Changelog
What the engine gained, newest first, and a plain list of what the previous documentation got wrong and no longer claims.
There is no dated API versioning today, and no Sidaxis-Version header. Dated versioning is on the roadmap.
Newest first
- Documentation corrected to the real
/functions/v1contract — every path, header and field name in these docs now matches a call that answers. - Hosted sessions:
hosted-session-createandhosted-session-consume, a single-use token minted by the merchant's server and exchanged once by ours. - Merchant themes:
merchant-theme-get, 22 appearance tokens on capture and 19 on mandate, with the Sidaxis theme served when a merchant has not customised. - Alias availability:
alias-availabilitywith format rules, reserved names, deterministic suggestions and a short reservation. - Document as a verified fact:
403 DOCUMENT_REQUIRED, once per identity, withliveness_reusable: false— liveness is always of the moment, a document expires on its own date. - Mandate assurance: a mandate issued from a capture that included a verified document is born
face_voice_doc. - Agent identity on mandates:
agent_display_nameandagent_descriptor, frozen at issuance and shown on authorisation, revocation and receipts. - Scope vocabulary v2: eight canonical scopes, exact matching,
taskrequires constraints. - Assurance on receipts:
face,face_voice,face_voice_doc, derived at the act and frozen — receipts written before assurance existed say the strength was not recorded. - Mandates: issue, check, consume, get, revoke, scopes, with an outbox worker delivering five signed events every minute.
Corrections
If you integrated against the earlier documentation, these are the claims that were wrong and are no longer made:
| The old text said | The engine |
|---|---|
mandate-check consumes the ceiling and is idempotent | Check is advisory and moves nothing. mandate-consume is the only call that moves a ceiling — mandates/consume |
Authorization: Bearer sk_live_… | x-sidaxis-api-key — authentication |
| A sandbox host | Sandbox is the merchant plus the key prefix — sandbox |
| FaceToken as the identifier | The auth.users UUID, minted by the engine |
| Twelve MCP tools | Nine, each mapped onto a live endpoint — MCP |
Cursor pagination, next_cursor | mandate-get lists by effective status — mandates/get |
Sidaxis-Version, Sidaxis-RateLimit-* | Nothing emits them — roadmap |
Sidaxis is the human authorisation layer. It never moves money, holds funds or settles. The machine-readable contract is openapi.yaml.