API reference

Getting tolled needs one endpoint you host (the credits API) and the dashboard. naulon also has a small HTTP API you can call directly to price a resource, settle a payment from your own runtime, or pull earnings and audit data into your own tools. If you only want the toll running, read Getting tolled instead.

Every endpoint authenticates with an nln_live_ key sent as a bearer token, and every endpoint is scoped to the site the key is bound to. See Authentication to mint one.

Interactive reference

The interactive reference lists every endpoint with its parameters, request and response shapes, and a "try it" console:

• API explorer: the interactive reference.
• OpenAPI document: /docs/api/spec (or straight from the gate at https://gate.naulon.app/_naulon/openapi.json).

The document is generated from the running code. Point any OpenAPI tool (a client generator, Postman, your IDE) at the JSON URL.

What's in it

Group	Endpoint	Does
Enforce	GET /_naulon/quote	Price a resource. 204 means it's free.
Enforce	POST /_naulon/verify	Settle a buyer's payment from your own runtime.
Enforce	POST /_naulon/observe	Report what your runtime decided, so it reaches your Audit page.
Config	GET /_naulon/tenants/self	Your site's current toll config.
Earnings	GET /_naulon/earnings	Earnings rollup for a window.
Earnings	GET /_naulon/earnings/statements	Per-author payout statements.
Earnings	GET /_naulon/earnings/reconciliation	Recorded vs settled vs outstanding.
Earnings	GET /_naulon/earnings/export.csv · export.pdf	Downloadable exports.
Audit	GET /_naulon/audit	Agent traffic: outcomes, agents, articles, hours, and the newest requests.
Audit	GET /_naulon/audit/requests	One page of requests for the same filters, with how many matched.
Audit	GET /_naulon/audit/requests/{id}/trace	One request in full. For a paid read, the payment behind it: payer, each payee's share, chain, settlement reference, terms hash and the licence id you can check at /verify.
Members	GET /_naulon/members	Your author/payee roster.
Licences	POST /_naulon/licenses/quote · /licenses	Price and buy a licence over a scope and period. Both answer 403 sale_disabled today. A licence already bought still reads.
Webhooks	anomaly.detected · settlement.completed	What naulon POSTs to you, declared in the document rather than only here.

The document names its server, so the explorer's "try it" console sends real requests to the live API with the key you paste into it. It also declares both webhook events, including the envelope every signed delivery carries and the three Naulon-* headers that come with it. Generate a client from the document and you get the handler types too. See Webhooks for verifying a signature.

The in-app enforcement middleware calls quote, verify and observe for you. Call them yourself only if you are building your own integration. See In-app enforcement for the middleware that wraps them, and for what each of the three sends.

The explorer also lists the /_naulon/verify-host routes, which a runtime uses to prove it owns the domain it enforces on. The WordPress plugin calls them during setup with the key you paste into it; you do not call them by hand.

Read Errors for the response shapes on failure, and Rate limits for what governs request and payload size.