StoneAI

Govern your first AI decision
in fifteen minutes

Signup → decree → approval → cryptographic proof · plain curl, no SDK required
01

Create your tenant

~2 min

One call creates your tenant, your first API key, and your tenant's Ed25519 signing public key (you'll use it in step 5 to verify receipts without trusting us).

curl -s -X POST 'https://stoneai.fanz.website/v1/signup' \
  -H 'Content-Type: application/json' \
  -d '{"email":"you@company.com","password":"a-long-passphrase","company":"Acme"}'

The response is enveloped like every /v1 call — {"success":true,"data":{...}} — and data contains tenantId, apiKey, and signingPubKey.

Save the apiKey now. It is shown exactly once and stored only as a hash. Export it for the rest of this guide: export STONE_KEY=sk_…
02

Raise your first decree

~3 min

Send StoneAI a truth — the facts of a decision your systems are about to take. The model council reasons over it and returns a decree that is pending human approval: nothing executes yet.

curl -s -X POST 'https://stoneai.fanz.website/v1/decrees' \
  -H "Authorization: Bearer $STONE_KEY" \
  -H 'Content-Type: application/json' \
  -d '{"domain":"ops","truth":{"signal":"502 spike","target":"checkout-service"}}'

Note the returned data.id (export it: export DECREE_ID=…) plus action, confidence, required_scope, and content_hash — the hash is already chained into your tenant's append-only audit ledger.

03

Approve it — the human brake

~2 min

A decree only becomes actionable when a human presents the scope it requires. Deny works the same way (/deny).

curl -s -X POST "https://stoneai.fanz.website/v1/decrees/$DECREE_ID/approve" \
  -H "Authorization: Bearer $STONE_KEY" \
  -H 'Content-Type: application/json' \
  -d '{"approverId":"you@company.com","scope":"PRODUCTION"}'
04

Fetch the Covenant Receipt

~1 min

Every decided decree yields a signed receipt — the portable proof that this decision was governed: what was decided, by whom, under which scope, hash-chained into the ledger.

curl -s "https://stoneai.fanz.website/v1/decrees/$DECREE_ID/receipt" \
  -H "Authorization: Bearer $STONE_KEY" | python3 -c 'import sys,json;print(json.dumps(json.load(sys.stdin)["data"],indent=2))' > receipt.json
05

Verify it offline — don't trust us

~2 min

The receipt verifies on your machine against the signingPubKey from step 1. No network call, no StoneAI involvement:

npx @stoneai/verify receipt.json --pubkey "$SIGNING_PUBKEY"
Why this matters: auditors, customers, and regulators can check the signature and hash-chain themselves. If we tampered with a single decision, verification breaks.
06

Wire up webhooks (optional)

~5 min

Get pushed decree events (raised / approved / denied) instead of polling. Deliveries are HMAC-signed; inspect recent attempts at /v1/webhook/deliveries.

curl -s -X PUT 'https://stoneai.fanz.website/v1/webhook' \
  -H "Authorization: Bearer $STONE_KEY" \
  -H 'Content-Type: application/json' \
  -d '{"url":"https://your-app.example/hooks/stoneai","events":["decree.approved","decree.denied"]}'
The Covenant holds.

Full contract: API reference · machine-readable: openapi.json · live health: status