Financial infrastructure for autonomous software.

# 1. Prove control of the owner key (ed25519). Nothing else is needed: no browser, no wallet app.curl -X POST "$VEYRA_URL/api/v1/auth/challenge" -H "Content-Type: application/json"   -d '{ "address": "<owner public key, base58>" }'# -> { "message": "...", "nonceToken": "..." }   sign the UTF-8 bytes of message, base58 the signaturecurl -X POST "$VEYRA_URL/api/v1/auth/token" -H "Content-Type: application/json"   -d '{ "address": "...", "message": "...", "signature": "...", "nonceToken": "...", "organizationName": "My agent" }'# -> { "token": "vot_..." }   the organization exists now# 2. Create the Squads account. The response is a transaction prepared and simulated on mainnet.curl -X POST "$VEYRA_URL/api/v1/accounts" -H "Authorization: Bearer $VOT" -H "Content-Type: application/json"   -d '{ "name": "Agent Ops", "type": "AGENT", "coOwners": [], "threshold": 1,        "vaults": [{ "name": "Operating Vault", "type": "OPERATING", "description": "" }],        "deposit": { "asset": "SOL", "amount": "0.05" } }'# -> { "id": "ptx_...", "transaction": "<base64>", "simulation": { "ok": true } }# 3. Add the owner signature to the transaction (keep existing signatures) and submit it.curl -X POST "$VEYRA_URL/api/v1/tx/ptx_.../submit" -H "Authorization: Bearer $VOT" -H "Content-Type: application/json"   -d '{ "transaction": "<signed base64>" }'# -> { "signature": "...", "result": { "accountId": "acc_..." } }   confirmed on Solana mainnet# 4. Same pattern for POST /api/v1/agents, deposits, approvals and withdrawals.

// curl -o veyra.ts "$VEYRA_URL/sdk/veyra.ts"   (single file, no dependencies)import { Veyra, signInWithKey, type OwnerSigner } from "./veyra";import { ed25519 } from "@noble/curves/ed25519.js";import bs58 from "bs58";const secret = ed25519.utils.randomSecretKey();           // persist securely, then fund the address with SOLconst owner: OwnerSigner = { publicKey: bs58.encode(ed25519.getPublicKey(secret)), signMessage: (m) => ed25519.sign(m, secret) };const { token } = await signInWithKey(process.env.VEYRA_URL!, owner, { organizationName: "My agent" });const veyra = new Veyra({ apiKey: token, baseUrl: process.env.VEYRA_URL! });const { result: { accountId } } = await veyra.owner.createAccount({ name: "Agent Ops", deposit: { asset: "SOL", amount: "0.05" } }, owner);const ctx: any = await veyra.context();const payee = await veyra.owner.createCounterparty({ name: "Vendor", type: "BUSINESS", address: "<base58>" });const { result: { agentId } } = await veyra.owner.createAgent(  { accountId, vaultId: ctx.vaults[0].id, name: "Atlas", kind: "PAYMENT", limits: [{ asset: "SOL", amount: "0.02" }], period: "DAY", counterpartyIds: [payee.id], gasSol: "0.01" },  owner,);const { execution } = await veyra.intents.submit({ agentId, action: "PAYMENT", asset: "SOL", amount: "0.003", counterpartyId: payee.id });console.log(await veyra.executions.wait(execution.id));

# The base URL is the origin of your VEYRA deploymentexport VEYRA_URL="https://your-veyra-deployment"# API key (organization scope), created in /developers/dashboardexport VEYRA_API_KEY="vk_live_..."# Agent session token (one agent, its vaults and allowed actions)export VEYRA_AGENT_TOKEN="vas_..."# Find your agentId, vaultId and counterparty ids with one callcurl "$VEYRA_URL/api/v1/context" -H "Authorization: Bearer $VEYRA_AGENT_TOKEN"

curl -X POST "$VEYRA_URL/api/v1/intents/preview" \  -H "Authorization: Bearer $VEYRA_AGENT_TOKEN" \  -H "Content-Type: application/json" \  -d '{    "agentId": "agt_...",    "action": "SWAP",    "asset": "USDC",    "outputAsset": "SOL",    "amount": "250",    "maxSlippageBps": 50  }'

curl -X POST "$VEYRA_URL/api/v1/intents" \  -H "Authorization: Bearer $VEYRA_AGENT_TOKEN" \  -H "Content-Type: application/json" \  -H "idempotency-key: rebalance-2026-10-05-001" \  -d '{    "agentId": "agt_...",    "action": "SWAP",    "asset": "USDC",    "outputAsset": "SOL",    "amount": "250",    "maxSlippageBps": 50,    "justification": "Rebalance to target SOL weight"  }'# 202 Accepted (200 with "replayed": true for a repeated idempotency key)# { "execution": { "id": "exe_...", "state": "CREATED", ... }, "replayed": false }

curl "$VEYRA_URL/api/v1/executions/exe_..." \  -H "Authorization: Bearer $VEYRA_AGENT_TOKEN"

curl "$VEYRA_URL/api/v1/agents/agt_..." \  -H "Authorization: Bearer $VEYRA_AGENT_TOKEN"# {#   "agent": { "id": "agt_...", "status": "ACTIVE", "chainStatus": "ACTIVE",#              "executor": "<executor public key>", "primaryVaultId": "vlt_...", ... },#   "limits": [ { "asset": "USDC", "amount": "...", "period": "DAY",#                 "destinations": ["..."], "remaining": "...", ... } ],#   "wallet": { "balances": [ ... ], "totalUsd": 0 },#   "gasLamports": 0# }

# Pause or resume an agent (API key)curl -X PATCH "$VEYRA_URL/api/v1/agents/agt_..." \  -H "Authorization: Bearer $VEYRA_API_KEY" \  -H "Content-Type: application/json" \  -d '{ "status": "PAUSED" }'

curl "$VEYRA_URL/api/v1/vaults" \  -H "Authorization: Bearer $VEYRA_API_KEY"# [ { "id": "vlt_...", "name": "...", "type": "PAYMENT", "address": "<vault PDA>",#     "status": "ACTIVE", "balances": [ { "asset": "USDC", "amount": "<base units>",#     "decimals": 6, "usdValue": 0 } ], "totalUsd": 0, ... } ]

{  "decision": "REQUIRE_APPROVAL",  "triggeredPolicies": [    {      "policyId": "pol_...",      "reason": "TRANSACTION_ABOVE_THRESHOLD",      "outcome": "REQUIRE_APPROVAL",      "message": "..."    }  ],  "approvalRequirement": {    "rule": { "kind": "THRESHOLD", "required": 1, "of": ["OWNER"] },    "approvalsRequired": 1  },  "evaluatedPolicyIds": ["pol_..."],  "evaluatedAt": "<ISO 8601>"}

{  "amountUsd": 25000,             // cents, priced server-side  "evaluation": { "decision": "ALLOW", "triggeredPolicies": [], ... },  "fee": {                        // USD micro-units (1e-6), as strings    "networkFee": "...",    "executionFee": "...",    "providerFee": "...",    "totalFee": "..."  },  "route": "JUPITER",             // SPENDING_LIMIT | SQUADS_PROPOSAL | AGENT_WALLET | JUPITER  "estimatedTime": "About 15 seconds"}

curl -X POST "$VEYRA_URL/api/v1/payments" \  -H "Authorization: Bearer $VEYRA_API_KEY" \  -H "Content-Type: application/json" \  -H "idempotency-key: inv-0042-payment" \  -d '{    "agentId": "agt_...",    "counterpartyId": "cp_...",    "asset": "USDC",    "amount": "980.00",    "reference": "PO-118",    "invoice": "INV-0042",    "memo": "October hosting"  }'# { "paymentId": "pay_...", "execution": { "id": "exe_...", "state": "CREATED", ... } }

curl "$VEYRA_URL/api/v1/approvals?status=PENDING" \  -H "Authorization: Bearer $VEYRA_API_KEY"

curl -X POST "$VEYRA_URL/api/v1/agents/agt_.../requests" \  -H "Authorization: Bearer $VEYRA_AGENT_TOKEN" \  -H "Content-Type: application/json" \  -d '{    "type": "LIMIT_INCREASE",    "title": "Raise daily limit",    "requestedChange": "Daily limit to 5,000 USDC",    "currentRule": "Daily limit 2,000 USDC",    "justification": "Settlement volume doubled this week."  }'# Returns the created approval request (status PENDING) for owners to decide.

// curl -o veyra.ts "$VEYRA_URL/sdk/veyra.ts"import { Veyra, VeyraError } from "./veyra";const veyra = new Veyra({  apiKey: process.env.VEYRA_AGENT_TOKEN!, // vk_live_... or vas_...  baseUrl: process.env.VEYRA_URL!,});const agent = veyra.agent("agt_...");// Check the decision and fee first. Nothing is created or signed.const preview = await veyra.intents.preview({  agentId: agent.id, action: "PAYMENT", asset: "USDC", amount: "120", counterpartyId: "cp_...",});if (preview.evaluation.decision !== "BLOCK") {  const { execution } = await agent.pay(    { counterpartyId: "cp_...", asset: "USDC", amount: "120", memo: "INV-0042" },    { idempotencyKey: "inv-0042" },  );  const final = await veyra.executions.wait(execution.id, { timeoutMs: 90_000 });  // SETTLED | BLOCKED | FAILED | CANCELLED | AWAITING_APPROVAL}try {  await agent.swap({ from: "USDC", to: "SOL", amount: "250", maxSlippageBps: 50 });} catch (e) {  if (e instanceof VeyraError) console.error(e.status, e.code, e.message);}

new Veyra({ apiKey, baseUrl })veyra.intents.submit(body, { idempotencyKey? })veyra.intents.preview(body)veyra.executions.get(id)veyra.executions.list({ agentId?, state?, limit? })veyra.executions.wait(id, { timeoutMs?, intervalMs? })veyra.payments.create(body, { idempotencyKey? })   // API keyveyra.approvals.list(status?)veyra.agents.list()veyra.agents.get(id)veyra.agents.requestChange(agentId, body)veyra.webhooks.verify(rawBody, header, secret)      // async, Web Cryptoveyra.context()                                     // ids, scope, limits, unitssignInWithKey(baseUrl, ownerSigner)                 // -> { token: "vot_..." }veyra.owner.createAccount(body, signer)             // prepare, sign, submit, confirmveyra.owner.deposit(vaultId, body, signer)veyra.owner.createCounterparty(body)veyra.owner.createAgent(body, signer)veyra.owner.issueSession(body)                      // -> { token: "vas_..." }veyra.owner.approve(approvalId, signer)veyra.owner.withdraw(vaultId, body, signer)veyra.owner.run(path, body, signer)                 // any endpoint returning a prepared transactionsignPreparedTransaction(base64, signer)             // adds one signature, keeps the restconst agent = veyra.agent(agentId)agent.swap({ from, to, amount, maxSlippageBps })agent.pay({ counterpartyId, asset, amount, memo })agent.allocate({ asset, amount })agent.returnCapital({ asset, amount })agent.request({ type, title, requestedChange, justification })

curl -X POST "$VEYRA_URL/api/v1/webhooks" \  -H "Authorization: Bearer $VEYRA_API_KEY" \  -H "Content-Type: application/json" \  -d '{    "url": "https://example.com/veyra/webhooks",    "events": ["agent.execution.settled", "agent.execution.blocked", "approval.required"]  }'# { "id": "whk_...", "secret": "whsec_..." }   The secret is shown once.

POST /veyra/webhookscontent-type: application/jsonuser-agent: VEYRA-Webhooks/1veyra-signature: t=1791200000,v1=5f2c...e81a{ "id": "whd_...", "type": "agent.execution.settled", "createdAt": "<ISO 8601>", "data": { ... } }

import { createHmac, timingSafeEqual } from "node:crypto";const TOLERANCE_S = 300;export function verifyVeyraSignature(rawBody: string, header: string | null, secret: string): boolean {  if (!header) return false;  const parts = Object.fromEntries(header.split(",").map((p) => p.split("=", 2) as [string, string]));  const t = Number(parts.t);  if (!Number.isInteger(t) || !parts.v1) return false;  // Reject old or future timestamps (replay protection)  if (Math.abs(Math.floor(Date.now() / 1000) - t) > TOLERANCE_S) return false;  const expected = Buffer.from(createHmac("sha256", secret).update(`${t}.${rawBody}`).digest("hex"), "hex");  const received = Buffer.from(parts.v1, "hex");  return expected.length === received.length && timingSafeEqual(expected, received);}// Next.js route handlerexport async function POST(req: Request) {  const rawBody = await req.text(); // verify the exact bytes you received  if (!verifyVeyraSignature(rawBody, req.headers.get("veyra-signature"), process.env.VEYRA_WEBHOOK_SECRET!)) {    return new Response("invalid signature", { status: 400 });  }  const event = JSON.parse(rawBody) as { id: string; type: string; data: Record<string, unknown> };  // Deduplicate on event.id: deliveries can be retried.  return new Response("ok");}