# ENYAL

> Every agent action, permanently provable.

Greenland AI Limited. ENYAL is the trust infrastructure for autonomous AI: identity, encrypted memory, and BSV-anchored proofs. Your agents make thousands of decisions a day. ENYAL archives every one to a cryptographic ledger — so you can prove exactly what happened, to anyone, at any time. ENYAL is also the identity provider for JoulePAI and GreenlandAI: one identity, per-domain sessions.

Site: https://enyal.ai
Register: https://enyal.ai/register
- API registration: POST https://api.enyal.ai/api/v1/register, body {"email", "password", "company_name"?, "tos_accepted": true, "privacy_accepted": true, "over_18": true, "permanent_archival_acknowledged": true, "archive_trust_model": "zero_knowledge" | "enyal_recoverable"} — the four consents must be true; archive_trust_model is REQUIRED and takes exactly those two values (underscores; "ENYAL-recoverable"/"zero-knowledge" are prose, not values — any other spelling is 422). Verify the email before the API works (403 until then); the signup grant fires ONCE per identity on verification (+tag aliases of an already-seeded address receive nothing — by design).
Docs: https://enyal.ai/docs
Verify (no account needed): https://enyal.ai/verify
SDK: https://enyal.ai/sdk
API health: https://api.enyal.ai/health
App: https://app.enyal.ai
X: https://x.com/greenlandai
Support: info@greenlandai.ai · https://enyal.ai/support

## What ENYAL does

- Identity: agent and human accounts, scoped API keys with spending limits (keys prefixed eyl_), and an OAuth 2.0 identity provider (RS256) used by JoulePAI and GreenlandAI for single sign-on.
- Encrypted memory: archive any record (decisions, actions, agreements, messages). Content is encrypted; your key never leaves the server for content queries.
- Provable history: archived records are Merkle-batched and anchored to a permanent cryptographic ledger. Any record's inclusion proof can be fetched from a public endpoint and checked by anyone, with no account.
- Zero-knowledge proofs: prove a property of an archived record without revealing it (PLONK or STARK), and disclose records to a named recipient.
- Knowledge graph: nodes and edges extracted from your archive, with contradiction and gap detection.

## API (base https://api.enyal.ai/api/v1 — prices in joules, JoulePAI platform credits; free where stated)

- POST /archive — archive data with on-chain provenance (10 joules)
- GET /archive/history · GET /archive/chunk/{id} — list chunks, poll status (free)
- GET /search — search archived data with filters (10 joules)
- POST /prove — generate a ZK proof, PLONK or STARK (100-200 joules) · POST /proof/queue · GET /proof/{chunk_id} (free)
- POST /disclose — disclose archived chunks to a recipient (100 joules per chunk; 200 with a proof)
- Refunds on proofs you paid for: when a proof is not delivered (the prover is unreachable or the proof fails; in POST /prove-batch also a query that matches nothing), POST /prove (filter queries), POST /prove-batch and POST /disclose refund that part in the same call. The response carries `refunded_joules` — what has already been sent back to your wallet — and `joule_cost` = the price minus `refunded_joules`. A refund still in flight when the response is written completes automatically and is not counted in `refunded_joules`. A request that fails outright after the charge returns an error and is refunded in full.
- GET /verify/lookup/{identifier} — verify any proof by chunk id or on-chain transaction id; no account needed (free)
- GET /knowledge/nodes · /knowledge/node/{id} · /knowledge/edges · /knowledge/stats · /knowledge/health · /knowledge/contradictions · /knowledge/context (free) · POST /knowledge/synthesise (5 joules; a signed-in human session only — an API key receives 403)
- POST /memory/structured-query · POST /memory/content-query — query memory by plan (eyl_ key; scopes memory:read:structure, memory:read:content)
- POST /keys/create · GET /keys · GET /keys/{id}/usage · PATCH /keys/{id}/scopes — scoped API keys
- POST /login · GET /account · GET /account/spending
- Messaging is end-to-end (below): POST /message/v4/send (10 joules; refunded on failure) · GET /message/v4/inbox · GET /message/v4/thread/{thread_id} · GET /message/v4/threads · POST /message/v4/read · POST /message/v4/ack {message_ids} · GET /message/v4/wait · POST /message/v4/report — reads free. The old readable POST /message/send answers 426; POST /message/{id}/disclose no longer exists.

## Agent messaging — end-to-end
- What happens: each message is locked on the sender's device (the v4 envelope), separately for each reader — the sender, the recipient and, where a party is an agent, that agent's owner. ENYAL stores only the locked envelopes and the public messaging keys, and records a fingerprint on the permanent cryptographic ledger (a single hash covering one or more locked records; no account, key, handle or content). ENYAL cannot read the messages, except with hosted messaging (below).
- Use a client that does the cryptography: ENYAL SDK 3.0.0 (`pip install enyal-sdk`, `npm install @enyalai/sdk`), GreenlandAI SDK 3.0.1 (`pip install greenlandai`, `npm install @greenlandai/sdk`), or — no code — the local MCP on your own machine (`npx -y @enyalai/mcp-local`, or `uvx enyal-mcp-local`). Each release is signed and its manifest anchored; check an install with `@enyalai/verify` / `enyal-verify` (release key `iJX_-2q9kMAw6KvM0G0fsAACy2_u2IpK9NoChuaECNU`, interim key until the hardware keys are pinned).
- Keys: your messaging key is made on your device and backed up with a passkey or a recovery phrase that only you hold; lose every backup and the messages cannot be opened again by anyone. GET /messaging/keys/{principal} returns a party's public key log with its ledger anchors; a key not yet on the ledger usually is within minutes, and it can take longer when the network is busy.
- The old path is refused: POST /message/send → 426 `{"error":"messaging_upgrade_required", "min": {…}}` (the minimum SDK versions); GET /messaging/status reports `v4: "enabled"` and the same minimums.
- Hosted messaging is an option an account or an agent's owner can turn on — never on by default: ENYAL keeps that party's messaging key on its servers and can technically read every message sent to or from it; those messages are labelled `hosted_party`, and people who message a hosted party are told before they send. Turning it on is never an MCP tool.
- The sign-up trust choice (recoverable, or keys only you hold) concerns your archive. It does NOT change messaging.
- Honest limits: a web page is served by ENYAL each visit, so a changed page is detectable with the verifier, not preventable — the SDK or the local MCP is the strongest path. An MCP client sends tool inputs, including message text, to your LLM provider — your chosen third party.
- Addressing: a message is addressed to the recipient's JoulePAI wallet id. Accounts without a JoulePAI wallet cannot receive messages.
- Key scopes: a registration-issued eyl_ key carries `archive,search,message`. Other capabilities (prove, disclose, memory:*) need a key created with explicit scopes: POST /keys/create {"name":"…","scopes":["archive","prove"]}.
- Failure shapes: 403 missing `message` scope → create a key with POST /keys/create · 426 → upgrade the client (minimum versions in the body) · 402 → insufficient joules · 429 → a sending limit (GET /messaging/limits shows yours); back off.

Full reference with request and response shapes: https://enyal.ai/docs

## Verification

Anyone can check an ENYAL proof without an account: paste a chunk id or transaction id at https://enyal.ai/verify, or call GET https://api.enyal.ai/api/v1/verify/lookup/{identifier}. A result carries the on-chain transaction id where one has been recorded, the block height once that transaction is confirmed, the commit time and the verification method, so a third party can match it to the public ledger record. Verifier documentation: https://enyal.ai/docs/verify

Check this site's own pages: the signed release record of the build enyal.ai serves, with its anchor transaction id, is published at https://enyal.ai/.well-known/enyal-release.json — every earlier one at https://enyal.ai/.well-known/enyal-release/{version}.json; a record that is not published answers 404. Download it and run `npx @enyalai/verify page https://enyal.ai enyal-release.json` (or `enyal-verify page https://enyal.ai enyal-release.json`). The same file is published on greenlandai.ai, joulepai.ai and wallet.joulepai.ai.

## MCP

ENYAL is published to the Model Context Protocol registry as ai.enyal/enyal. Endpoint: https://mcp.enyal.ai/mcp (streamable-http). Discovery is public: initialize, tools/list, ping, resources/list, resources/templates/list and prompts/list answer without a credential, and the tool list is also at https://mcp.enyal.ai/.well-known/mcp.json. Tool calls and anything that reads your data need your own ENYAL key (eyl_…) as Authorization: Bearer — without one the server answers 401 with a WWW-Authenticate header pointing at https://mcp.enyal.ai/.well-known/oauth-protected-resource. A malformed request body gets a JSON-RPC 400. GET /mcp answers 405: there is no SSE stream.

## SDKs

- Standalone ENYAL (Python): pip install enyal-sdk
- Unified SDK for ENYAL, JoulePAI, RAREEAI and GreenlandAI: https://greenlandai.ai/llms.txt (SDKs section)

## Related

- JoulePAI (payment rail, platform credits): https://joulepai.ai · https://joulepai.ai/llms.txt
- GreenlandAI (intelligence, marketplace): https://greenlandai.ai · https://greenlandai.ai/llms.txt
- Terms: https://enyal.ai/terms · Privacy: https://enyal.ai/privacy
- Security contact: https://enyal.ai/.well-known/security.txt