Haldir — The Guardian Layer for AI Agents

# Haldir — The Guardian Layer for AI Agents > Haldir provides identity, secrets management, and audit logging for AI agents via REST API and MCP (Model Context Protocol). ## What Haldir Does Haldir sits between AI agents and the tools they use. It enforces governance on every action: - **Gate**: Scoped sessions with permissions and spend limits. Agents authenticate through Gate before accessing any tool. - **Vault**: Encrypted secrets (API keys, credentials, tokens). Agents request access; Vault checks session scope before returning values. - **Watch**: Immutable audit log for every action. Anomaly detection, cost tracking, compliance exports. - **Proxy**: Intercepts every MCP tool call. The agent connects to Haldir; Haldir forwards to upstream servers after enforcing policies. ## API Base URL https://haldir.xyz/v1 ## Authentication All endpoints require an API key via header: - `Authorization: Bearer hld_xxx` - or `X-API-Key: hld_xxx` Create your first key (no auth needed for the first key): POST /v1/keys {"name": "my-app"} ## Core Endpoints ### Sessions (Gate) - POST /v1/sessions — Create agent session with scoped permissions and spend limit - GET /v1/sessions/{id} — Get session info including remaining budget - DELETE /v1/sessions/{id} — Revoke session immediately - POST /v1/sessions/{id}/check — Check if session has a permission {"scope": "read"} ### Secrets (Vault) - POST /v1/secrets — Store encrypted secret {"name": "key", "value": "secret"} - GET /v1/secrets/{name} — Retrieve secret (pass X-Session-ID header for scope check) - GET /v1/secrets — List secret names (never values) - DELETE /v1/secrets/{name} — Delete secret ### Payments - POST /v1/payments/authorize — Authorize payment against session budget {"session_id": "ses_xxx", "amount": 29.99} ### Audit (Watch) - POST /v1/audit — Log action {"session_id": "ses_xxx", "tool": "stripe", "action": "charge", "cost_usd": 29.99} - GET /v1/audit — Query audit trail. Params: se

{ "openapi": "3.1.0", "info": { "title": "Haldir API — Governance for AI Agents", "version": "0.1.0", "description": "Haldir is a security and governance layer for AI agents, composed of three modules:\n\n- **Gate** — Session-scoped permissions. Create short-lived sessions with explicit scopes (read, write, admin, spend:N) and TTLs. Every privileged operation must pass through Gate first.\n- **Vault** — Encrypted secret storage with access control. Secrets are AES-encrypted