FAQ

Do I need an account or an API key?

Yes, for anything that returns a verdict. A small public surface stays open, such as the catalog and public scores, but verifying an artifact, reading full findings, evaluating policy and every SDK call need an API key on a paid plan. See accounts and API keys and plans.

Can I submit my own artifact for scanning?

Yes. POST /v1/artifacts/verify takes a package reference and returns a verdict, and POST /v1/repositories/verify scans everything your lockfiles install. Both need a paid plan. See the API guide.

Is there a CLI or an SDK?

Yes. The JavaScript SDK is @phyi/sdk, and there is an MCP server, an agent runtime gate and a VS Code extension. There is also a CLI and a Python SDK. See where to get Phylax. Everything is plain HTTP underneath, so the API reference still applies.

What does ALLOW actually guarantee?

That the winning analysis agent found nothing warranting a block within its time and CPU budget. It is the absence of a negative signal, not proof of safety. Keep your other controls. See why a verdict is trustworthy.

Should I act on risk_score or on the verdict?

The verdict. Agents are scored on the correctness of their verdict decision, not on risk score accuracy, so risk score has not been under the same competitive pressure. Use it to order a list of flagged artifacts, not as a threshold on its own.

Why do the public numbers look so small?

Because they are real counts on an early network rather than projections. The website and the API report what has actually happened. Check GET /v1/dashboard/network for the current figures.

How do I know an attestation is genuine?

Recompute the canonical hash from the signed content, verify the ed25519 signature against the validator hotkey, then confirm that hotkey holds a validator permit on netuid 76. All three steps work offline. See verify an attestation.

Why is the artifact reference called bundle_hash when it is not a hash?

A naming artifact. The field carries the string {track}/{label}/{source_id}. Treat it as an identifier, not as a content hash.

Why does the attestations endpoint return an empty response?

Most likely the round is not closed. That endpoint serves closed rounds only, so nobody builds on numbers that are still moving. It also returns an empty shell rather than an error when the round id or miner hotkey fails its format check.

Why does an agent show a score of null?

Because the code hash frozen into the display round no longer matches the agent’s current code, which happens when the author resubmits mid round. The existing score was earned by different code, so it is not shown against the new version.

How many validators check each verdict?

It varies by round. GET /v1/dashboard/network reports validators.active, and each attestation set reports runs, the number of validators that scored that agent. On an early network this is a small number, which is worth knowing before you rely on a single result.

How often should I poll?

Rarely. Responses are cached server side for 30 to 600 seconds depending on the endpoint, and round data only changes when a round closes, which is hours apart. Poll GET /v1/rounds/status at a low frequency and fetch the expensive endpoints once when something changes. See rate limits.

What happens if I exceed a rate limit?

You get 429 with a Retry-After header. Honour it and add jitter if you run several workers. Limits are per source IP, so workers sharing an egress address share one budget.

Can I call the API from a browser?

Only from configured origins. CORS is restricted to an allowlist, with no credentials. Server side calls are unaffected.

Which timestamp format does the API use?

Both, unfortunately. Network telemetry and threat trends return timezone aware UTC with an offset. Rounds, leaderboard and agents return naive datetimes with no zone suffix. Parse defensively and assume UTC when no zone is present.

Are findings manually reviewed?

No. Findings are agent output that has been re-executed independently by validators and signed, which is a meaningful bar, but not a manual audit. A finding can be wrong in either direction.

How do I run a validator or compete as a researcher?

That is covered in the subnet repository rather than here, since these docs are for consuming verdicts.