Trusty Sweep Developer Support
Overview
One engine, consumer + programmable: sources, inventory, Shadow Sweep plans, verified execution, receipts, Vault, portability, intelligence, creator revenue reconciliation, usage.
Trusty Sweep API 1.0.0
Section titled “Trusty Sweep API 1.0.0”The Trusty Sweep public API is a thin, governed externalization of the primitives the consumer product uses. Every material action follows plan → validate → authorize → commit → verify → receipt. See https://developers.trustysweep.com for guides.
Conventions: prefixed ULID ids; cursor pagination (limit, cursor → data, next_cursor); Idempotency-Key on mutations; RFC 9457 problem responses; IETF RateLimit-* headers; CloudEvents webhooks signed with Sweep-Signature.
Authentication
Section titled “Authentication”sessionCookie
Section titled “sessionCookie”Consumer web session (HttpOnly). Mutations require an allowlisted Origin.
Security scheme type: apiKey
Cookie parameter name: sweep_session
sessionToken
Section titled “sessionToken”Consumer session token for native/PWA clients.
Security scheme type: http
Bearer format: sst_…
apiKey
Section titled “apiKey”Developer API key. Scopes fixed at creation. sk_test_ keys operate in the isolated test tenant.
Security scheme type: http
Bearer format: sk_live_… | sk_test_…
oauth2
Section titled “oauth2”OAuth 2.1 with PKCE (S256), RFC 8707 resource indicators, refresh rotation. Discovery: /.well-known/oauth-authorization-server.
Security scheme type: oauth2
Flow type: authorizationCode
Authorization URL: https://api.trustysweep.com/oauth/authorize
Token URL: https://api.trustysweep.com/oauth/token
Refresh URL: https://api.trustysweep.com/oauth/token
Scopes:
- sources:read - Read connected sources and quota
- sources:write - Connect, disconnect, and configure sources
- inventory:read - Read normalized inventory, diagnosis, and the Digital State Graph
- plans:write - Create, validate, and price Shadow Sweep plans; read executions and receipts
- plans:commit - Authorize and commit plans (executes actions within the user's delegation)
- vault:read - List, search, and download Vault objects and manifests
- vault:write - Upload to the Vault and manage destinations
- intel:read - Read trial, renewal, meter, and spend intelligence
- creator:read - Read creator revenue audits
- creator:write - Connect creator sources and upload statements
- usage:read - Read usage, charges, and the commercial envelope
- grants:manage - List and revoke delegation grants
- account:read - Read account identity and events
- webhooks:manage - Manage webhooks