Accept your organization's private invitation link and create your password.
An owner or administrator opens Access & API and generates an expiring key with the required scopes. Save the one-time value in your server's secret store.
Call the API over HTTPS from your backend. Keep API keys out of browser code and query strings.
Base URL: . The organization is determined by the key; no tenant selector is accepted.
Collection is synchronous and can take tens of seconds. Allow a 120-second client timeout. If a POST times out, inspect recent analyses before submitting another collection; POST /analyses has no idempotency key.
Python example (standard library)JavaScript example (server-side fetch)
02 / EVIDENCE
What the data describes
Source-reported, bounded public-chain samples with anchors, retrieval times and coverage. Exact amounts are decimal strings in base units; parse them as integers with arbitrary precision.
Red: structural deviation within the sampled asset cohort. Blue: completeness of block anchors, transaction references, amounts and timestamps. Red can be null when the sample is insufficient.
Scores are descriptive and private. Graph connections do not establish identity, ownership or continuity of value. Bitcoin inputs and outputs are separate observations; summing both is not transfer volume.
Reference search covers indexed retained analyses. The response reports indexed versus retained counts. Opening an older analysis indexes it.
03 / OPERATIONS
Limits and lifecycle
120 authenticated API requests/minute per user or key.
6 analysis collections/minute and 100/day per organization; 1–4 pages; up to 1,200 references and 4,000 records.
60 Graphus gateway reads/minute per organization; 30 overview and 30 science reads/minute per organization.
Latest 50 analyses, 100 investigations, 50 evidence snapshots per investigation, 100 watched references and latest 500 observation matches per organization.
Each evidence snapshot retains up to 100 incident records and reports truncation; it survives analysis retention.
Watchlists evaluate on collection or explicit evaluation. No background chain scan, email transport or webhooks are deployed.
Scopes, pagination and errors
All scopes listed for an operation are required. Keys expire and can be revoked immediately; their creator must retain an owner/admin membership. Browser viewers cannot create analyses, investigations or watch entries.
Paginated endpoints return items and next_cursor. Send the cursor unchanged with the same filters. limit is 1–50 (default 25). New records created during pagination appear after restarting the list. Concurrent deletion and retention may remove records.
Failures return {"error":"machine_readable_code"}. Every API response carries X-Request-Id and X-Porb-Api-Version. HTTP 401 means authentication failed; 403 means missing permission; 404 includes resources belonging to other organizations. On 429 respect Retry-After. Retry GET after transient 502/503 with bounded backoff; do not blindly retry writes.
Private responses use Cache-Control: no-store, private. Partner credentials are intended for server integrations. Browser cross-origin calls are not enabled.
Evidence digest verification: compute SHA-256 of UTF-8 JSON.stringify(snapshot) in the returned property order; compare the lowercase hexadecimal value to digest. This verifies the preserved packet, not independent verification of the source chain.