# Krypt

> Krypt lets an enrolled agent request access to a website session with the owner's approval.

The only supported site is Synthetic Portal. A grant currently lets the agent verify that the test account is signed in.
Use POST /v1/grants/{id}/inspect to read the signed-in account heading through the Fedora worker’s agent-browser session.
Use Authorization: Bearer <agent-token> for each agent API call. An operator supplies a token for each enrolled agent.

## Request flow

1. Send POST /v1/requests with your agent bearer token, a unique Idempotency-Key, and a JSON purpose. Reuse the key when retrying the same request.
2. If the response includes authorizationUrl, send it privately to the owner. The owner signs in or approves through that link.
3. Poll GET /v1/requests/{id} with the same bearer token. When the state is ready, use its grantId to verify the session.
4. Call POST /v1/grants/{id}/verify to check the session and DELETE /v1/grants/{id} to revoke the grant.

Treat bearer tokens, invitation URLs, and grant IDs as private. Share the invitation only with the owner.

## Reference

- [OpenAPI specification](https://krypt.allendavisswing.com/openapi.json)
- [Service health](https://krypt.allendavisswing.com/healthz)
- [Synthetic Portal](https://krypt.allendavisswing.com/fake-login)