CAM PROTOCOL · MCP · REST API v1.0.0

Govern AI agents through
multi-party human authorization

AI agents and people can request sensitive data access or actions through MCP or REST. At least M of N named human approvers must approve, no approver may deny, and the configured veto window must pass before CAM sends one signed call to the customer's system. That system releases data or executes the action. CAM never executes actions or stores governed data; each decision is recorded in a tamper-evident, SHA-256 hash-chained audit log.

Request a sandbox key Read the API docs

Sandbox keys are free. Request one and LeAndrew will send it within one business day. Production keys are provisioned per integration.

Request production access

MCP for AI Agents

Route sensitive data access and action requests.

CAM exposes a Streamable HTTP MCP endpoint at https://api.safeloc.co/mcp. Send Authorization: Bearer cam_<prefix>_<secret> as a transport header. The REST API base is https://api.safeloc.co/v1.

Streamable HTTP

Connect with Streamable HTTP to https://api.safeloc.co/mcp. The current API version is v1.0.0.

Bearer API key

Send Authorization: Bearer cam_<prefix>_<secret>. Keys are sandbox or production. Keep the key in the runtime or secret store, not in prompts or tool arguments.

Governed release

Email is the default approver notification method. Approval links go only to approvers, never to the requester. An agent can submit and monitor a request, but cannot approve for a member. Any denial permanently vetoes the request.

Three agent-facing tools

submit_access_request

Creates an M-of-N request through POST /v1/requests. It never exposes member response tokens.

get_access_request_status

Reads the request state and per-member breakdown from GET /v1/requests/:id.

wait_for_access_request_outcome

Polls until vetoed, expired, data_released, or fetch_failed, or until its bounded timeout. Returns outcome state, not the released payload.

Approval and denial stay with human circle members out of band. The MCP server does not expose their response tokens. Approving and break-glass are not MCP tools.

Node.js clientStreamableHTTPClientTransport

import { Client } from "@modelcontextprotocol/sdk/client/index.js";
import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";

const client = new Client({ name: "advisor-agent", version: "1.0.0" });
const transport = new StreamableHTTPClientTransport(
  new URL("https://api.safeloc.co/mcp"),
  {
    requestInit: {
      headers: { Authorization: "Bearer " + process.env.CAM_API_KEY },
    },
  },
);

await client.connect(transport);

const result = await client.callTool({
  name: "submit_access_request",
  arguments: {
    requester_identity: "advisor-agent@westfield.example.com",
    requester_type: "ai_agent",
    data_owner_id: "ACCT-78234",
    data_category: "financial",
    reason_code: "TRADE_AUTHORIZATION",
    reason_detail: "Request authorization for the scheduled portfolio rebalance.",
    threshold_m: 2,
    threshold_n: 3,
    data_endpoint_url: "https://api.example.com/cam-release/ACCT-78234",
      // key_fragment_id values below are approver labels, not cryptographic key shares.
      circle: [
      { member_identifier: "advisor@westfield.example.com", member_role: "senior_advisor", key_fragment_id: "kf-1" },
      { member_identifier: "compliance@westfield.example.com", member_role: "compliance_officer", key_fragment_id: "kf-2" },
      { member_identifier: "risk@westfield.example.com", member_role: "risk_manager", key_fragment_id: "kf-3" },
    ],
  },
});

ResourcesAPI docs Sandbox simulator Webhooks

Direct REST API Integration

Use REST when your system calls CAM directly

MCP endpoint: https://api.safeloc.co/mcp. REST base: https://api.safeloc.co/v1. REST supports request creation, member responses, request status, and audit retrieval. In the examples, key_fragment_id is an approver label only, not a cryptographic key share.

Step 1

Request created

POST /v1/requests creates an M-of-N request with the data owner, category, reason, endpoint, circle, threshold, and expiry settings.

Step 2

Approvers receive email notifications

Email is the default approver notification method. Approval links go only to approvers, never to the requester. The REST 201 response includes a single-use response_token for each circle member; the MCP tool does not expose these tokens.

Step 3

Any denial permanently vetoes

A single denied response permanently vetoes the request, regardless of the approval count.

Step 4

Customer system handles the signed call

After at least M of N named human approvers approve, no denial, and passage of the configured veto window, CAM sends one signed call to the customer's system. That system releases data or executes the action. CAM does not execute actions or store governed data.

Step 5

Every transition is audited

Each decision is recorded in a tamper-evident, SHA-256 hash-chained audit log. GET /v1/audit/:id returns the log with chain_valid.

Create a governed request

Email is the default approver notification method. Approval links go only to approvers, never to the requester. POST /v1/requests returns 201 Created. The REST response includes one single-use response_token per circle member, while the MCP tool does not expose these tokens. Deliver each REST token to its human member out of band. At least M of N named human approvers must approve, no approver may deny, and the configured veto window must pass before CAM sends one signed call to the customer's HTTPS data_endpoint_url. The customer's system releases data or executes the action. CAM does not execute actions or store governed data.

POST /v1/requests

curl -X POST https://api.safeloc.co/v1/requests \
  -H "Authorization: Bearer $CAM_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "requester_identity": "advisor-agent@westfield.example.com",
    "requester_type": "ai_agent",
    "data_owner_id": "ACCT-78234",
    "data_category": "financial",
    "reason_code": "TRADE_AUTHORIZATION",
    "reason_detail": "Request authorization for the scheduled portfolio rebalance.",
    "threshold_m": 2,
    "threshold_n": 3,
    "data_endpoint_url": "https://api.example.com/cam-release/ACCT-78234",
    "circle": [
      {"member_identifier":"advisor@westfield.example.com","member_role":"senior_advisor","key_fragment_id":"kf-1"},
      {"member_identifier":"compliance@westfield.example.com","member_role":"compliance_officer","key_fragment_id":"kf-2"},
      {"member_identifier":"risk@westfield.example.com","member_role":"risk_manager","key_fragment_id":"kf-3"}
    ]
  }'

Response

201 Created

{
  "request_id": "<request-uuid>",
  "status": "pending",
  "threshold_m": 2,
  "threshold_n": 3,
  "expires_at": "<server-generated ISO 8601 timestamp>",
  "circle_members": [
    { "member_identifier": "advisor@westfield.example.com", "response_token": "<single-use response token>" },
    { "member_identifier": "compliance@westfield.example.com", "response_token": "<single-use response token>" },
    { "member_identifier": "risk@westfield.example.com", "response_token": "<single-use response token>" }
  ]
}

POST /v1/requests/:id/respond

curl -X POST "https://api.safeloc.co/v1/requests/$REQUEST_ID/respond" \
  -H "Authorization: Bearer $CAM_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"response_token":"<single-use response token>","response":"approved"}'

GET /v1/audit/:id

curl "https://api.safeloc.co/v1/audit/$REQUEST_ID" \
  -H "Authorization: Bearer $CAM_API_KEY"

Access Options

Sandbox and Production

Sandbox

Sandbox: free, approved within one business day, with a live simulator and test approvers. Usage limits apply.

Sandbox limits apply

Production

Production keys are provisioned per integration, with onboarding support.

Open interfaces

Works with your stack

CAM is a REST API. Anything that can make an HTTPS call can be governed: AI agent frameworks, internal tools, workflow automation platforms, and custom applications.

Learn how CAM handles governance metadata, contact data, and service providers.

Trust and data handling

Build With CAM