Documentation
The governed execution layer between AI and your application
Your application posts a question. Tether routes it, calls a model with your tools, and returns structured JSON — without ever holding your database credentials, and without writing anything until a person confirms it.
Start here
IntroductionWhat Tether is, what it is not, and when not to use it.QuickstartTwo ways in. Which one depends on whether you already have an AI.Bring your AIPut Tether in front of the agent you already run.Use Tether AIPreview, connect, add actions, govern, embed.Your first writeThe staging and confirmation flow, end to end.
Core concepts
The six objectsTenant, user, role, capability, action, approval — and nothing else.Tenants and scopeWhere identity comes from, and where it must never come from.ToolsThe catalog, and why the write flag is declared rather than guessed.Reads and writesTwo paths through the engine, and why they differ.Staged writesPreview, confirm, guard, claim, execute.The output contractTyped blocks, schema repair, and graceful degradation.Turns and ceilingsHow a turn terminates, and what bounds it.Context and memoryWhat is remembered, what is retrieved, what is never stored.Cost and quotasThe ledger, fail-closed pricing, and the breaker.
The tool endpoint
OverviewThe one thing you implement.Request envelopeExactly what arrives, field by field.Verifying signaturesHMAC verification, with working code.Returning resultsWhat to send back, and the size ceiling.Retries, timeouts, idempotencyReads retry. Writes never do.Endpoint requirementsWhat Tether refuses to connect to, and why.
SDKs
API reference
AuthenticationAPI keys, scope headers, and the rule that governs both.ChatPOST /v1/chatStreamingPOST /v1/chat/streamFeedbackPOST /v1/chat/feedbackInsightsPOST /v1/insightsActionsList and confirm staged writes.ToolsRegister, validate, and read the catalog.Approvers and policyPUT /v1/users and PUT /v1/policy — who may approve what.Tool endpointGET and PUT /v1/endpoint — where your tools run.Events webhookPUT /v1/events/webhook and GET /v1/events/deliveries — where signed events go, and whether they arrived.Domain packGET and PUT /v1/domain-pack — vocabulary, tone and the out-of-scope reply.Account/v1/account — your keys, key recovery, and erasing the account.Embed/v1/embed — the snippet with your widget key, mailed to your developer, and a check of your site.Providers/v1/provider — create the businesses you serve, issue their keys, apply your configuration.User sessions/v1/user-sessions — sign a business's people in to an approval app by a mailed link, once per link, across instances.MailSign-in links and approval notices Tether sends, its configuration, and GET /v1/mail/deliveries.AuditGET /v1/audit — the append-only history, as JSON or CSV.OutcomesGET /v1/outcomes — conversations, verified task success, handoffs and model cost for a period, as JSON or CSV.SignupPOST /v1/signup — self-serve development keys, when it is open.The MCP endpointPOST /mcp — your catalog, governed.Knowledge/v1/knowledge — your policies and FAQ, retrieved beside your tools and named on each answer.RepositoryThe CI key a repository runner publishes with, what arrived, and vocabulary suggestions.Preview ModePOST /v1/preview — answer before connecting.ErrorsEvery code the API returns.
Guides
Connect your platformFor a software provider: from nothing to a business's first verified action.Keep your repository map up to dateA GitHub Action on your own runner; your code never leaves it.Describing your APIWhich operations to import, and how to describe them so the model uses them correctly.Rendering blocksTurning the output contract into UI.Building a confirmation UIThe surface where a human approves a write.Validating your catalog in CICatch a broken catalog before your users do.The approval inboxWhere a person says yes, and sees why they cannot.The widgetAn assistant in your brand, in one script tag.Verified customersTell the agent which of your customers is asking.Calling your API as the userPass the signed-in person's own token through to your imported API.Handoff to a personPass the conversation to your staff, in your words.The tether CLIRegister, lint, run a turn, and see why it did that.Testing with mock modeExercise your catalog and endpoint with no provider key and no spend.Scoping multi-site tenantsOne customer, many locations.Choosing risk levelsWhich writes should stop and ask.
Operations
ConfigurationEvery setting, and what happens if you get it wrong.Plans and ceilingsModel, output ceiling, tool turns, tool visibility.Cost accountingReading the ledger.TelemetryWhy a turn behaved the way it did.Security modelThe boundaries, and the one that is still open.Data handlingWhat is kept, for how long, and what is not yet decided.