openapi: 3.2.0
info:
  title: sipi.bot — Spend Firewall for AI Agents System API
  description: 'sipi.bot sits in front of every transaction an autonomous AI agent attempts and evaluates it against your spend rules — per-transaction caps, daily totals, velocity (runaway-loop protection), merchant allow/block, category limits, time windows, and approval thresholds. It returns APPROVED, BLOCKED, or FLAGGED with a deterministic rules check, before a single dollar moves. Every decision is written to a queryable audit log.


    **The core call an agent makes before spending:** `POST /v1/transactions/evaluate`.


    Auth is optional only for the public evaluation sandbox. Pass `Authorization: Bearer ` for an isolated paid or operator-created workspace. Dashboard and control-plane routes require authentication.'
  version: 0.1.0
  contact:
    name: sipi.bot
    url: https://sipi.bot
    email: sales@sipiteno.com
  license:
    name: MIT
    url: https://github.com/kindrat86/sipi-bot/blob/main/LICENSE
  termsOfService: https://sipi.bot/terms
servers:
- url: https://sipi.bot
  description: Production
security:
- BearerAuth: []
tags:
- name: System
  description: Service health and metadata
paths:
  /health:
    get:
      tags:
      - System
      summary: Service health
      operationId: health
      security:
      - {}
      responses:
        '200':
          description: Service is up.
          content:
            application/json:
              schema:
                type: object
                properties:
                  ok:
                    type: boolean
                  service:
                    type: string
                  version:
                    type: string
  /.well-known/agent-card.json:
    get:
      tags:
      - System
      summary: Agent card (A2A discovery)
      description: Machine-readable agent card for Agent-to-Agent discovery — name, capabilities, skills, and endpoint URLs.
      operationId: agentCard
      security:
      - {}
      responses:
        '200':
          description: Agent card.
          content:
            application/json:
              schema:
                type: object
components:
  securitySchemes:
    BearerAuth:
      type: http
      scheme: bearer
      description: A checkout-issued or operator-created API key. ADMIN_TOKEN is accepted only for operator control-plane access.
externalDocs:
  description: Agent card (A2A discovery)
  url: https://sipi.bot/.well-known/agent-card.json