One-click end-to-end demo

One click. Full flow. Signed end to end.

Open playground →Demo

Purpose Permission API

Demo data

You learn: What the purpose-permission endpoints take and return. You can: Pick a request and send it.

Clinical lead · Issue the grant

Request
POST /purpose-permissions

{
  "grantee": "<grantee>",
  "purpose": "<purpose>",
  "scope": "<scope>",
  "ttl_days": 90
}
Response 201
{
  "grantee": "kye:ent:halden.example:agent:clin-03",
  "id": "kye:purpose:halden:clin-03:clinical-summarise-2026q4",
  "issued_by": "kye:ent:halden.example:officer:clinical-lead",
  "not_after": "2027-01-01T00:00:00Z",
  "not_before": "2026-10-01T00:00:00Z",
  "principal": "kye:ent:halden.example",
  "purpose": {
    "id": "kye:purpose-class:clinical.summarise",
    "label": "Summarise care records for the treating clinician"
  },
  "restrictions": {
    "dual_control": false,
    "jurisdiction": [
      "GB"
    ],
    "rate_cap": {
      "requests_per_minute": 20
    },
    "requires_evidence": true
  },
  "scope": {
    "actions": [
      "read",
      "summarise"
    ],
    "data_classes": [
      "health.record"
    ],
    "resources": [
      "kye:res:halden.example:ehr:ward-7"
    ]
  },
  "version": 1
}
How this widget is built
Demonstrates
App API
Components
  • /api/v1/purpose-permissions
  • OpenAPI contract (app.yaml)
Flow
Requests come from the app API contract; the issue response is the demo grant. Architecture diagram
Used on
  • /examples/: On the examples page, with the rest of its scenario.
  • /sandbox/demos/demo/: The sandbox demo: the same calls, answered from the contract.
  • /lab/: The lab: call the API in your browser.

End-to-end demo, stage by stage

Demo data

You learn: How it works, one stage at a time. You can: Run it end to end.

  1. Do I need to sign up?

    KYE Protocol™

    No.

  2. Is this real?

    KYE Protocol™

    Yes. Real Workers. Real keys.

  3. Can I see the source?

    KYE Protocol™

    Yes. The runtime is open.

  4. Where does state go?

    KYE Protocol™

    Public sandbox DB. Resets daily.

  5. Will it log my IP?

    KYE Protocol™

    No. Logs are scrubbed.

  6. How many calls free?

    KYE Protocol™

    Up to 200 per hour.

  7. Curl-friendly?

    KYE Protocol™

    Yes. Every endpoint.

  8. Bring my own data?

    KYE Protocol™

    Yes. Drop a JSON. Try.

How this widget is built
Demonstrates
KYE™ runtime
Components
  • The stages this page describes
Flow
Each stage in order, as the page sets it out. Architecture diagram
Used on

Live demoRun this demo at sandbox.kyeprotocol.com/demo.html; the same governed flow also runs in the terminal and the lab.

Runs a sample Action Request through every production Worker in the KYE™ runtime chain — kye-gateway → kye-pdp → back to your browser — and shows the response from each hop. No sign-up. No install. Uses the same public URLs you would use from your own code.

Plain Q&A

Plain Q&A

Short questions. Short answers.

  • Do I need to sign up? No.
  • Is this real? Yes. Real Workers. Real keys.
  • Can I see the source? Yes. The runtime is open.
  • Where does state go? Public sandbox DB. Resets daily.
  • Will it log my IP? No. Logs are scrubbed.
  • How many calls free? Up to 200 per hour.
  • Curl-friendly? Yes. Every endpoint.
  • Bring my own data? Yes. Drop a JSON. Try.

1 · Gateway health

GET https://api.kyeprotocol.com/health

2 · PDP health

GET https://pdp.kyeprotocol.com/health

3 · Edge health

GET https://edge.kyeprotocol.com/health

4 · MCP health

GET https://mcp.kyeprotocol.com/health

5 · Public directory

GET /v1/directory/widgets

6 · Decision (auth needed)

POST /v1/decisions/evaluate

Idle. Click "Run" to fire all 6 probes.

Request payload

{
  "action": {
    "id": "kye:action:demo:purchase:001",
    "verb": "submit_payment",
    "subject": "kye:agent:demo-sandbox-agent",
    "object":  "kye:invoice:acme:2026-Q2-099",
    "amount":  { "currency": "USD", "value": 4800.00 },
    "context": { "channel": "sandbox-demo", "now_iso": "2026-05-14T22:00:00Z" }
  },
  "policy_set_id": "kye:policy-set:demo:public-purchase-v1"
}

Response

No probe run yet.

Probe ledger

stepstatusendpointlatency

The decision step requires a bearer token. The demo's call lands at kye-gateway's POST /v1/decisions/evaluate without one, so the expected response is 401 unauthorized — that's the deny-by-default guard surface working as designed. To run a real signed decision, mint an API key via the Customer Cloud → API keys panel and inject it as Authorization: Bearer ….

Canonical KYE™ surfaces referenced on this page: KYE™ Edge Governance™ · KYE™ MCP Server · KYE Protocol™.