Live demo

These call the real public routes. Credentials are minted only for the demo API's own audience, so nothing here works against any other service.

1. Mint a credential for one read

Expected: decision: ALLOW and a token. Copy the token for the next steps.

2. Ask for something outside the grants

Expected: decision: DENY, no token.

3. A path a Tomcat server would read as /admin

Expected: DENY (before 2026-11-02 it was ALLOW, one of the findings fixed that day).

4. Use the token, then use it again

curl -s https://cainstudio.online/api/v1/broker-keystone/demo-api/orders/A-1042 -H "Authorization: CAIN-Action $TOKEN"   # works
curl -s https://cainstudio.online/api/v1/broker-keystone/demo-api/orders/A-1042 -H "Authorization: CAIN-Action $TOKEN"   # replayed

5. The published key

FIRME AI CORPORATION · CAIN-42 is a Byzantine trust fabric. Numbers marked "our own check" were run by us, not by an independent party. Nothing on these pages is a certification.