API reference

The public endpoints take no key: the Trust Profile read below, the operations in the API reference, and the Model Context Protocol (MCP) server. Trooth does not offer a credentialed API for outside integration. The authenticated endpoints run the company and buyer workspaces, are scoped to a signed-in session, and are not documented here.

A workspace API key has one documented use: sending evidence events into your own company workspace, described under Connect, API and webhook in the workspace. A key is scoped to that workspace, shown once when it is created, and revocable at any time. No other endpoint is documented for a key, so a key is not a supported way to read or change anything else. Webhooks fire on the events listed in the developer docs, and a delivery is attempted rather than guaranteed.

The endpoints on this page take no authentication. Where a limit applies it is counted for each IP address rather than for each tenant. This site's own limits run two fixed windows at the same time, one by the minute and one by the hour (lib/rate-limit.ts). The Trooth API applies no rate limit to the /public/trust read above. The MCP server allows 120 tool calls a minute for each IP address, counted separately on each server instance, so the limit is approximate; listing and the handshake are not counted, and over it the answer is 429 with Retry-After: 60. Trooth is free and has no plans, so no caller carries a larger allowance than another. Webhooks are HMAC-signed.

Trooth's public trust layer is queryable by AI agents over the Model Context Protocol. The server is read-only and needs no key: it exposes published Trust Profiles, live outside-in surface reads, token checks, and Trooth's curated knowledge base, with the same provenance labels as everywhere else. Point any MCP client that connects to remote servers at the endpoint below (streamable HTTP, single JSON response per POST, protocol 2026-07-28, server trooth-mcp 1.1.0). The older revisions 2025-06-18, 2025-03-26 or 2024-11-05 are still answered, so a client written against one of those keeps working and does not have to change to connect. The block below is a project .mcp.json entry in the form Claude Code and VS Code document; Claude.ai and Claude Desktop take the same URL under Customize, Connectors, Add custom connector, and ChatGPT has Trooth Network as a listed app. Each client's plan and region limits and its removal step are on the agents page.

{  "mcpServers": {    "trooth": {      "type": "http",      "url": "https://api.trooth.co/public/mcp"    }  }}

Tools: trooth_public_trust_profile (for a company that publishes, its record in prose: coverage, the last witnessed date, continuity, a methodology summary, how many facts are published and a link to the profile; the facts themselves are on the profile and in /api/network/profile), trooth_outside_in_read (live TLS, security headers, security.txt for any public domain), trooth_verify (re-check a Trust Ledger Token's two signatures and report it valid, expired, revoked, or invalid when a signature fails), and trooth_ask (Trooth product and methodology questions). Each takes one required string argument (company, domain, token, question) and returns structuredContent with status, provenance, subject and summary alongside the text. The server also serves 4 markdown resources (trooth://methodology, trooth://provenance-labels, trooth://verify-a-vendor, trooth://what-a-call-sends) and 3 prompts (vendor_trust_check, verify_trust_token, before_you_trust). Tool calls are rate limited per IP, as above; tenant data is never exposed. The field-level contract and the agent pattern are on Agents and MCP.