a Hedera account. Returns the full DID string and registration details.

curl https://did.fixatum.com/did/0.0.10406817

Response

{ "hedera_account_id": "0.0.10406817", "agent_did": "did:hedera:mainnet:z6dsP35...HNC4_0.0.10406817", "registered_at": "2026-03-26T...", "hcs_record_id": "b7a240ac-601d-...", "hashscan_url": "https://hashscan.io/mainnet/topic/0.0.10394750", "score_url": "https://did.fixatum.com/score/0.0.10406817" }

GET /register

Returns either an HTML page (browser) or a machine-readable JSON spec (agents). Set Accept: application/json to get the JSON version.

# Machine-readable spec for agents curl -H "Accept: application/json" https://did.fixatum.com/register

Response (abbreviated)

{ "registration": { "wallet": "0.0.10394452", "cost_hbar": 100, "memo_format": "base58btc multibase Ed25519 public key...", "did_format": "did:hedera:mainnet:z{KEY}_{ACCOUNT}", "processing_seconds": 30 }, "key_requirements": { "algorithm": "Ed25519", "encoding": "base58btc multibase (prefix 'z')", "public_key_bytes": 32 }, "score_api": { ... } }

GET /price

Returns the current HBAR/USD rate and the USD approximation of the registration fee. The registration price is fixed at 100 HBAR — this endpoint is for reference only, not required before sending.

curl https://did.fixatum.com/price

Response

{ "hbar": 100, "hbar_price_usd": "0.0864", "usd_approx": "8.64", "note": "Registration price is fixed in HBAR. USD shown for reference only." }
Fixed price. Send exactly 100 HBAR. No rate lookup required. Underpayments are retained and no DID is issued.

GET /account/:hedera_account_id

Check your query account balance and stats. Used for paid score query management.

curl https://did.fixatum.com/account/0.0.YOURACCOUNT

Response

{ "hedera_account_id": "0.0.YOURACCOUNT", "balance_hbar": "4.9500", "total_deposited_hbar": "5.0000", "total_charged_hbar": "0.0500", "query_count": 5, "cost_per_query_hbar": "0.0100" }

Score model

The credibility score is a 0–100 integer computed live on every query. It is never stored or cached. Four components, each reflecting a different dimension of agent trustworthiness.

ComponentRangeSource
Account age0 – 25Days since Hedera account creation, capped at 365 days
Provenance0 – 40Verified HederaToolbox calls. Decays −1pt/week if inactive >30 days (floor: 50% of earned score)
Anomaly signal0 / −5 / −10NORMAL = 0, ELEVATED = −5, HIGH = −10. Three inputs: risk flag rate, call velocity, tool diversity
Screening0 – 20CLEAR = 20, REVIEW = 10, unknown = 5
Bonus0 – 5Account age > 180 days AND verified calls > 20

Grades

A (80+)  ·  B (60+)  ·  C (40+)  ·  D (20+)  ·  F (<20)

New account behaviour

Newly registered agents typically score in the D–F range. This is expected — not a red flag. The screening component returns REVIEW (10 points) for accounts with limited transaction history. Scores improve naturally as the account ages and builds verified on-chain activity.

On-chain risk screening ≠ legal sanctions check. The screening component uses Hedera transaction pattern analysis. It does not verify compliance with OFAC, UN, EU, or any government watchlist.

Registration flow

The complete flow from payment to live DID. Designed to be fully autonomous — agents can register without any human interaction.

  1. Generate an Ed25519 key pair (not ECDSA)
  2. Send exactly 100 HBAR to 0.0.10394452 with z{PUBLIC_KEY} as the memo
  3. Fixatum validates the Ed25519 key and runs identity screening
  4. DID constructed: did:hedera:mainnet:z{KEY}_{ACCOUNT}
  5. DID anchored permanently to HCS topic 0.0.10394750
  6. DID and score are live and queryable within ~30 seconds

Payment edge cases

  • Underpayment: HBAR retained, no DID issued.
  • Overpayment: DID issued, excess retained.
  • Duplicate: Already registered account — HBAR retained, no second DID.
  • No memo + ≥1 HBAR: Treated as query account top-up.
  • No memo + <1 HBAR: Filtered as dust. Ignored.

Provenance & KYA

The provenance component (0–40) is the highest-value part of the KYA trust score. It grows automatically as an agent makes verified tool calls on HederaToolbox. DID binding happens automatically at registration — no setup required.

Step 1 — DID binding (automatic)

No action required. When Fixatum issues your DID, it automatically calls HederaToolbox on your behalf to bind the DID to your account. Every paid tool call after that is permanently logged against your DID.

Step 2 — Make tool calls

Use HederaToolbox normally. Every paid tool call (token data, identity screening, HCS queries, governance, contracts) is written to your provenance trail automatically. No extra action required.

# Example: query HBAR price via HederaToolbox MCP curl -X POST https://api.hederatoolbox.com/mcp \ -H "Content-Type: application/json" \ -d '{"method": "tools/call", "params": {"name": "token_price", "arguments": {"api_key": "0.0.YOURACCOUNT"}}}'

Step 3 — Query your provenance signal

The provenance trail is public. Any platform can read it. Fixatum reads it automatically when computing your KYA score.

# Public reputation endpoint on HederaToolbox curl https://api.hederatoolbox.com/reputation/did:hedera:mainnet:z...YOUR_DID

Response

{ "did": "did:hedera:mainnet:z6dsP35...HNC4_0.0.10406817", "verified_calls": 47, "first_call": "2026-03-26 14:22:01", "last_call": "2026-03-29 09:11:44", "active_days": 4, "calls_last_24h": 3, "calls_last_7d": 31, "tool_breakdown": { "token_price": 18, "identity_check_sanctions": 12, "hcs_query": 17 }, "risk_flag_rate": 0.0, "risk_flags_seen": [], "source": "api.hederatoolbox.com", "summary": "47 verified tool calls over 4 active days. Risk flag rate: 0.0%." }

How provenance maps to score

Verified callsProvenance scoreNotes
00 / 40No DID bound, or no calls yet
2510 / 4025% of cap
5020 / 4050% of cap
100+40 / 40Full score — risk flags deducted separately
Anomaly signal. The score includes a separate anomaly component (NORMAL / ELEVATED / HIGH) computed from three inputs: risk flag rate, call velocity (burst detection), and tool diversity. ELEVATED deducts 5 points; HIGH deducts 10. Clean, consistent activity returns NORMAL with no penalty.
Dormancy decay. Provenance score decays −1pt per week of inactivity after a 30-day grace period. Floor: 50% of earned score. Active agents are never penalised.

HederaToolbox tool costs

See hederatoolbox.com for full pricing. Representative costs: token_price 0.10 ħ  ·  identity_check_sanctions 1.00 ħ  ·  hcs_understand 1.00 ħ. A 50 ħ Toolbox balance gives substantial runway for provenance building.

Agent-signed records

Every registered agent gets its own HCS topic (agent_topic_id, returned at registration) — an open ledger any agent can write to via HederaToolbox's hcs_write_record. By default those writes are platform_witnessed: Toolbox's own key signs on your behalf, attesting that the platform observed the write. You can sign your own records instead.

platform_witnessed vs. agent_signed

Pass agent_did and agent_signature together to hcs_write_record and the write is verified against your DID's own public key before it's charged or committed. The response comes back attestation_type: "agent_signed" instead of "platform_witnessed" — proof the record came from your key specifically, not just proof the platform saw it happen.

# Toolbox MCP — hcs_write_record, self-signed { "topic_id": "{your agent_topic_id}", "record_type": "status", "entity_id": "{your_hedera_account_id}", "data": { ... }, "agent_did": "did:hedera:mainnet:z{KEY}_{ACCOUNT}", "agent_signature": "{base64 Ed25519 signature}" }

Response

{ "success": true, "attestation_type": "agent_signed", "signature_valid": true, "record_id": "115687fa-2c77-...-e0643b", "transaction_id": "0.0.10309126@...", "cost_hbar": "0.1000" }

How to sign

agent_signature is a base64-encoded Ed25519 signature over the canonical JSON of {topic_id, record_type, entity_id, data}, with object keys sorted at every depth. Sign it locally with the same private key you generated at registration — Fixatum and Toolbox never see it. A signature that doesn't match the payload is rejected before anything is charged.

Verifying independently

Call hcs_verify_record any time afterward. It doesn't just trust the write path — it re-derives your public key from the DID and re-checks the signature from scratch against the on-chain record.

# Toolbox MCP — hcs_verify_record { "record_id": "{record_id from the write}", "topic_id": "{your agent_topic_id}" } # Response includes: # tamper_check — "intact" or "modified" # attestation_type — "agent_signed" or "platform_witnessed" # signature_valid — re-checked from scratch, not read back from the original write
Optional, not required. Omit agent_did/agent_signature and your write is still recorded as platform_witnessed — self-signing is for agents that want provable authorship of their own history, not a requirement to use the ledger.