Skip to content

Quickstart

Get your first AuditProof in 5 minutes.

1. Sign Up

curl -X POST https://api.nanorix.io/v1/signup \
  -H "Content-Type: application/json" \
  -d '{"email": "you@company.com", "jurisdiction": "US"}'

Response:

{
  "customer_id": "cust_8a3f...",
  "api_key": "nrx_live_a1b2c3d4e5f6...",
  "tier": "free",
  "message": "Save your API key — it cannot be retrieved later."
}

Save your API key

The API key is shown exactly once. Nanorix stores only a SHA-256 hash. If you lose it, you'll need to contact support for a key rotation.

The jurisdiction field determines which regulatory frameworks appear in your AuditProofs. Options: US, EU, UK, CA, AU, IN, OTHER.

2. Create a Capsule

curl -X POST https://api.nanorix.io/v1/capsules \
  -H "Authorization: Bearer nrx_live_a1b2c3d4e5f6..." \
  -H "Content-Type: application/json" \
  -d '{"data_classification": "PHI"}'

Response:

{
  "id": "cap_a8f3e71c4b2d9f06",
  "status": "active",
  "ttl_seconds": 300,
  "created_at": "2026-03-01T14:00:00Z",
  "expires_at": "2026-03-01T14:05:00Z"
}

The capsule is now running inside a sealed ephemeral environment with volatile-memory-only storage. The data_classification field is your declaration of what kind of data you'll process. Options: PHI, PII, financial, credentials, general.

3. Execute a Command

curl -X POST https://api.nanorix.io/v1/capsules/cap_a8f3e71c4b2d9f06/exec \
  -H "Authorization: Bearer nrx_live_a1b2c3d4e5f6..." \
  -H "Content-Type: application/json" \
  -d '{
    "command": "python classify.py",
    "input_data": "{\"record_id\": \"P-1234\", \"diagnosis\": \"Type 2 diabetes\"}",
    "timeout": 30
  }'

Response:

{
  "capsule_id": "cap_a8f3e71c4b2d9f06",
  "stdout": "classification: chronic_condition, risk_score: 0.72",
  "stderr": "",
  "exit_code": 0,
  "executed_at": "2026-03-01T14:01:00Z",
  "timed_out": false
}

The input_data is written to a file inside the sealed sandbox before execution. Your command reads it from {tmpfs}/input/data. The data never touches persistent disk and never appears in command-line arguments.

4. Destroy and Get Your AuditProof

curl -X DELETE https://api.nanorix.io/v1/capsules/cap_a8f3e71c4b2d9f06 \
  -H "Authorization: Bearer nrx_live_a1b2c3d4e5f6..."

Response (truncated for readability):

{
  "capsule_id": "cap_a8f3e71c4b2d9f06",
  "status": "destroyed",
  "cdp": {
    "cdp_version": "2.1",
    "capsule_id": "cap_a8f3e71c4b2d9f06",
    "created_at": "2026-03-01T14:00:00Z",
    "destroyed_at": "2026-03-01T14:04:58Z",
    "chain": [
      {"step": 1, "subsystem": "eee_namespace", "operation": "environment_isolation", "evidence_hash": "sha512:...", "chain_hash": "sha512:..."},
      {"step": 8, "subsystem": "capsule_destroy", "operation": "lifecycle_completion", "evidence_hash": "sha512:...", "chain_hash": "sha512:..."}
    ],
    "final_hash": "sha512:2c8a4f63d19e7b...",
    "attestation": {
      "algorithm": "Ed25519",
      "public_key": "base64:MCowBQYDK2Vw...",
      "signature": "base64:VGhpcyBpcyBh..."
    },
    "regulatory_context": {
      "notice": "This mapping identifies regulatory provisions related to the destruction evidence. It is not a compliance certification. Compliance determinations should be made by qualified legal and compliance professionals.",
      "framework_version": "2026-02",
      "jurisdiction": "US",
      "mappings": [
        {
          "step": 3,
          "subsystem": "eee_memory",
          "frameworks": [
            {
              "regulation": "HIPAA",
              "provision": "§164.310(d)(2)(i)",
              "description": "Device and media controls — disposal",
              "relationship": "related_to"
            }
          ]
        }
      ]
    }
  }
}

Save the cdp object as auditproof.json. This is your AuditProof — signed evidence of the capsule's full lifecycle.

The regulatory_context section maps each destruction step to relevant regulatory provisions. This is a factual reference mapping, not a compliance certification. Your compliance team uses it as evidence alongside their own controls.

5. Verify the AuditProof

Online (API)

curl -X POST https://api.nanorix.io/v1/verify \
  -H "Content-Type: application/json" \
  -d @auditproof.json

Online (Web)

Go to nanorix.io/verify and drag-and-drop your AuditProof file.

Offline (Python)

import json
from nanorix.verifier import verify

with open("auditproof.json") as f:
    proof = json.load(f)

result = verify(proof)   # recomputes the full hash chain + checks the Ed25519 signature, offline
print("chain valid:", result.chain_valid)
print("signature valid:", result.signature_valid)
print("ok:", result.ok)
if not result.ok:
    print("failed step:", result.failed_step, "-", result.failure_reason)

The full manual algorithm (for verifying with no Nanorix code at all) is in Verification.

For all verification methods, see Verification.

6. Retrieve the Stored Record

If you need the record later:

curl https://api.nanorix.io/v1/proofs/cap_a8f3e71c4b2d9f06 \
  -H "Authorization: Bearer nrx_live_a1b2c3d4e5f6..."

This returns the stored AuditRecord — your private complete record — for any destroyed capsule you own.

What's Next