Quick Start

Asqav creates signed receipts for AI agent actions. Use them to review what happened and give auditors evidence they can verify independently.

This guide walks through installing the SDK, connecting an agent, and creating your first receipt.

Dashboard or API?

Connect an agent once through the SDK or API. Use the dashboard to understand its activity, review issues, and collect evidence. You do not need to operate the dashboard for every agent action.

Agents tells you who is connected. Use it to check an agent’s status and open its recent activity. Activity tells you what happened. Use it to inspect runs across agents, filter by agent, and open signed records. Review contains Incidents and Approvals; Manage contains Policies and Settings. Enterprise support is separate from these work pages.

TaskWhere to do it
See recent activity and items needing attentionOverview
Inspect agent runs, rule decisions, and timestamp proofsActivity
Investigate an incident or record a human decisionIncidents or Approvals
Generate evidence for an auditReports
See connected agents, their status, and recorded activityAgents; your integration can register agents through the API
Change the rules agents followPolicies; use the API for repeatable setup
Manage keys for API access, webhooks, and team settingsSettings
Record actions, submit approval requests, or control executionYour SDK/API integration
Configure several signers and collect their signaturesSigning API; monitor progress in Settings → Enterprise → Multi-party signing
Create or track a priority support ticketEnterprise support, available on Enterprise plans. All plans can read these docs or contact Asqav about account and billing questions.

For a business or compliance review, start with Overview, open the relevant record, then generate a report when you need to share evidence. For an integration, continue below. An approval or signature does not execute an external action; your application decides when to proceed.

Installation

Asqav provides Python and TypeScript SDKs for the hosted API. The examples below cover their shared signing and verification workflow; language-specific helpers are documented in the SDK repository.

Install the Python SDK:

bash 
pip install asqav

Install the TypeScript SDK:

bash 
npm install @asqav/sdk

The TypeScript SDK works in Node.js 20+, Deno, Bun, and modern browsers. Source: github.com/jagmarques/asqav-sdk (monorepo with both packages).

Create a Governed Agent

Call govern() with your API key to initialize the SDK and create a governed agent identity with ML-DSA signatures in one step. Get your key from the dashboard.

python 
import asqav

# govern() initializes the SDK and creates the agent in one call
agent = asqav.govern(api_key="sk_...", agent_name="my-agent")

# Agent is now ready with ML-DSA-65 keys
print(f"Agent ID: {agent.agent_id}")
print(f"Algorithm: {agent.algorithm}")  # ml-dsa-65
typescript 
import { govern } from "@asqav/sdk";

// govern() initializes the SDK and creates the agent in one call
const agent = await govern({ apiKey: "sk_...", agentName: "my-agent" });

// Agent is now ready with ML-DSA-65 keys
console.log(`Agent ID: ${agent.agentId}`);
console.log(`Algorithm: ${agent.algorithm}`);

Sign Actions

Sign actions to create a cryptographic audit trail:

python 
# Sign an action (e.g., API call)
signature = agent.sign("api:openai:chat")

# Sign with context
signature = agent.sign(
    "database:query",
    {"table": "users", "operation": "select"}
)

A user_intent envelope attaches an additional signature to the record. Your application must also bind that key to the user and validate the authorization context. See User Intent for Ed25519, ECDSA P-256 and WebAuthn verification requirements.

python 
resp = agent.sign(
    "transfer:funds",
    {"to": "acct_42", "amount_eur": 100},
    user_intent={
        "signature": "<base64 user sig>",
        "public_key": "<base64 user pubkey>",
        "algorithm": "ed25519",
        "signed_message": "<base64 sha256 of action+context+nonce>",
    },
)
assert resp.user_intent_verified is True

The SDK signs with compliance_mode=True by default. On a fresh organization with no policy registered yet, the first sign is auto-routed to an honest observation receipt (decision: observation, and the response carries policy_enforcement: observation_no_policy) instead of asserting that a policy allowed the action. See Control Attestation for the full first-sign behavior.

Verify the Receipt

Every signature is publicly verifiable, no API key needed. Close the loop by verifying the receipt you just created:

python 
# Verify the receipt (public endpoint, no auth)
result = asqav.verify_signature(signature.signature_id)

print(result.verification_detail.signature_valid)  # True
print(result.verification_url)  # shareable proof page

A fresh receipt reports signature_valid: True right away while the timestamp anchor is still pending; verified flips to true once the anchor confirms. Open verification_url in a browser to see the same receipt as a human-readable proof page you can share with an auditor.

typescript 
import { govern, verifySignature } from "@asqav/sdk";

// govern() initializes the SDK and creates the agent in one call
const agent = await govern({ apiKey: "sk_...", agentName: "my-agent" });

// Agent is now ready with ML-DSA-65 keys
console.log(`Agent ID: ${agent.agentId}`);
console.log(`Algorithm: ${agent.algorithm}`);

// Sign an action (e.g., API call)
await agent.sign({ actionType: "api:openai:chat" });

// Sign with context
const signature = await agent.sign({
  actionType: "database:query",
  context: { table: "users", operation: "select" },
});

// Verify the receipt (public endpoint, no auth)
const result = await verifySignature(signature.signatureId);

console.log(result.verificationDetail.signatureValid);  // true
console.log(result.verificationUrl);  // shareable proof page

Issue Tokens

Issue JWT tokens for your agents, signed with ML-DSA (FIPS 204):

python 
# Issue a token valid for 1 hour
token = agent.issue_token(ttl=3600)

# Use the JWT string (token.token) for authentication
headers = {"Authorization": f"Bearer {token.token}"}

Scope Tokens

Issue tokens scoped to specific actions, so agents only get the permissions they need:

python 
# Issue a scope token limited to data:read
token = agent.create_scope_token(actions=["data:read"], ttl=3600)
headers = token.to_header()

Audit Trail Replay

Replay the recorded actions in an agent session to inspect their order and recorded timestamps:

python 
# Replay a session's audit trail
timeline = asqav.replay("agt_abc", "sess_abc123")
print(timeline.summary())

CLI Tools

The SDK ships an ergonomic CLI for the most common governance workflows. Install once with pip install "asqav[cli]" and you have all of these.

Scaffold a project and validate your setup:

bash 
asqav quickstart
asqav doctor

Replay an agent's signed audit trail, online or offline from a bundle:

bash 
asqav replay agt_x7y8z9 sess_abc123
asqav replay --bundle compliance-bundle.json

Pre-flight an action through revocation, suspension, and policy. The command exits non-zero if the action is blocked:

bash 
asqav preflight agt_x7y8z9 data:read

Approve a pending signing-action session:

bash 
asqav approve session_abc123 entity_xyz789

Check an agent's spend against a budget, then record the actual cost:

bash 
asqav budget check --agent-id agt_x7y8z9 --limit 10 --estimated-cost 0.42
asqav budget record --agent-id agt_x7y8z9 --action data:read --actual-cost 0.42 --limit 10

List the frameworks you can tag, then export a Merkle-rooted compliance bundle:

bash 
asqav compliance frameworks
asqav compliance export --session sess_abc --framework eu_ai_act_art12 --output bundle.json

Full reference with every flag: CLI Reference.

Platform capabilities

Signing modes and deployment options:

  1. Hash-only mode for cloud - fingerprint {action_type, context} with RFC 8785 + SHA-256 locally. Only the hash plus a small whitelisted metadata bag travels. See the Fingerprint Spec.
  2. Self-hosted signer / split-trust - ML-DSA-65 keys and raw payloads stay in the customer's container. See Self-hosted Signer.
  3. Bring-your-own KMS (AWS KMS / GCP KMS) - Enterprise tier. AWS uses ML_DSA_65 on FIPS 140-3 Level 3 HSMs. GCP uses PQ_SIGN_ML_DSA_65 (software preview, HSM coming). See Key Management.
  4. Customer-owned storage - in hash-only and self-hosted modes, raw payload fields such as prompts, context, and reasoning traces stay in your infrastructure. Only digests and a small whitelisted metadata bag reach the cloud.
  5. SCITT / COSE_Sign1 receipt export - public GET /api/v1/signatures/{id}/cose returns application/cose (CBOR tag 18). Same ML-DSA-65 key signs both JCS and COSE forms. Background in the SCITT and COSE post.
  6. Air-gapped / on-prem mode - offline license validator and egress gate. Self-hosted signer with no outbound HTTP. See the self-hosted signer guide.

Next Steps