Quickstart
API base: https://api.mephistopheles.ai/v1. Authenticate server-to-server requests with a key created in your account. The secret is displayed once and stored only as a hash.
curl --request POST \
--url https://api.mephistopheles.ai/v1/verifications \
--header 'Authorization: Bearer mph_test_REDACTED' \
--header 'Idempotency-Key: 0198-example-request-id' \
--header 'Content-Type: application/json' \
--header 'X-Request-ID: your-trace-id' \
--data '{
"content": "The statement to examine.",
"profile": "general_web",
"mode": "thorough",
"retention_hours": 24
}'Result contract
Each result includes aligned claims, five verdict states, evidence relationships and passages, coverage, materiality-weighted risk, abstention, policy versions, retrieval time and engine configuration. Unknown fields are rejected on write endpoints.
| Verdict | Meaning |
|---|---|
| supported | The active policy obtained sufficient suitable evidence. |
| contradicted | Suitable evidence directly conflicts with the claim. |
| disputed | Credible evidence conflicts or context prevents a single conclusion. |
| unverifiable | The policy did not obtain sufficient suitable evidence. |
| not_checkable | The content is outside factual verification. |
Complete v1 surface
The table is generated from the same route definitions that produce the OpenAPI 3.1 document, so unavailable or renamed operations cannot silently remain in this page.
| Method | Path | Purpose |
|---|---|---|
POST | /v1/verifications | Create Verification |
POST | /v1/claims/verify | Verify Claim Direct |
POST | /v1/batches | Batch Verify |
GET | /v1/verifications/{verification_id} | Get Verification |
GET | /v1/verifications/{verification_id}/export | Export Verification |
GET | /v1/policies | Policies |
GET | /v1/models | Models |
GET | /v1/engine | Engine Versions |
POST | /v1/documents | Submit Document |
GET | /v1/documents/{job_id} | Document Status |
GET | /v1/documents/{job_id}/artifacts/{artifact_id} | Document Artifact |
POST | /v1/documents/{job_id}/cancel | Cancel Document |
POST | /v1/documents/{job_id}/retry | Retry Document |
DELETE | /v1/sessions/{session_id} | Revoke Session |
DELETE | /v1/sessions | Revoke All Sessions |
POST | /v1/billing/checkout | Billing Checkout |
POST | /v1/billing/portal | Billing Portal |
POST | /v1/api-keys | Api Key Create |
DELETE | /v1/api-keys/{key_id} | Revoke Api Key |
POST | /v1/api-keys/{key_id}/rotate | Rotate Api Key |
GET | /v1/organizations | List Organizations |
POST | /v1/organizations | Create Organization |
PATCH | /v1/organizations/{organization_id}/settings | Update Organization Settings |
GET | /v1/organizations/{organization_id}/policies | List Organization Policies |
POST | /v1/organizations/{organization_id}/policies | Create Organization Policy |
DELETE | /v1/organizations/{organization_id}/policies/{policy_id} | Deactivate Organization Policy |
GET | /v1/organizations/{organization_id}/usage | Organization Usage |
GET | /v1/usage/estimate | Usage Estimate |
GET | /v1/organizations/{organization_id}/audit-events | Organization Audit Events |
GET | /v1/organizations/{organization_id}/members | List Members |
POST | /v1/organizations/{organization_id}/members | Add Member |
POST | /v1/organizations/{organization_id}/projects | Create Project |
GET | /v1/organizations/{organization_id}/source-sets | List Source Sets |
POST | /v1/organizations/{organization_id}/source-sets | Create Source Set |
POST | /v1/organizations/{organization_id}/source-sets/{source_set_id}/resources | Add Source Resource |
DELETE | /v1/organizations/{organization_id}/source-sets/{source_set_id}/resources/{resource_id} | Disable Source Resource |
GET | /v1/organizations/{organization_id}/provider-connections | List Provider Connections |
POST | /v1/organizations/{organization_id}/provider-connections | Create Provider Connection |
POST | /v1/organizations/{organization_id}/provider-connections/{connection_id}/rotate | Rotate Provider Connection |
DELETE | /v1/organizations/{organization_id}/provider-connections/{connection_id} | Revoke Provider Connection |
POST | /v1/webhooks | Create Webhook |
DELETE | /v1/webhooks/{webhook_id} | Disable Webhook |
GET | /v1/reviews | Review Queue |
POST | /v1/verifications/{verification_id}/reviews | Review Claim |
POST | /v1/chat/completions | Chat Completions |
Current model registry
Registry version 2026-08-28. Availability and retirement are explicit; applications should not hard-code a provider’s display name.
| ID | Provider | Status |
|---|---|---|
| OpenAI | available |
| Anthropic | available |
| available | |
| xAI | available |
| DeepSeek | available |
Errors, limits and idempotency
Every response has an X-Request-ID. Metered operations also return RateLimit-Limit, RateLimit-Remaining and RateLimit-Reset. API errors use a stable code, message and request ID. Text, direct-claim, batch, chat-completion and document creation accept a stable Idempotency-Key for safe network retries. The same owner, endpoint, key and request replay the completed result; changed request material conflicts, and in-flight work returns Retry-After. Batch children are replayed independently if a later item fails. Document replay returns the original encrypted owner token. Secret-creation endpoints deliberately do not replay API-key or webhook secrets after their one-time response.
OpenAI-compatible streaming
POST /chat/completions accepts the compatible message shape. In streaming mode, the completion event arrives first and is explicitly marked unverified; the verification event follows when evidence review completes.
Provider credentials
Organisation owners and admins can create, rotate and revoke encrypted provider connections. A credential is decrypted only into request-scoped memory, propagated into bounded verification workers, excluded from logs and response objects, then discarded when the request context closes. The browser extension stores no provider secret. Direct browser-to-provider OAuth is preferred when a provider offers a suitable official flow.
Security boundary
Keep API keys on your server. Browser clients should use the same-origin workbench or extension flow. Webhook destinations, when configured, are restricted to public HTTPS endpoints and deliveries are signed. See the security page and data-flow disclosure.