The Risk Network for AI

Measure and reduce AI risk at runtime with the Humanos API, build a verified risk reputation, and use it to unlock credit, insurance, yield and more.

Overview

Humanos is the Risk Network for AI. AI risk changes every time an agent acts, so Humanos measures it continuously, reduces it with runtime controls, and makes it provable with signed, verifiable evidence.

The Humanos API is how your systems take part in that network:

• Control risk. Verify every agent action against a user-approved mandate before it executes, and capture human approval at runtime when an action falls outside its scope. See Agent Actions and Collecting Approvals.
• Measure risk. Every approval, verification, and revocation is recorded as a signed event on the credential’s chain: runtime evidence about each mandate and the agent acting under it.
• Build on risk intelligence. Read risk metrics computed from that evidence for your own agents, or for a partner’s agents while they share access with you. See Risk Metrics.

An agent’s risk record is built once and can be shared with any partner across the network. Insurers, lenders, and auditors you share it with assess the agent from its verified record instead of starting from zero, which is what unlocks credit, insurance, yield, and other financial products.

Base URL: https://api.humanos.tech

SDKs

Skip the raw HTTP calls. Our official SDKs wrap every endpoint in idiomatic bindings for your stack, including auto-signing and webhook decryption.

TypeScript

npm install humanos

For the full SDK documentation click here.

Python

pip install humanos

For the full SDK documentation click here.

C#

dotnet add package Humanos

For the full SDK documentation click here.

Concepts

Concept	Description
Action	A reusable policy template you publish from the dashboard. Declares userParams, the values the user approves; executionParams, the values the agent supplies at execution time; and the rules that compare them.
Mandate	A signed W3C credential of type POLICY that the user issues to your agent. It references one action plus the userParams values that bind this specific approval.
Verifiable Presentation (VP)	A short-lived, signed proof derived from a mandate. The agent presents one each time it wants to act.
Verify	Humanos checks the VP’s signatures, expiry, revocation status, and the action’s rules against the agent’s executionParams. Returns allow or deny.
Revoke	Kills a mandate. Any further VP issuance or verify call is denied.
Risk metrics	Aggregates computed from an agent’s mandates, signed lifecycle events, and the identity checks of the humans who granted its authority. Available for your own agents, or for a partner’s while that partner shares access with you.

Lifecycle

A mandate’s lifetime breaks into two flows:

• Request and approval happens once. You define an action, request a mandate, and the user accepts or rejects. On accept, Humanos issues the mandate and you persist its ID.
• Issuance and verification happens on every action. The agent issues a fresh VP from the mandate, Humanos verifies it against the agent’s executionParams, and returns allow or deny.

Every event in both flows also feeds the agent’s risk metrics, so measurement runs continuously without a separate integration.

Walk each flow end to end in the Guides.

Audit trail

Every consequential event in a mandate’s lifecycle, whether issuance, approval, verification, or revocation, is persisted as an immutable, cryptographically signed record chained to the credential. Audit Credential Event Chain re-verifies that chain and returns a tamper-evidence report (credentials issued before the v0.2 format have no chain). You get a complete, tamper-evident history without logging anything yourself, and it is the same evidence the risk metrics are computed from.

W3C standards

Every entity in the Humanos ecosystem, whether an automated system, an organization, or an end user, is identified by a Decentralized Identifier, or DID, that complies with the W3C DID standard. All authorizations are encapsulated as W3C Verifiable Credentials 2.0, giving each authorization a cryptographic proof, a tamper-evident structure, and a complete audit trail.

DID 1.1

W3C standard for verifiable identities with no central registry.

VC 2.0

W3C data model for the credentials every authorization uses.