Build on the risk-signals layer.

Authentication

# 1. Get a token
curl -X POST https://api.assurelocker.com/v1/oauth/token \
  -d grant_type=client_credentials \
  -d client_id=$CLIENT_ID -d client_secret=$CLIENT_SECRET

# 2. Generate a Risk Signals Pack (sandbox)
curl -X POST https://api.assurelocker.com/v1/po/risk-signals \
  -H "Authorization: Bearer $TOKEN" \
  -H "x-idempotency-key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{ "mode": "DEMO", "buyerGstin": "...", "borrowerGstin": "...", "subcontractorGstin": "...", "poValue": 5000000 }'

Core endpoints

Public registry anchoring

Every long-lived object we issue — Receivable Evidence Objects, KYC/KYB passports, identity-state transitions, membership events and PO/receivable records — is hash-anchored in an immutable registry. The anchor is a timestamped, tamper-evident fingerprint: anyone holding the object can prove it existed, unaltered, at a point in time — and the same PO or receivable presented twice is detectable independently of any external registry. Hashes only — never raw PII or commercial data in the registry.

// Every pack & webhook payload carries an "anchor" block:
"anchor": {
  "network": "public-registry",
  "txId": "tx_9f2c1a8e...",        // public-registry anchor id
  "payloadSha256": "9f2c..."       // SHA-256 of the canonical object (hash only)
}

// Verify locally (Node) — tamper-evident, no trust in us required:
import { createHash } from "node:crypto";
const recomputed = createHash("sha256").update(canonicalJson).digest("hex");
const ok = recomputed === anchor.payloadSha256;   // must match
// then confirm anchor.txId in the public registry for end-to-end proof.

Error codes