Mint an OAuth access token, find an action in the public catalogue and call it at POST /api/v1/actions/<id>.
Agents, evidence, governance, commerce and disclosure are all in Trustvice 360. Sign up free and open every suite from one dashboard.
© 2026 Trustvice. All rights reserved. Trustvice is a product by Trustvice. Secured and supercharged by Avonao Labs.
Report abuseYou want a machine caller, an agent or a script, to use one Trustvice capability. Every capability is a registered action with a stable id, a typed input and the same response envelope, so one request shape covers all of them.
Trustvice 360tvc_… id and its secret)curlThe code reads secrets from environment variables. Keep them in your shell or your secret store, never in a file you commit. Action calls also send X-Workspace-Id.
Exchange your OAuth client's id and secret for an access token with client_credentials. The token lives for one hour (expires_in: 3600) and carries the client's permission scope. Export it as TRUSTVICE_TOKEN.
Every action answers in the same envelope: ok: true with data, or ok: false with an error code and message.
{ "ok": true, "data": { …action output… } }
{ "ok": false, "error": { "code": , : } }401 unauthenticated, never a half-authenticated request.403 permission_denied, naming the exact permission that was required.
Trustvice 360: trust and govern your AI agents with signed, verifiable evidence.
Digital Trust. On the Record.
The innovation platform for
Software‑as‑a‑Service.
curl -sS -X POST https://api.trustvice.com/api/v1/oauth/token \
-H "Content-Type: application/json" \
-d "{\"grant_type\":\"client_credentials\",\"client_id\":\"tvc_…\",\"client_secret\":\"$TRUSTVICE_CLIENT_SECRET\"}"POST /api/v1/oauth/token
{ "grant_type": "client_credentials",
"client_id": "tvc_…", "client_secret": "…" }The public catalogue of registered actions is served at GET /api/v1/actions, without a credential. Action ids are hierarchical: <domain>.<noun>.<verb>. The API reference lists every action's input schema and permissions.
curl -sS https://api.trustvice.com/api/v1/actionsSend the action's input as JSON to POST /api/v1/actions/<action-id>, with the access token and your workspace id. Workspace API keys are rejected here by design: an API key grants workspace access, not agent intent.
curl -sS -X POST https://api.trustvice.com/api/v1/actions/<action-id> \
-H "Authorization: Bearer $TRUSTVICE_TOKEN" \
-H "X-Workspace-Id: ws_…" \
-H "Content-Type: application/json" \
-d '{ … }'POST /api/v1/actions/<action-id>
Authorization: Bearer <oauth-access-token>
X-Workspace-Id: ws_…
Content-Type: application/json
{ …input fields… }Read ok first. On success the output is in data; on failure error carries a machine-readable code and a human sentence. A domain 404 or 422 is the product answering, not a transport error.
Copied from: /docs/actions
Idempotency-Key header.412 confirmation_required first.Every statement above comes from the Trustvice docs linked on this page. Where a docs page says more, it is the reference.
Handle 412 confirmation_required: mint a confirmation token and replay the call with X-Trustvice-Confirmation.
One short email when we add recipes to the cookbook. No other mail, and you can unsubscribe from any message.
One POST endpoint per registered action, with the same behaviour over REST and MCP. The docs list every action with its input and permissions.