Confidentiality you can program.

// Recipient side: find transfers sent to this wallet, then claim them.
const pending = await client.scanClaimable();
const { claimedIds, failed } = await client.claim(pending);

import { previewPolicy, type PrivateAgent } from "@privatly/sdk";

// Same evaluation the server runs before every agent execution.
const decision = previewPolicy(policy, {
  amountUsd: 120,
  asset: "USDC",
  category: "payments",
  spentTodayUsd: 300,
});

// Target shape, backed today by /api/agents/** in the app.
const agent: PrivateAgent = await agents.get(agentId);
await agent.addObjective({
  kind: "recurring_payment",
  asset: "USDC",
  amount: 120,
  recipient: vendor,
  intervalDays: 7,
  maxRuns: 12,
});

// 1. Nonce (sets an httpOnly cookie scoped to /api/auth)
GET /api/auth/nonce
200 { "nonce": "9f2c4a..." }

// 2. The wallet signs a Sign in with Solana message containing that nonce,
//    the current host as domain, and an issuedAt within the last 10 minutes.

// 3. Verify
POST /api/auth/verify
{
  "address": "<base58 wallet>",
  "signedMessage": "<base64 message bytes>",
  "signature": "<base64 ed25519 signature>"
}
200 { "wallet": "<base58 wallet>" }   // sets privatly_session, 7 days

curl -X POST https://privatly.xyz/api/quote \
  -H "Content-Type: application/json" \
  -H "x-api-key: $API_KEY" \
  -d '{"action":"PRIVATE_TRANSFER","amountUsd":1000,"asset":"USDC"}'

{
  "action": "PRIVATE_TRANSFER", // PRIVATE_SWAP | PRIVATE_TRANSFER | AGENT_EXECUTION
                                // PRIVATE_REBALANCE | ENCRYPTED_MESSAGE | VIEW_KEY
  "amountUsd": 1000,            // 0 to 1,000,000,000
  "asset": "USDC"               // 1 to 64 characters
}

{
  "quote": {
    "action": "PRIVATE_TRANSFER",
    "protocolFee": {
      "$big": "800000"
    },
    "providerCost": {
      "$big": "0"
    },
    "relayerCost": {
      "$big": "0"
    },
    "networkCost": {
      "$big": "2000"
    },
    "integratorShare": {
      "$big": "0"
    },
    "privacyExecutionFee": {
      "$big": "800000"
    },
    "totalFee": {
      "$big": "802000"
    },
    "baseProtocolFee": {
      "$big": "800000"
    },
    "discounts": [],
    "ruleSnapshot": {
      "model": "bps_with_cap",
      "bps": 8,
      "minimumUsd": 0.05,
      "maximumUsd": 25
    },
    "quotedAt": 1791329918362,
    "expiresAt": 1791329948362,
    "source": "server"
  },
  "tier": "free"
}

GET /api/prices
200 {
  "prices": { "SOL": <usd>, "USDC": <usd>, "USDT": <usd>, "JitoSOL": <usd> }, // missing when unpriced
  "at": <epoch ms>
}

GET /api/swap/quote?inputMint=<mint>&outputMint=<mint>&amount=<base units>&slippageBps=50
200 {
  "quote": { /* Jupiter quote response, platformFee included when collectable */ },
  "fee": { "bps": 15, "mint": "<mint the fee is taken in>" }  // bps 0 when not collectable
}

POST /api/swap/build
{ "userPublicKey": "<session wallet>", "quoteResponse": { /* quote from above */ } }
200 { "transaction": "<base64 versioned transaction>", "lastValidBlockHeight": <number | null> }
409 { "error": "Quote is outdated. Refresh and try again." }

POST /api/executions
{
  "kind": "private_transfer",      // private_swap | private_transfer | shield | unshield | claim
                                   // view_key_created | view_key_revoked | agent_setup | subscription
  "title": "Sent USDC",
  "signatures": ["<signature>"],   // 1 to 8, each verified on-chain as signed by the session wallet
  "quoteId": "<uuid from /api/quote>", // optional: settles that quote into the revenue ledger once
  "publicFields": [{ "label": "Asset", "value": "USDC" }],
  "privatePayload": "<ciphertext>" // optional, encrypted on the client
}
200 { "id": "<activity id>" }
422 { "error": "Transaction not signed by this wallet (5Kd1x2ab…)" }

POST /api/subscriptions
{ "tier": "pro", "signature": "<USDC transfer to the treasury, signed by the session wallet>" }
200 { "tier": "pro", "expiresAt": "2026-11-04T12:00:00.000Z" }
409 { "error": "This payment was already applied" }

POST /api/integrators/keys
{ "label": "Production" }
201 {
  "key": "privatly_live_…",   // shown once; only a SHA-256 hash is stored
  "record": { "id": "<uuid>", "label": "Production", "prefix": "privatly_live_ab12cd",
              "createdAt": "…", "lastUsedAt": null, "revokedAt": null }
}