Build on Trooth.

The public Trust Profile API needs no key or account. It returns the signed, public posture for any company by slug. Authenticated endpoints (your dashboard, webhooks) use a Bearer token issued with your API plan. Trooth automates. Trooth never signs.

curl https://api.trooth.co/public/trust/your-co

Ready for authenticated calls? Grab a key and see rate limits on the API reference.

Every value the API returns came through this path. Select a node to see what it receives, what it emits, and what it is unable to do.

{  "connector": "aws",  "grant": "read-only",  "scopes": ["describe*", "list*", "get*"],  "write_scopes": []}

GET /public/trust/:slug returns a company's public, signed Trust Profile as JSON: tier, Trust Score, framework coverage, and the last witnessed time. Public and unauthenticated.

curl -s https://api.trooth.co/public/trust/acme-ai \
  -H "Accept: application/json"

Drop a live, self-updating Trust Badge anywhere. Paste the embed where you want it to appear. It reads your public profile and re-renders automatically; no redeploy needed.

<div id="trooth-trust-badge" data-slug="your-co"></div>
<script src="https://trooth.co/badge.js"></script>

Full install steps and placement tips are on the badge install page.

Run a report-only compliance scan against any framework straight from your terminal or CI. It never applies changes and never signs on your behalf. The scan posts to POST /v1/grc/scan and returns the same witnessed evidence the dashboard reads.

# No install. Advisory and report-only; nothing is ever applied.
terraform show -json plan.tfplan > plan.json
npx trooth scan plan.json

Flags, CI wiring and the full command reference are on the CLI page.

Run the same advisory preflight on every pull request. It posts the plan to /v1/preflight and is report-only by default, so it never blocks a merge.

# .github/workflows/trooth.yml
- name: Trooth compliance scan
  uses: troothllc/trooth-action@v1
  with:
    api-key: ${{ secrets.TROOTH_API_KEY }}
    plan-file: plan.json
    fail-on: none   # report-only; set critical/high/medium/low to gate

Subscribe to state changes and Trooth will POST a JSON event to your endpoint. Manage endpoints from your dashboard.

Each event shares one envelope; the data.object varies by type.

{
  "id": "evt_01J8Z9K2QH4B7C",
  "type": "trust.score.changed",
  "created": 1785340800,
  "api_version": "2026-08-02",
  "data": { "object": {
    "profile": "acme-ai",
    "previous_score": 78,
    "current_score": 84,
    "tier": "silver",
    "changed_controls": ["soc2.cc6.1"]
  } }
}

The legacy name control.verified is accepted as an alias when registering webhooks.

Every delivery is signed. The X-Trooth-Signature header is an HMAC-SHA256 of the raw request body, keyed with your endpoint's signing secret. Compute the same HMAC and compare in constant time before trusting a payload.

import crypto from "node:crypto";

// Verify the X-Trooth-Signature header against the raw request body.
export function verifyTrooth(rawBody, signature, secret) {
  const expected = crypto
    .createHmac("sha256", secret)
    .update(rawBody, "utf8")
    .digest("hex");
  return crypto.timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(signature),
  );
}