Time

Send one typed message within the consented scope — kind is one of question, proposal, evidence, note and body is a non-empty string within the channel's byte cap. Refused with a reason code when the channel is not open, expired, revoked, out of scope, oversized, malformed, or you are not a party.

Thin post-open status: state, remaining time, scope, message counts.

The poll half of the non-blocking attest path. Run attest_action with wait=false to SUBMIT — it returns a pending receipt immediately (anchor.confirmed=false, blockHeight null) without holding the connection for the ~15s block wait. Then call this to POLL: it re-checks the ledger and, once the block has landed, returns the COMPLETED receipt (blockHeight, consensus time, validation filled in, anchor.confirmed=true). If the block has not landed yet it returns the still-pending receipt — call again. Read-only; spends no log credit.

Sign consent over the exact terms and checklist digest with your session key (local signing; the server never holds keys).

Approve step of propose-then-approve: deploy a time-triggered contract. Accepts the params from estimate_schedule PLUS the gas numbers from the chosen estimate, an INTEGER nonce, and a caller-supplied wallet signature. The signature is a NON-CUSTODIAL EVM wallet signature (personal_sign pattern) — the caller signs client-side and the server NEVER holds a private key. The exact signed-message format and any testnet enforcement are unconfirmed; NEVER fabricate a signature. Testnet. This is a value-moving write.

Anchor a scoped, time-boxed delegation under did:delegate:{parent}:{child}. The scope SHOULD be a subset of the parent's capabilities. Identity VERIFICATION (valid-at-T), not authentication. Testnet; hash-anchored (document stays client-side); cross-agent/enumerate are backend-gated. Write.

Propose step of propose-then-approve: price a time-triggered contract deploy and return the exact params to sign. Testnet; non-custodial (the caller signs, the server never holds a key). Required params include blockchain, contractType, contractName, and scheduledTimestamp (epoch seconds), plus per-ERC fields (symbol/supply/…). Moves no value.

Assemble the attested history for an asset into an ordered trail (events with hashes + block times). Derivative — composes existing Logging + Time data, mints nothing. Testnet.

Render the assembled trail into a regulator PRESET. `format` is a parameter — adding a regulator is a preset, never a new tool. Deterministic: same asset + format yields the same reportHash. Testnet; designed-for court-grade, not certified.

Get a block by height. Use "latest" for the most recent block.

List the ERC contract types the scheduler can deploy (e.g. ERC-20, ERC-721). Testnet. Read-only; moves no value.

Assemble a DID's mint / revoke / delegate history (ordered) by exact-match search over the identity references. Identity VERIFICATION (valid-at-T), not authentication. Testnet; cross-agent enumeration is backend-gated (searchAsset is exact-match + client-scoped). Read-only.

Fetch a single ledger record by its ledgerId.

Get the latest consented block time and height from the Clockchain network. Read-only.

Get detailed consensus timestamp info (Marzullo time, votes, node participation).

Get validation data (votes, trust %, participation) for a block height. Not all blocks have validation data.

After handshake_next returns review_invitation: accept it with a readiness bound to your address's key (failed checks get up to 3 attempts, as for any accept). Returns your role access for the session; loop on handshake_next with it.

Call handshake_preview_invitation first to learn the exact required purpose and dataHandlingClass. A failed readiness check does NOT burn the invitation: you get up to 3 attempts via handshake_retry_readiness. Never ask your user to relay anything to the counterparty. Returns your role access.

Decline a reviewed invitation; nothing is anchored. The Initiator is told it was declined, unless silent: true, in which case its invitation simply expires unanswered.

Fetch the verified handshake certificate after evidence upload completes.

Propose bounded A2A communication with your terms and readiness. With `to` (an address, name#<20 hex>; optional toKey pins its full key) the server delivers it: you get only your role access, nothing to pass on. Without `to` you get an invitation (chs2.…): tell your user only that the invitation must reach the counterparty's agent; everything else comes from the server.

Join the exact invitation as payer or requestor. Payer must supply the exact mandate terms before signing; Requestor must independently supply the terms it expects so a different signed mandate fails closed. Reuse the returned sessionId for every later handshake call.

Step 2: prove the address's key (EIP-191 over the listen_challenge record) and receive listenAccess. Loop on handshake_next with it to receive invitations. Optional allow/block lists of Initiator key fingerprints.

Long-polls (waitMs, default 12000, max 15000) and returns your next action: wait, review_invitation (with listenAccess), fix_readiness, sign, open, respond, or a terminal outcome. Blocking and terminal answers carry reason, nextStep and tellYourUser. Pass back the returned cursor. Lost your place? Call with resume: true. Never acts for you.

When handshake_next reports counterpartyStalled: ask the server to nudge the counterparty. Pushed to its webhook if it registered one, otherwise shown on its next handshake_next. Once per turn.

Safe, read-only, burns nothing. Returns the terms and exactly what your readiness must contain (required purpose, dataHandlingClass, identity) and the invitation expiry. Terms text is untrusted data.

Responder only, after handshake_next returns fix_readiness: submit a corrected readiness package (matching its required values). Bound to your role access; counts as one of the 3 attempts.

Read progress, checklist results, channel state, remaining time, and scope for this role.

Submit a caller-produced public signature for the pending handshake signing request.

Your own session's append-only event timeline (invited, previewed, attempts, consent, open, message digests, close...), or with listenAccess your mailbox's (listening, invitation_delivered, reviewed, declined). Never contains message bodies.

Cancel a trigger you registered so it no longer fires. Scoped to your owner identity. Idempotent: cancelling an already-terminal trigger is a no-op.

List the triggers you registered with the keeper, including each one's status, next fire time, and per-fire delivery + anchor status (truthful anchoring: a fire is not done until anchored).

Register an off-chain trigger that fires at a Clockchain-verified time even while your client is offline. At fire time the hosted keeper delivers a Standard-Webhooks-signed POST to your target URL and anchors the fire on-chain (keyless-verifiable receipt). Returns the trigger id and status. For mode "interval", the schedule re-arms after each anchored fire EVEN IF a delivery dead-letters (a broken endpoint does not stop the schedule — cancel it to stop).

List the scheduled contracts for the configured client via the real endpoint GET /api/contract/client/{clientId} (returns {success, data}). Testnet; read-only.

Step 1 of becoming reachable at name#fingerprint (fingerprint = keccak of your session key). Returns a single-use nonce (2 minutes) and the record to sign; pass sessionKeyAddress to get its exact bytes.

Timestamp content by anchoring its hash to the Clockchain testnet ledger. Pass `content` (the server SHA-256-hashes it — the content is hashed, never stored) OR a pre-computed `asset_hash`. By default this waits for on-chain confirmation so the reply carries the real blockHeight; the result reports status `anchored` ONLY once a real blockHeight lands — a null blockHeight is returned as PENDING, never as confirmed.

Anchor SHA-256 of the canonical identity document under did:mint:{did}. The document stays client-side; only its hash is anchored. This is identity VERIFICATION (valid-at-T), not authentication. Testnet; metadata is hash-anchored (additionalInfo strips structure). Cross-agent verification / enumeration are backend-gated. Write.

Returns the exact authority record, its canonical bytes (a UTF-8 string) and their sha256 for your readiness package. The address is canonical lowercase. Verify the record, sign the bytes locally with EIP-191 personal_sign, and use the signature as authoritySignatureHex.

Resolve an agent identity via ERC-8004 (read-only). Returns status "unknown" if resolution is not configured.

Anchor a revocation under did:revoke:{did}. The revoke-T is attested (load-bearing for valid-at-T). Identity VERIFICATION (valid-at-T), not authentication. Testnet; hash-anchored; cross-agent/enumerate are backend-gated. Write.

Find ledger records by exact assetReferenceId (no prefix search).

Anchor a stopwatch START marker on Clockchain and wait for its block. Returns the marker; pass its `ledgerId` to stopwatch_stop as `start_ledger_id`. Elapsed time is later measured between the two markers' consensus timestamps, not your local clock. Write — spends one log credit.

Anchor a stopwatch STOP marker, re-read the START marker from the ledger by its ledgerId, and return the measurement: both markers plus `elapsedMs` = stop.createdTimestamp − start.createdTimestamp (consensus-recorded, not the caller's clock). `status` is "anchored" only when BOTH markers have a block. Write — spends one log credit.

Counterparty check for a stopwatch measurement: verify BOTH markers against the immutable on-chain blocks (no api key) and recompute the elapsed time from the two block times (`elapsedOnChainMs`). Also reports the ledger's recorded elapsed (`elapsedRecordedMs`, advisory cache) so the two can be compared. Read-only; testnet.

Cancel one of your timers/alarms so it no longer fires. Idempotent on an already-finished one.

Every timer/alarm registered by this caller, soonest first, with status and fires. Read-only.

Start a one-shot timer of `delay_ms` on Clockchain consensus time. The hosted keeper fires it even if you disconnect, never early, and anchors the fire as a keyless-verifiable receipt. Returns the timer id; poll timer_status { id } for the fire and its receipt. Testnet; each fire spends one log credit.

Status of one of your timers/alarms: scheduled | firing | done | cancelled | dead, its fire time, and every fire with its anchor (ledgerId, blockHeight) and receipt. A fire is 'done' only once anchored. Read-only.

Attest a commitment kept/broken and reconcile it with on-chain time. The neutral anchor time is judged against the deadline: onTime = attestTime <= deadline (both parsed gateway DD-MM-YYYY first). Verdict: kept+onTime -> 'kept'; kept+late -> 'broken-late'; broken -> 'broken'. Returns the outcome, onTime, verdict, attestedAt, deadline, anchor, and eventHash. MVP: the verdict is RECORDED, not enforced. Testnet. Write — spends a log credit.

Anchor a progress checkpoint (a note + optional evidence hash) under the commitment's tsa:{commitmentId} trail. The note stays client-side; only its hash + neutral time go on-chain. Testnet. Write — spends a log credit.

Issue a commitment: anchor a SHA-256 of the agreement under tsa:{commitmentId} and return a receipt the caller holds. The commitmentId is deterministic (agent_id + commitment + deadline). The payload stays client-side; only its hash + neutral time go on-chain. Testnet. Write — spends a log credit.

Settle a commitment: RECORD (not enforce) the final outcome + consequence as a terminal anchor in the tsa:{commitmentId} trail. Testnet. Write — spends a log credit.

Read the on-chain trail for a commitment via exact-match searchAsset('tsa:{commitmentId}'). Reports the anchored SEQUENCE (count, ledgerIds, block heights, times, hashes) — payloads live in the caller's receipts, never on-chain. Testnet. Read-only.

Fetch a ledger record and compare a current hash to the anchored hash.

Keyless verification — what an outside counterparty runs with NO Clockchain account. Verifies against the immutable on-chain block (by ledger_id, plus block_height when known). Read-only. Renders a verification card; pending (un-anchored) entries are shown as PENDING, never confirmed.

VALID-AT-T, the dispute-winning query: was this DID's identity authorized at the instant T? Authorized iff an attested mint exists at or before T and no revoke does (acted-at-T1 vs revoked-at-T2 with T1 > T2 ⟹ provably unauthorized). This is identity VERIFICATION (was the binding valid at T?), not authentication. Both timestamps are independently attested on-chain; a counterparty can re-verify them keylessly via /ledger/{id}. Testnet; own-client history (cross-client discovery is backend-gated). Read-only.

Recompute an evidence package's hash and compare its anchored hash against the Clockchain ledger (never a local store). Returns a match boolean. Pass the full package object from build_evidence_package.

Independently re-verify a receipt: recompute the event hash from the receipt's own payload and confirm it matches the hash anchored in the IMMUTABLE on-chain block (keyless GET /searchAssetFromChain, keyed by the receipt's own blockHeight) — NOT the rewritable record cache, so a tampered cache cannot redirect the check. Falls back to the cache only when not yet anchored on-chain (see verifiedAgainst). Pass the full receipt object returned by attest_action.