REST API

1. Authentication

   Include your API token in the Authorization header for all requests.

   Authorization: Bearer PHYLAX_API_TOKEN

   Every read endpoint is public, so you can explore the whole API without a token. One is required only to apply your organization’s policies or to reach org-scoped resources.

2. Base URL

   All requests should be made to the following base URL.

   https://api.phyi.dev

3. Endpoint groups

   Group	Base path	Description
   Artifacts	/v1/artifacts	Upload, retrieve, and inspect artifacts.
   Attestations	/v1/attestations	Query and verify attestations.
   Policies	/v1/policies	Create, update, and evaluate policies.
   Search	/v1/search	Search artifacts and attestations.
   Webhooks	/v1/webhooks	Manage webhook endpoints and events.

4. Example request

   Evaluate an artifact against a policy.

   curl -X POST https://api.phyi.dev/v1/policies/evaluate \
     -H "Authorization: Bearer $PHYLAX_API_TOKEN" \
     -H "Content-Type: application/json" \
     -d '{
       "artifact": "pkg:npm/express@4.18.2",
       "policy": "prod-runtime-policy",
       "include": ["vulnerabilities", "licenses", "provenance"]
     }'

5. Example response

   {
     "id": "eval_0L3ZY3Z6P4Q9V4B1T6K3",
     "artifact": "pkg:npm/express@4.18.2",
     "policy": "prod-runtime-policy",
     "verdict": "allow",
     "score": 92,
     "risk": "low",
     "details": {
       "passed": ["integrity", "license", "provenance"],
       "failed": [],
       "warnings": ["outdated-dependency"]
     },
     "evaluated_at": "2026-05-24T12:34:56Z"
   }

6. Common headers and pagination

   Header	Description	Example
   Authorization	Your Phylax API token	Bearer PHYLAX_API_TOKEN
   Content-Type	Request payload format	application/json
   Accept	Response format	application/json
   X-Phylax-Page	Page number for paginated results	1
   X-Phylax-Page-Size	Page size, max 100	20
   X-Phylax-Next-Page	Returned if more results are available	2

   Treat X-Phylax-Next-Page as the only signal that more data exists. Do not infer the end of a collection from a short page: a filtered page can be short and still have successors.

Try it without an account

Every read endpoint is public, so the fastest way to evaluate Phylax is to call it.

curl https://api.phyi.dev/v1/health

{ "status": "ok" }

Network-wide telemetry, including lifetime attestation counts, the verdict split, per-track activity and a 24 hour throughput series:

curl https://api.phyi.dev/v1/dashboard/network

Recent closed rounds with their winners, and the per-task findings behind them:

curl 'https://api.phyi.dev/v1/rounds?limit=5'
curl 'https://api.phyi.dev/v1/rounds/<round_id>/attestations?miner=<ss58-hotkey>'

Closed rounds only

The attestations endpoint serves closed rounds only. Asking for a round that is still open returns an empty shell rather than partial results, so nobody builds on numbers that are still moving.

Reference

API reference Every endpoint with its parameters, response fields, caching and rate limits. Data models Field by field reference for the objects these endpoints return. Error codes Every error response, what causes it, and whether to retry. Rate limits The limits and transport constraints the API applies.

Related guides

Prefer a typed client? See SDKs. Prefer a terminal? See the Phylax CLI.