APIR · FOR AI VENDORSYour customer wants to know what your agent did.
A security review asks it. An insurer asks it. From 10 December 2026, Australian customers have to describe automated decisions in their privacy policy, so expect them to ask you too. APIR gives each of your agents signed papers and a tamper-evident log book you can hand over.
WHO ASKS
THE BUYER
The security review
How is this agent controlled, and what has it done? Send its papers and its log book, which they can check themselves.
THE INSURER
The AI questions
They ask the same thing. APIR keeps the record. It does not insure anyone, arrange cover or set a premium.
FROM 10 DECEMBER
Your Australian customers
The OAIC says software providers should give customers “clear, high-level information about how their software can be used to make decisions”. The OAIC generally expects the obligation to stay with your customer, so expect the questions to come to you. A disclosure sheet answers them once, in your words. Read the rule. Not legal advice.
HOW IT WORKS
STEP 1
Register your agents
One on a form, or up to 50 in one API call, all or nothing. The first is free. A name already on the record comes back under “existing”, so a retry cannot double up.
curl -X POST https://apir.ai/api/v1/agents \
-H "Authorization: Bearer apir_sk_..." \
-H "Content-Type: application/json" \
-d '{"agents":[{"name":"Refunds agent"},{"name":"Support agent"}]}'STEP 2
Send one call per action
Your agent keeps running where it runs. Prompts and outputs stay on your side: you send their SHA-256 hashes. Each event goes on a hash chain, and the chain heads are timestamped each night by an outside RFC 3161 authority.
curl -X POST https://apir.ai/api/v1/events \
-H "Authorization: Bearer apir_sk_..." \
-H "Content-Type: application/json" \
-d '{"agent_id":"<the agent id>",
"events":[{"type":"decision",
"summary":"Approved refund #4521 under the AUD 200 limit",
"input_hash":"<sha256 of the prompt>",
"output_hash":"<sha256 of the answer>"}]}'From Python: pip install git+https://github.com/apir-ai/apir-record. No dependencies, MIT. If your agents speak AG-UI (LangGraph, CrewAI, Mastra and others), one subscriber does it. The full reference is on the developers page.
STEP 3
Write its mandate
You say what the agent may do, where, up to what value and until when, and APIR signs it. After five conduct events the trust genome can score it, and until then it reads Unrated. A Trust Passport follows once it earns one.
STEP 4
Write its disclosure sheet
What it decides on its own, what it helps a person decide, what personal information it uses and what a person reviews, in your own words. APIR records it on the agent’s log book and does not check it. You get a link to send, and nothing goes out from us.
WHAT YOU HAND OVER
FREE
The disclosure sheet
A page your customer can read, save as a PDF and use when they write their privacy policy. It shows the declaration has not changed. It does not show the declaration is true.
FREE
A link to its passport
Once the agent has a passport, anyone with the link can check its signature, mandate and record at /check-agent, with no account.
FREE
The export
A zip of the log book with its timestamp tokens. Your customer runs apir-record, our open-source checker, on their own machine: every file, every hash and link, and each chain head against its token.
PAID
The Evidence Pack
One agent’s record, sealed behind a public verify link, with its outside timestamp, for one deal, review or claim. See the price.
WHAT IT WILL NOT TELL THEM
- The log book shows what your agent reported and any later change to it. It cannot show what the agent left out.
- The mandate is your own statement of what the agent may do.
- APIR holds no SOC 2, ISO 27001 or penetration test report. The trust page says so and lists what can be checked instead.
- APIR does not give legal advice or write anyone’s privacy policy.
- The specification lists the known gaps.
Your first agent is free, for good.
After that, AUD 99 per agent a month, or AUD 499 a month for up to 10 agents. Or AUD 49 per agent, once, for its papers. Running agents for many customers? Ask about a platform account.
We are taking on the first outside teams now.