Building against Temper

For someone writing code that talks to Temper — a service, a script, or an agent runtime that
is not the CLI.

The API

Every endpoint and schema is generated from the router, so the reference cannot drift from
what ships. The published API reference is at
docs.temperkb.io, rendered from the OpenAPI spec. The API base
URL is <origin>/api — for the hosted instance, https://temperkb.io/api.

Before you call anything, read The Trust Boundary — it
sets out the two-gate boundary the whole API sits behind, how to discover the audience, the
error contract, and the machine-principal sharp edge.

Authenticating as a machine

A machine principal is not a user with a long-lived token; it is its own kind of principal,
registered ahead of time.

Standing up a machine credential —
issuing and using machine credentials.

Machine tokens — the token claim shape, who mints vs.
who validates, and what a token does and does not carry.

Token verification — how a token is validated, and
the one-issuer-per-instance invariant.

What a caller is allowed to do

Authoring authorization — the rules that
decide whether a write is permitted: explicit capability, the three predicates, and the
container-write cascade.

Contexts and refs — what a context is and how to
address one. The ref grammar, the two-grammars problem, and the four traps.

Query cost and the bounds that shape it — what a
composed read costs, which layer bounds what, and why cost follows the acts you compose rather
than the stages you declare.

Compose queries that stay fast — the
practical half: binding producers, why every declared stage executes, and what to measure.

Language SDKs

Ruby, via temper-rb — the generated gem and how it tracks the
API.

Building against Temper

The API#

Authenticating as a machine#

What a caller is allowed to do#

Language SDKs#

The API

Authenticating as a machine

What a caller is allowed to do

Language SDKs