Passkey / Base Account / SIWE / DID·CACAO / recovery phrase / TOTP on auth.mithril.fund, card verification, the assurance ladder, token revocation.

Guardrail templates and the firewall's task × rung table, rendered from the enforced policy.

Organizations (did:webvh), roles, member invitations, organization SSO (OIDC).

Cancel at period end, no proration, allowance expiry, refunds and disputes.

Issue a connection token in the account console and put it in the environment.

The catalog at /v1/models: red-team (dedicated route) and blue-team (shared route) models, what admits each, and per-model detail.

Everything with curl alone: catalog, completion, stream, tools, jobs, status, balance.

Every public endpoint: method, auth, request and response shapes.

Point the Python / TypeScript OpenAI SDK with one base_url line. What passes, what is dropped.

The Messages wire is not served (measured 405). Use the OpenAI wire, or a translating proxy.

The Gemini wire is not served (measured 405). Use the OpenAI wire.

LangChain, LlamaIndex, Vercel AI SDK, OpenAI Agents SDK, LiteLLM.

stream: true is served as a one-chunk SSE; underneath, a job (submit, poll).

Native tool calling: send definitions, get tool_calls back. Execution stays on the agent.

The model reasons before it answers; reasoning tokens count inside max_tokens.

Writing for the research model: framing the task, the system turn, passing files, asking for JSON, what to avoid.

/mcp.json, llms.txt, agent-quickstart.md — the entry points an agent reads for itself, and what is MCP and what is not.

Guardrails on every request, the firewall by assurance rung, versions published at /secure/.

response_format is accepted and dropped. Ask for JSON in the prompt.

The OpenAI-compatible error shape and per-code handling.

The free 50 req/day allowance and tokens/day by assurance rung.

1 credit = $1; plans, balances, per-token micro-USD rating, settlement from receipts. Top up any whole-dollar amount from $10 to $1,000; larger credit packs carry a bonus.

Reading billing / usage / chargedMicroUSD on a response, and how free vs paid is decided.

What is kept, where, for how long: the prompt's path, job records, audit receipts, payment data, logs, deletion.

Bring-your-own provider keys are not offered (first-party inference).

The public catalog of the security-services suite at GET /v1/security/services — CTEM, VM, GRC, IR and DR (component-shipped), DAST, SAST and SPECT (gated), their findings feeding the VM ledger, and the CSF 2.0 GOVERN / RESPOND / RECOVER APIs. The spear-phishing defence solution is at GET /v1/security/solutions/spear-phishing.