Quickstart

Mint a key, call REST, optionally attach MCP. You get the same org data and RBAC as the dashboard, including SHA-256-fingerprinted evidence metadata and lifecycle states.

Before you curl: skim Lifecycle (named states as signals) and Verification (hash-chained vs optional Seal). Access shape: Access Model.

Prerequisites

Need	Detail
Arbiter org membership	Signed-in user in a provisioned org
API key	Mint under Settings (or `POST /api/api-keys` once you have a bootstrap session)
Expected outcome	`200` JSON from `GET /api/risks` or MCP `list_risks`

No workspace yet? Start at arbiter.blockskunk.com (subscribe online; we provision your org and email when it is ready). Once signed in, mint a key under Settings or call POST /api/api-keys as documented in Authentication. In-app docs live at /settings/api-docs.

First REST call

# 1. Mint a key in the Arbiter app (Settings).
export ARBITER_API_KEY="arb_…"

# 2. List risks
curl -H "Authorization: Bearer $ARBITER_API_KEY" \
  https://arbiter.blockskunk.com/api/risks

# 3. Partner Read (metadata-only envelope)
curl -H "Authorization: Bearer $ARBITER_API_KEY" \
  "https://arbiter.blockskunk.com/api/v1/assets?limit=50"

Successful Partner Read responses include contractVersion: "arbiter.partner.v1", evidence_hash, verified_no_npi, and cursor pagination. See Pagination.

First MCP call

npx @modelcontextprotocol/inspector \
  --transport streamable-http \
  --url https://mcp.arbiter.blockskunk.com/mcp \
  --header "Authorization: Bearer $ARBITER_API_KEY"

The same key works on REST and MCP. See MCP.

Production checklist

Store the key in a secret manager — never in git.
One key per workload; rotate on a schedule (Authentication).
Prefer Partner Read /api/v1 for external OS sync — not unversioned UI paths.
Honor 429 + Retry-After; treat 5xx as retryable with backoff.
Confirm NPI / metadata-only boundary on partner envelopes (verified_no_npi).
Read the Disclosure Boundary before publishing integration docs of your own.

Next: Authentication