Skip to main content
Available under X-Mnemom-Version: 2026-04-15 and later. See Agent cards for the two-card model.

​
Two cards per agent

Every agent on Mnemom is governed by two YAML cards:
CardAuthorsAnswers
Alignment cardAgent operator, Org adminWho is this agent? What may it do? What does it commit to?
Protection cardSecurity operatorHow is this agent protected from threats?
Both cards are composed at storage time from three scopes — Platform ⇒ Org ⇒ Agent — into a canonical document the gateway and observer read on every request. Composition semantics (union / deny-overrides / floor / concat) are defined on the Agent cards page.

​
Endpoint surface

​
Per-agent

MethodPathPurpose
GET/v1/alignment/agent/:idRead the canonical alignment card
PUT/v1/alignment/agent/:idPublish a new alignment card (YAML or JSON)
GET/v1/protection/agent/:idRead the canonical protection card
PUT/v1/protection/agent/:idPublish a new protection card
GET/v1/agents/:id/exemptionsList active exemptions
POST/v1/agents/:id/exemptionsGrant an exemption (org-admin only)
DELETE/v1/agents/:id/exemptions/:exemption_idRevoke an exemption

​
Per-org

MethodPathPurpose
GET/v1/alignment/org/:idRead the org alignment template
PUT/v1/alignment/org/:idUpdate the template (triggers org-wide recompose)
DELETE/v1/alignment/org/:idClear the template
GET/v1/protection/org/:idRead the org protection template
PUT/v1/protection/org/:idUpdate the template (triggers org-wide recompose)
DELETE/v1/protection/org/:idClear the template

​
Content negotiation

All card endpoints are YAML-first.
Request headerResponse body
Accept: text/yaml (default)YAML
Accept: application/yamlYAML
Accept: application/jsonJSON
PUT endpoints accept either YAML (via Content-Type: text/yaml) or JSON (via Content-Type: application/json with the raw card as the body, or wrapped as { "card_yaml": "<yaml string>" } or { "card_json": {...} }).

​
Required request headers on mutations

Every PUT, POST, or DELETE must carry: 
Idempotency-Key: <opaque 24h-unique string>
Replays of the same key with the same request body return the cached response. Replays with a different body return 422 Idempotency-Key conflict.

​
Cross-cutting contracts

Every response from a card endpoint includes X-Mnemom-Schema, every mutation writes a governance_audit_log row before responding, and every mutation emits a webhook event. See the Governance guarantees page for details.

​
What is NOT available through these endpoints

  • Trust edges, team cards, team coherence, fault lines — separate endpoints under /v1/teams/…; unchanged by the unified-cards consolidation.
  • Safe House operational endpoints (quarantine, canary, patterns, metrics, sessions, compliance reports) — preserved; unchanged by the unified-cards consolidation.
  • Policy evaluation — /v1/policies/evaluate and /v1/policies/evaluate/historical are preserved as a distinct concern (evaluate a card’s enforcement section against a tool manifest).