ai.greenlandai/greenlandai

Tools

• balance_proof

  Cryptographic inclusion proof for YOUR wallet balance in the latest hourly transparency attestation (GET /wallet/balance-proof): leaf hash, Merkle sibling path, root, the anchoring BSV txid, and `verification` (the steps to recompute the root and check it on chain). Bearer required; the wallet is the one your credential owns — there is NO wallet_id argument, the backend resolves it from your token. Anchoring is batched exactly like transparency_latest: `bsv_txid` may read "pending" until this attestation's OP_RETURN batch (five per transaction, roughly every five hours) is broadcast — not-yet-batched is not unanchored; for the most recent anchored root read transparency_latest.last_anchored.

  shallow
• billing_attempts

  YOUR OWN CHARGE RECORD — what this wallet was charged for, attempt by attempt, so you can verify your bill without asking us (relays GET /api/v1/billing/attempts; own wallet only — derived from your credential, never a parameter). Distinct from `joules_balance` (how much I have): this answers WHAT I WAS CHARGED FOR. Each item: `status` — pending = reserved, not yet settled · completed = settled; `settled_all_in_joules` left the wallet (base + the 0.5% rail fee) · settled_zero = delivered nothing, nothing moved · failed = released, nothing moved (a 4xx, a 5xx, a refused reservation) · settle_failed = delivered but unsettled — new queries refuse until it clears · expired = past the 15-minute replay window, superseded · refunded = reversed in full. `reserved_joules` vs `settled_joules` is the settle-for-delivered difference (partial hops, empty results). Match `attempt_id` to `metering.attempt_id` in the response body you got (or the `X-Metering-Attempt` header / `price.attempt_id`; `look_at`'s image result carries it as `metering_attempt`). `limit` 1-200 (default 50), `offset` for paging. Bearer or agent key required.

  shallow
• billing_quote

  The exact per-caller price of a metered call BEFORE you make it — free, no website, an MCP tool you can actually invoke (relays GET /api/v1/billing/quote). `path` = the API path the call would hit — e.g. "/api/v1/relationships" (the `relationships` tool), "/api/v1/look.from" (`look_from`), "/api/v1/map.viewport" (`map_viewport`), "/api/v1/companies/{id}" (`company`), "/api/v1/nearby" (`nearby`); `hops` = graph depth (1-20) for a relationships path. Priced at YOUR tier. Read `joules_all_in` — the TRUE debit (base `joules` + `rail_fee_joules`, the 0.5% rail surcharge); fund that, not the base. Graph paths price per hop and refund unused/empty hops (`refund_on_empty`/`quote_is_maximum`). Bearer required, but NO verification — an unverified caller may still price a call.

  shallow
• bridge_proof

  Cryptographic inclusion proofs for YOUR Bridge Ledger rows — contribution/fee events — in the balance-proof shape (GET /programme/bridge/proof): per-row leaf hash, sibling path, the `bridge_root`, and the anchoring BSV txid, plus `verification`. Bearer required; scoped to the holder your token resolves to — no argument. `anchoring` is either "anchored" (with a real 64-hex `bsv_txid`) or a pending note: Bridge rows are anchored by being batched into the hourly transparency attestation (five attestations per OP_RETURN transaction, roughly every five hours), so the newest rows read pending until their batch is broadcast and then carry the batch txid. Nothing is computed on request — it reads what the attestation stored.

  shallow
• company

  One company's record and graph neighbourhood by id. Metered — debited from the CALLING agent's own wallet, not the owner's (read it with the `joules_balance` tool). For the exact per-caller price before you call, use the `billing_quote` tool (free, tier-aware; returns `joules_all_in`) or check affordability with the `joules_deficit` tool; the true debit is the base `joule_cost` plus a 0.5% rail surcharge rounded up (a 100 J call debits 101 J) = `joules_all_in`.

  shallow
• contribute_receipts

  Your OWN append-only contribution receipts (forward your enabled gai_ key as X-API-Key) — the proof of what you submitted, with the canonical claim hash (claim_sha256) so you can verify what the door holds matches what you sent. Own rows only, no staff fields. Read-only. GET /api/v1/contribute/receipts.

  shallow
• contribute_relations

  Submit evidenced graph relationships to the GreenlandAI contributor door (TEN programme). Auth: your OWN GreenlandAI key in X-API-Key — an agent's gai_ registration key or the owner's gai_ key, the SAME key you use on the graph reads; the agent ID (gqa_) is NOT sent here, the door derives your contributor identity from the key. Contribute must first be enabled on that identity (a one-time human action on greenlandai.ai; the door returns a 403 naming the enable endpoint if it is not). Each item in `relations` MUST carry: subject, relation, object, source_url (a real http(s) page), quote (a verbatim passage >= 15 chars from that page stating the relationship — the judge refutes against it; a missing or placeholder source or quote is rejected at the door). Optional per item: subject_type, object_type. `entities` (optional) proposes a NEW endpoint ONLY alongside a relation that references it — a proposed entity is never accepted on its own. Nothing is written to the graph on submit: admitted claims are QUEUED for the nightly refutation judge (21:15 UTC). Per-item `results[].status`: queued_for_judgement / bundled_with_proposed_entity (queued) · duplicate / already_pending (accepted, not re-counted) · unmapped_relation (vocabulary review, not counted) · unresolved_subject|object (endpoint not found — `suggestions` returned; not counted) · self_loop / source_excluded / invalid (rejected, with reasons). The judge's verdict — promoted, HELD, or dismissed, with its reason — then appears per item via the contribute_submissions tool; the receipt via contribute_receipts; a HELD item is not a failure and is not counted until decided. Standing weights, streams and thresholds are live at GET /api/v1/programme/config — not restated here.

  shallow
• contribute_stats

  Your OWN contributor standing (forward your enabled gai_ key as X-API-Key; the door derives identity from the key). Returns totals (submitted/accepted/rejected), acceptance_rate, pending_review, refused_at_door, standing (good / warning / suspended / revoked) and the thresholds that apply after a floor of submissions. Read-only. GET /api/v1/contribute/status.

  shallow
• contribute_submissions

  Your OWN per-item submission outcomes (forward your enabled gai_ key as X-API-Key). Each item: id, kind, name, outcome (pending_review / accepted / rejected), the judge's reason verbatim in review_note (a pending item reads 'awaiting the judge (nightly, 21:15 UTC)'; a HELD item carries the judge's reason), duplicate flag, promoted {table, id}?, bundle_id?, submitted_at. Read-only. GET /api/v1/contribute/submissions.

  shallow
• deposit

  One resource deposit's record by numeric id (relays GET /api/v1/deposits/{id}), including its `commodities[]` ({name, role: primary|byproduct, group} — the commodity graph, with `resource_type` as the primary label) and operators. Pair with `deposits(commodity=...)`: search by commodity, then read the deposit. Metered — debited from the CALLING agent's own wallet; the response carries `charged_joules` (the all-in PRICE of this call) and the `metering` block (`metering.settlement` = whether you PAID, `settled_joules` = what left the wallet). Quote with `billing_quote("/api/v1/deposits/{id}")`.

  shallow
• deposit_status

  YOUR OWN USDC-on-Base deposit state (relays GET /api/v1/wallet/deposit-status; own wallet only, derived from your credential, never a parameter). States: credited (joules in your wallet) · held_below_min (under 5 USDC — held and accumulated, credits as one entry once your total reaches 5 USDC; nothing lost) · held_above_max (over the max — held for a human to release; nothing lost) · swept · held_no_fund (the deposit reached the minimum but the platform's funding wallet could not cover the joules at that moment — held, nothing moved, nothing lost; credited AUTOMATICALLY once platform funding is restored — the scanner retries it every minute — no action needed from you). Sent USDC and see nothing yet? Compare your deposit's Base block to scanner_cursor_block: above it = normal lag (the scanner hasn't reached it); at/below it with no row = flagged, not lost. held_below_min / held_above_max / swept / held_no_fund have not yet occurred on real funds. Bearer or agent key required.

  shallow
• deposits

  Search resource deposits (relays GET /api/v1/deposits). Filters: `commodity`, `resource_type`, `country`, `status`, `owner_country`, `max_port_km`, `search` (name substring), `limit` (<=100), `offset`. ⚠ READ THIS BEFORE USING `commodity`: it filters by the commodity GRAPH, not by the deposit's `resource_type` string. A deposit matches if it CONTAINS the commodity directly, OR CONTAINS a commodity GROUP the commodity is MEMBER_OF. So `commodity="neodymium"` returns EVERY rare-earth-element deposit — including ones whose name and `resource_type` never say "neodymium" (they host the rare_earth_elements group, of which neodymium is a member). That is correct, not a broken filter. The response's top-level `commodity_filter` {query, matched_directly, matched_via_group} tells you which happened — `matched_via_group` names the group (e.g. "rare_earth_elements") when the match came through it. Each deposit carries `commodities[]` ({name, role: primary|byproduct, group}); `resource_type` stays the primary label. Response shape: {count, total, deposits[], commodity_filter, charged_joules, metering}. Metered — `charged_joules` is the all-in PRICE of this call, debited from the CALLING agent's own wallet; `metering.settlement` / `metering.settled_joules` say whether it was actually PAID (settled · settled_zero · settle_failed = delivered but unpaid · released · unknown). Quote first with `billing_quote("/api/v1/deposits")`. Same as the SDK `deposits(commodity=...)`.

  shallow
• entity_change

  change(site, t0, t1) — the STRUCTURED CHANGE between two dated frames of one site (entity_type + id, or lat + lng): per class (water · ice · canopy · pad · stockpile · unknown) the area in m², by_sensor_m2 {optical, radar}, `said` (what each instrument saw: an area, "saw no change", "makes no call", or "untestable (reason)"), sensors_agreed, and a `confidence` from agreement with `confidence_why`: high = optical and radar both flag it in the same place; medium = one flags it and the other is blind to the class or untestable; low = they disagree (different places, or one flags it and the other could see it and saw none), or stockpile, or pad/stockpile without a terrain check. Optical is Sentinel-2; Landsat only for a date with no Sentinel-2 (before 2015-06-23 or a gap); radar is Sentinel-1 (from 2014-10). A Copernicus DEM terrain prior removes pad and stockpile on ground steeper than 12° (reported as steep_ground_excluded_m2). A stockpile carries a `volume` block: the height of material above the Copernicus DEM (2011–2015) inside it, MEASURED at each date from a dated height source (USGS 3DEP lidar in the US, Canada's HRDEM lidar by acquisition project in Canada, else NASA ICESat-2 profiles via SlideRule), bias-corrected on stable ground, volume = mean height × area ± its uncertainty; when BOTH dates are lidar surfaces the change is their DIRECT DIFFERENCE, so the 2011–2015 reference and its error cancel (`change_method` says which; `change_beyond_uncertainty` = |change| > 2σ), and a confidence — or untestable with what was tried (then brightness and shape only, low). Not a video and not a picture — fetch stills with look_at / look_through. For spans of 300+ days the t0 frame is taken at t1's day of year (same_season=true, default). A sensor that cannot see the pair says UNTESTABLE with its reason; the answer is UNTESTABLE only when BOTH are. Footprint: the site's held footprint, else a 500 m circle (stated in `footprint`); radius_m 50..2500 overrides. An entity whose coordinates are only a country centre is refused (409, not charged) — pass lat + lng. Dates YYYY-MM-DD, t0 on/after 1984-03-16, t1 default today. Slow: about 15–60 s. AGENT KEYS ONLY (a browser session is refused BEFORE any charge). SIDE EFFECTS: none beyond the charge — read-only. ⚠ CHARGING: ONE quote, ONE debit = two stills at look_at's live price, reserved up front; an UNTESTABLE answer costs nothing. Quote with `billing_quote("/api/v1/entity.change")`; the JSON carries `charged_joules` and a `price` block.

  shallow
• entity_history

  history(entity) — the CHEAP INDEX of one entity's dates (the place across time). `entity_type` deposit|infrastructure|company| project + `id`. Returns: `frames` — the imagery index over its coordinates (scene dates, cloud cover, scene ids, counts by year; NO images — fetch stills with `look_at` or a stack with `look_through`, the paid calls); `snapshots` — our record of the row since record time began (2026-10-03 19:29Z: versions with the fields that changed; before that "not recorded online"); `what_changed` — a short newest-first list (relationship began / ended with its basis, first stated by a source, capacity periods, events naming the company, our actions on the row, dataset releases matched), every item `time_is` "world" (a date a source states) or "ours" (when we acted). Nothing inferred. AUTH: an agent key; browser sessions follow the graph-read rule. SIDE EFFECTS: none beyond the charge — read-only. ⚠ CHARGING: one price at the basic class (look_from's price); an entity that does not exist is a 404 and costs nothing; quote with `billing_quote("/api/v1/entity.history")`. NOT the account's own query history (that is a different route).

  shallow
• entity_state

  state(entity, as_of) — ONE packet for one entity at a date (YYYY-MM-DD, default today): `target` (the entity as WE held it at as_of — before record time began, as held now, labelled), `pins` (look_from's frame, only pins we held by as_of; later additions counted), `graph` (its 1-hop relationships VALID at as_of — began on/before as_of, or stated by a source on/before as_of with the start unknown, and not ended by as_of — each with why; excluded edges counted by reason; never today's edges painted onto a past date), `image` (look_at's still for as_of — `as_of` is the SCENE's date, within 10 days — or `untestable: true` with the nearest scene's date), and `escrow_oracle` (`available: false`: no trade or oracle claim carries a site reference — said, not faked). AGENT KEYS ONLY (a browser session is refused BEFORE any charge). SIDE EFFECTS: none beyond the charge — read-only. ⚠ CHARGING: ONE quote, ONE debit = the live prices of the three parts (pins at the basic class + one graph hop + look_at's price), reserved up front and settled for the parts DELIVERED — a part with nothing in it (no pins, no edge valid at as_of, an UNTESTABLE image) is not charged; nothing delivered costs nothing. Quote with `billing_quote("/api/v1/entity.state")`; the JSON carries `charged_joules` and a `price` block (parts_base_joules, parts_delivered).

  shallow
• funding_prepare

  The in-band funding step for a joule shortfall — NEVER a website to visit (operator lock). States the code-true funding routes and whether each is live, so an agent knows what it can do right now rather than being bounced to a browser. Card funding is a human web flow (not an agent path); USDC on Base is the intended agent-fundable rail and is NOT live yet (deposit-address endpoint returns 503). Returns the shortfall context and the honest availability — it does not itself move money.

  shallow
• hops

  DEPRECATED alias for `relationships` — kept working, to be removed at a future major. Use `relationships`. Reason (operator ruling 2026-09-14): `hops` names the tool after the BILLING UNIT (traversal depth is what we meter, and `billing_quote` takes hops= for that reason), but the capability is the relationship EDGES with tiers + provenance — a tool list should name the capability, not the meter. Identical behavior and params to `relationships`; also the SDK helper name.

  shallow
• joules_balance

  Your own wallet balance — a FREE read either way (checking costs nothing). A GreenlandAI AGENT key (`gai_`/`gqa_`) reads its OWN wallet via GAI /api/v1/agent/me/balance — NO wallet_id needed; returns {agent_id, agent_name, wallet_id, balance_joules, balance}. A JoulePAI (`jlp_`) or ENYAL (`eyl_`) credential reads by `wallet_id` via JoulePAI /wallet/balance and returns {balance, wallet_id, …}. (The graph/map meter debits this same wallet — this is how an agent checks it before calling.)

  shallow
• joules_deficit

  Given a planned `cost`, read a balance and return {needed, have, shortfall, tool_to_call_next} so an agent can decide in-band whether it can afford the next call — no website, no guessing, FREE. A GreenlandAI AGENT key (`gai_`/`gqa_`) reads its OWN balance via GAI /api/v1/agent/me/balance (no wallet_id). A JoulePAI/ENYAL credential reads via JoulePAI — `wallet_id` OPTIONAL (omit → resolved via /wallet/me), pass it for a specific wallet.

  shallow
• ledger_verify

  Recent public ledger anchors with their on-chain transaction ids and the exact credit supply at each anchor — public, no auth. Independently checkable.

  shallow
• look_at

  Satellite still of a place — a Sentinel-2 ARCHIVE image (the screen as a picture). Pose = lat/lng OR entity_type+id (anchor); same pose family as `look_from`. Optional `as_of` (YYYY-MM-DD — the newest scene on/before that date) and `max_cloud` (0-100, default 20). AGENT KEYS ONLY (a session/dev key is refused BEFORE any charge). Metered, a read: 150 J (all-in 151), refunded in full if no image is delivered. RETURNS THE IMAGE (jpeg) as MCP image content PLUS `structuredContent` provenance from the scene's headers — read these and claim nothing stronger: `observed_at` is the SCENE's date, NEVER the request's; `source_tier` is the PROVIDER's, never the pin's; `freshness` is "archive", never "live"; plus cloud_cover, gsd, extent_km, attribution, cache, entity_cap_consumed (0), price. A cloudy or MISSING scene returns `available:false` + `freshness:"unavailable"` and is REFUNDED IN FULL — an unavailable RESULT, not an error, and NEVER a fabricated image.

  shallow
• look_from

  Map lane: pins near a point (lat/lng + radius_km). `entity_type` (deposit | infrastructure | company | project) behaves two ways (backend, 2026-09-14): `entity_type` ALONE (with lat/lng) FILTERS the frame to that type only; `entity_type` + `id` ANCHORS the pose at that entity and keeps ALL types; an unknown `entity_type` is a 400 BEFORE any charge (wallet unmoved). Metered — debited from the CALLING agent's own wallet, not the owner's; the response's `charged_joules` is the ALL-IN debit (base + 0.5% rail). Read the wallet with the `joules_balance` tool. For the exact per-caller price before you call, use the `billing_quote` tool (free, tier-aware; returns `joules_all_in`) or check affordability with the `joules_deficit` tool; the true debit is the base `joule_cost` plus a 0.5% rail surcharge rounded up (a 100 J call debits 101 J) = `joules_all_in`. Results carry `source_tier`/`tier_label` per pin — provenance you should keep. They reflect the pin at read time; a pin's tier or an edge in its `operators` can change afterwards and a held result will not reflect that. `energy=true` includes energy fleet infra; `include_country_centroids=true` adds country-centroid placeholder pins (both off by default).

  shallow
• look_through

  The image stack — an ORDERED STACK of dated Sentinel-2 ARCHIVE stills of ONE site across a date range (the place across time). Pose = lat/lng OR entity_type+id (anchor), the same pose rule as `look_at`. `t0` (YYYY-MM-DD, on or after 2015-06-23) and optional `t1` (default today) bound the range; `max_frames` (1-12, default 6) cuts it into that many equal windows, ONE still per window — the newest scene ACQUIRED inside that window with cloud cover at or under `max_cloud` (0-100, default 20). Each frame says its own `as_of` (the SCENE's date — never the window, never your request), `cloud_cover`, `scene_id`, `provenance` (provider, source_tier "provider", freshness "archive", attribution, gsd_m 10, extent_km 5.12), its own `charged_joules`, and the still as `image_jpeg_base64`. A window with no cloud-free scene is an explicit `available:false` frame with `as_of:null` and `charged_joules:0` — NEVER a fabricated image, never a scene borrowed from another window. Satellite-still resolution (10 m), not street-level. It does NOT say what changed between frames. AGENT KEYS ONLY (a browser session is refused BEFORE any charge). SIDE EFFECTS: none beyond the charge — read-only; stills are cached by pose + scene date (look_at's cache). ⚠ CHARGING: priced PER STILL at look_at's price; the meter RESERVES for `max_frames` before the stack is fetched and SETTLES for the frames DELIVERED (no frame at all settles to 0; a 4xx releases the reservation). Quote first: `billing_quote("/api/v1/look.through")` with max_frames. The JSON carries top-level `charged_joules` (what you kept paying, all-in) and a `price` block (per_frame_base_joules, max_frames, frames_delivered); verify any charge with `billing_attempts`. Every call through this relay carries a fresh idempotency key, so a retry here is always a new charge.

  shallow
• map_viewport

  Map lane: everything inside a bounding box — THE SCREEN (relays GET /api/v1/map.viewport). Typed params: min_lat/min_lng/max_lat/max_lng (the bbox — all four together), entity_type (deposit | infrastructure | company | project — default all four), energy (default False; omits energy fleet infra/projects), include_country_centroids (default False). Returns capped, id-ordered `pins` plus `counts_by_type` — the counts are the TRUE totals for the whole bbox, the pins are a sample, so read counts for totals and pins for detail. AGENT KEYS ONLY (a non-agent credential is refused BEFORE any charge); a per-owner viewport rate window applies; pins do NOT count against your entity cap. Metered — debited from the CALLING agent's own wallet (read it with the `joules_balance` tool); ONE `basic` price per call; quote it with the `billing_quote` tool and the true debit is base + 0.5% rail surcharge = `joules_all_in`. Carries `source_tier`/`tier_label` per pin; energy off, pipelines never, centroids off unless asked (same honesty as `look_from`).

  shallow
• mapdata

  CLOSED — do NOT call. `/api/v1/mapdata` (the bulk map-layers surface) is TEMPORARILY closed to ALL callers, agent AND human: the backend returns 403 BEFORE the meter, so NOTHING is charged (GR-109 operator ruling 2026-09-08, gated on AGENT_MAPDATA_ENABLED / HUMAN_MAPDATA_ENABLED — both default off while the map moves to a viewport surface). USE INSTEAD: `map_viewport` for a bounding box (capped pins + counts_by_type) or `look_from` for a pose (pins near a point or anchored on an entity). Kept in the tool list (not removed) so an enumerated list stays stable; reopens metered if the flags flip. (When open it was: metered map dataset, layers + include_country_centroids.)

  shallow
• market_accept

  Accept a delivery on a match (POST /match/{id}/accept) — releases escrow to the provider. You must be the buyer party; backend enforces it.

  shallow
• market_listings

  Browse the RAREEAI marketplace: kind="providers" (listings) or "oracles". Typed query params for the providers browse (GET /providers): frontier, resource_type, oracle_verified, active (default True), limit (<=200, default 50), offset, sort (default "price_asc"). Needs a bearer; no write scope to read.

  shallow
• market_match

  Read one marketplace match by id, including its `escrow_terms` and this trade's typed fee/timeout fields. You must be a party to the match. Bearer required.

  shallow
• market_provide

  Create/update a marketplace listing (POST /provide). Requires marketplace:write (verified account) — an unverified/under-scoped token gets the backend's real 403. First-time provider registration charges a 1,000-joule fee that is SPENT (not a refundable stake — contrast an oracle stake, which is returned on deregister). Body (TYPED — extra fields refused here): {wallet_id, frontier, resource_type, unit_type, price_joules_per_unit (int >=0), capacity_total?, min_units?, max_units_per_match?, endpoint_url?, sla? (dict), speed?, timeout_hours? / timeout_minutes?, stake_amount?, oracle_verified? (opt in to oracle checks), idempotency_key?}.

  shallow
• market_quote

  Quote a marketplace request by id — returns the escrow terms and this trade's own figures (fee_joules, deposit_fee_joules, buyer_debit_joules, escrow_expires_at, dispute_window_end) as typed fields. Parse those, not prose. Bearer required.

  shallow
• market_request

  Post a marketplace BUY request (POST /request) — you want to buy a resource; providers match against it and your escrow is debited on match. Bearer + a verified account (marketplace:write); an under-scoped token gets the backend's real 403. Body (TYPED — extra fields refused here): {wallet_id (a UUID you own, pays escrow), frontier, resource_type, unit_type, units_needed (int >0), max_price_per_unit (int >0, joules), priority?, requirements? (dict), ttl_seconds? (expiry), speed?, privacy_mode?}. Quote a specific request with `market_quote` before accepting a match.

  shallow
• nearby

  Entities near a location (the primitive `look_from` builds on). Typed query params (GET /nearby): lat + lng (required), radius_km (default 100), entity_type (optional filter), limit (<=100, default 20), include_country_centroids (default False). Metered — debited from the CALLING agent's own wallet, not the owner's (read it with the `joules_balance` tool). For the exact per-caller price before you call, use the `billing_quote` tool (free, tier-aware; returns `joules_all_in`) or check affordability with the `joules_deficit` tool; the true debit is the base `joule_cost` plus a 0.5% rail surcharge rounded up (a 100 J call debits 101 J) = `joules_all_in`. Carries `source_tier`/`tier_label`.

  shallow
• oracle_assess

  Post your verdict on a delivery you were assigned (POST /oracle/assess/{match_id}). Body: {verdict ('valid' or 'invalid'), quality_score (an integer 0-100), notes (<= 2000 chars), and optionally execution_trace (a dict describing how you verified)}. A quality_score below 40 auto-opens a dispute. You earn an equal share of the oracle fee — 1% of the trade value, clamped to 50-5,000 joules total, split evenly across the match's assigned oracles — deducted from the trade at settlement (it comes out of the trade amount before the provider is paid, not a separate platform charge). Assess within the 48-hour deadline. Requires being the assigned oracle + marketplace:write.

  shallow
• oracle_assignments

  List YOUR oracle assignments — the deliveries you have been assigned to assess (GET /oracle/assignments). The backend scopes this to your own wallet; you never see another oracle's queue. Optional query: status (filter) and limit (1-200, default 50). Each assignment carries match_id, deadline (assess within 48 hours or the assignment lapses), fee_earned, and the current verdict/quality if already assessed. Authenticated read — no marketplace:write needed.

  shallow
• oracle_deregister

  Deregister as an oracle and unstake (POST /oracle/deregister?wallet_id=...). Returns your staked joules from escrow (less any amount already slashed for overturned calls). Fails if you have pending assessments. wallet_id (the UUID of your oracle wallet) is REQUIRED and is sent as a QUERY parameter (the backend reads it via Query(...), unlike register/assess which take a body). Requires marketplace:write.

  shallow
• oracle_register

  Register as a RAREEAI oracle by staking joules (POST /oracle/register). INVITE-ONLY at launch (Phase 1 — the oracle pool is operator-run): a non-whitelisted wallet gets a STRUCTURED invite-only response saying how to apply (a verified account, a linked wallet holding the stake, then email info@raree.ai) — the path is discoverable, the gate explicit, no website bounce. Body: {wallet_id (a UUID you own), specialisations (a list of 1 to 7 values from EXACTLY: code, translation, data, general, content, research, infrastructure — any other value is a 422), stake_amount (an integer >= 10000 joules)}. The stake is REFUNDABLE — it is parked in escrow and returned in full when you deregister (unlike a provider listing fee, which is spent). A call overturned on dispute is slashed 10% of the stake. Requires a verified account + marketplace:write.

  shallow
• place_index

  place.index — WHAT EXISTS AT A PLACE, AND WHEN. Rows within `radius_km` (default 2, max 50) of lat + lng, or of an entity's site (entity_type deposit|infrastructure|company|project + id; a country-centre anchor is refused 409, not charged), newest first: `still` = a satellite still a route delivered (look_at, look_through, entity_state) or a frame entity_change used — scene id, acquisition date, platform, cloud cover, the ground it covers (footprint_m2); never who asked. `quote` = a dated source attestation of a relationship, at each end of the relation that has a site (relation id, relation, source url, an excerpt). `verdict` / `match` = oracle verdicts and marketplace match ids — none are held yet (they arrive with the escrow build) and none are invented; the answer says so in `not_held_yet`. Each row carries both times: `valid_on` (a date in the world, with its precision) and `recorded_at` (when GreenlandAI came to hold it). `from_date` / `to_date` (YYYY-MM-DD) filter valid_on; `kinds` and `entity_types` are comma lists; `counts` per kind cover the whole match, `rows` one page (limit 1..500, offset). Fetch a still with look_at; read a relationship with relationships. AUTH: an agent key; browser sessions follow the graph-read rule. SIDE EFFECTS: none beyond the charge — read-only. ⚠ CHARGING: one price at the basic class (look_from's price); an answer with no rows costs nothing; quote with `billing_quote("/api/v1/place.index")`; the JSON carries `charged_joules`.

  shallow
• relationships

  Graph lane: labelled relationship EDGES between companies/entities (ownership, operates, supplies, …) — the PRODUCT (edges with tiers + provenance), named for the capability, not the meter. Typed query params (GET /relationships): entity (the START NODE — matched as a case-insensitive SUBSTRING of an entity/company NAME, never an id: "3" matches any name containing "3" and resolves to an arbitrary one, so pass a full, distinctive name), hops (traversal DEPTH 1-10, default 1 — the BILLING UNIT: metered per hop, which is why `billing_quote` takes hops=), relation_type (one relation label — checked against the API's allow-list; unknown -> backend 400), search (free-text), limit (<=100, default 50), offset. Metered — debited from the CALLING agent's own wallet, not the owner's (read it with the `joules_balance` tool). For the exact per-caller price before you call, use the `billing_quote` tool (free, tier-aware; returns `joules_all_in`) or check affordability with the `joules_deficit` tool; the true debit is the base `joule_cost` plus a 0.5% rail surcharge rounded up (a 100 J call debits 101 J) = `joules_all_in`. Preserves `source_tier`/`tier_label` on each edge — do not strip them. These reflect the edge at read time; an edge can be demoted afterwards and a held result will not reflect that.

  shallow
• site_reconstruction

  A dated, georeferenced, textured 3D MODEL of a site (entity_type + id, or lat + lng) and its MEASUREMENTS as structured data. `measurements` (computed on the elevation source's own grid, every block with `source` and `accuracy`): site_extent (side, area, bbox, CRS); elevation (min, max, mean, relief, vertical datum); slope_deg (p10/p50/p90/max/mean + share per class 0–5/5–15/15–30/ 30–45/45–90°); pits (closed depressions filled to their spill level: area_m2, depth_max_m, depth_mean_m, volume_m3 ± volume_uncertainty_m3, spill and floor elevation, centre); heaps (closed mounds: area_m2, height_max_m, volume_m3 ± uncertainty above the highest separating saddle, base and top elevation, centre). Only features that CLOSE inside the extent are measured — 0 pits over a big open pit means the pit is larger than the square: widen radius_m. On a surface model a heap can be a stockpile, dump, building or rock: shape, not material. Tier follows the data: lidar_2m (USGS 3DEP lidar DSM 2 m, NAVD88, ~0.10 m) where it covers the extent, else dem_30m (Copernicus GLO-30, one epoch 2011–2015, EGM2008, < 4 m 90 %); texture NAIP (US) else Sentinel-2; the card states tier, sources, dates, datum, accuracy, dates_differ and what it is NOT (not a survey, not bare earth, not for volume certification). The MODEL is binary glTF 2.0 (+X east, +Y up, −Z north, metres; node extras carry the CRS, origin and base elevation); the card carries its sha256 and byte size. include_model=true adds `model_glb_base64` (a lidar model is about 4 MB, ~5 MB as base64); the raw file is GET /api/v1/site.reconstruction?…&format=glb on the API. radius_m 100..1000 (default 300; the square's side is 2 × radius); as_of YYYY-MM-DD picks the lidar collection and texture nearest that date. An entity whose coordinates are only a country centre is refused (409, not charged). Slow: about 15–60 s. AGENT KEYS ONLY (a browser session is refused BEFORE any charge). SIDE EFFECTS: none beyond the charge — read-only. ⚠ CHARGING: priced per tier, and the tier is decided BEFORE any charge (lidar_2m where 3DEP lidar covers the site, else dem_30m): the call reserves THAT tier's price — a 30 m site never needs the lidar price in the wallet. No model (no elevation source or no clear image) costs nothing. Price: lidar_2m 2,500 J, dem_30m 1,000 J, + the 0.5% rail fee (greenlandai-api look/reconstruct_build.RECONSTRUCTION_PRICE_JOULES). Quote the exact tier with `billing_quote("/api/v1/site.reconstruction", lat=…, lng=…, radius_m=…)` (or entity_type + id); the JSON carries `charged_joules` and a `price` block with tier_reserved and tier_delivered.

  shallow
• trade_settlement

  YOUR OWN trade's settlement — every leg of a marketplace trade you were the BUYER or SELLER of (relays GET /api/v1/wallet/trade/{match_id}/settlement). Party-gated on the backend: a 404 means you were not a party to this match (it also hides whether the match exists at all — never a wallet id leaks). Returns `your_role` (buyer|seller), `settled` (true once the provider has been paid), `leg_count`, and `legs[]` — each leg is {type (provider_payout · oracle_fee · platform_fee · contract_fee · fund_fee · buyer_refund · dispute_refund · dispute_payout · …), recipient_role (a ROLE — provider · oracle · treasury · fee-collection · buyer — NEVER a wallet id; the sentinel "unknown" marks a leg type the backend does not map yet — logged loudly on their side, never money to the platform), amount, status, txid, anchor}, plus top-level `all_anchored` (true only when every leg's anchor is `anchored`). `status` is the LEDGER state of the leg (the money has moved once it reads completed); `txid` is written at BROADCAST, not at confirmation — so a leg can be settled with txid NULL (not broadcast yet — typically under a minute — OR its anchor dead-lettered) or carry a txid not yet on chain. A null txid on a fresh read is NOT a missing or failed leg: read `anchor`, the state to act on — queued | confirming | confirmed → poll (~30 s); anchored → verify the leg's txid on chain yourself (e.g. the `verify_proof` tool with the txid) — you don't have to trust us; failed | cancelled → the ledger leg settled but its anchor dead-lettered and will NOT reach the chain by itself (escalate); none → no anchor was attempted; unknown → a queue state the view does not recognise. This is the trade-WIDE view: `deposit_status` and a single transfer's status show only your own leg, not the payout or fees. Own trades only. Bearer or agent key required.

  shallow
• transparency_latest

  The latest hourly PUBLIC transparency attestation (GET /transparency/latest — no auth): a Merkle root over every wallet balance, the verified total supply, a transaction attestation, the state root, and the Bridge Ledger root, plus the BSV transaction that anchors the batch. ANCHORING IS BATCHED, NEVER IMMEDIATE: five attestations are anchored per OP_RETURN transaction, roughly every five hours. So the newest attestation's top-level `bsv_txid` legitimately reads the string "pending" for up to about five hours after its `timestamp` — that is the normal in-flight state, NOT "unanchored" and NOT an error. `last_anchored` names the most recent attestation whose batch IS on chain and carries a real 64-hex `bsv_txid` (with its merkle_root/bridge_root) you can open on a block explorer; `anchoring` restates the cadence. Everything here is independently checkable — you need not take it on trust.

  shallow
• verify_proof

  Look up one identifier (chunk_id, proof_id, match_id, transfer id, or a BSV txid) in ENYAL's public verify lookup — no auth. The backend's body is returned UNCHANGED; read these fields, in this order, and claim nothing stronger than they say: - `found:true` = at least one of our systems holds a record for the id. For a chunk, proof or transfer UUID (a DATABASE record; a MATCH is different — see the marketplace-match bullet below): `anchor_status` ∈ {anchored | pending | unanchored} with `bsv_tx_id` — "anchored" means recorded as anchored; the chain is NOT checked on this path; `merkle_proof`/`merkle_root` are present only where the archive stores them. To check the chain, look up the returned `bsv_tx_id`. - For a bare txid (not a match): `chain_status` (confirmed | mempool | not_on_chain | unchecked) and `chain_confirmed` — this 4-value set is the WhatsOnChain status of one transaction and is distinct from a match's `release_anchor_status` enum below; do not conflate the two. Only `chain_confirmed:true` is a verified anchor. `mempool` can still be evicted. `found:false, recorded:true, chain_status:"not_on_chain"` = we recorded it but the network does not have it — a PHANTOM, not an anchor. Coverage (ENYAL as it runs, 2026-09-03): ENYAL's archive, RAREEAI escrow legs (fund/deliver/oracle/release/dispute/resolve/refund) + reputation, JoulePAI transfers + settlement queue; RAREEAI provider-REGISTRATION anchors are outside it. - `degraded:true` (+ `unavailable_sources`) = a source could not be checked; the result is INCONCLUSIVE, not an absence. Only `found:false, degraded:false` is a clean not-found. - For a RAREEAI marketplace match the body carries TWO INDEPENDENT on-chain claims — read both, collapse neither: `ledger_payout_anchor` (the joule movement that settled the trade — provider payout or buyer refund — with its own `txid`/`block_height`/`status`; this is the anchor a customer checks today, and it nests a batched `settlement_proof` leaf) and `escrow_contract_release_anchor` (the sCrypt escrow contract's terminal leg — its confirmed transaction id is `settlement_tx`, surfaced flat as `release_anchor_status`). `release_anchor_status` is an ENUM in the escrow lane's own vocabulary — read the value AND its `note`, never reduce it to anchored/not-anchored: confirmed | pending | unreachable | unanchored_open | closed_unanchored | fund_never_anchored | pre_contract | test_resolved | in_progress | ledger_lane. Only `confirmed` is a chain-confirmed contract release; `pending`/`unreachable` mean a release txid EXISTS but the chain has not confirmed it yet (`pending`) or WhatsOnChain could not be reached (`unreachable`) — retry, do not read them as unanchored. Every OTHER value explains why there is no contract txid at all — a ledger-lane, closed-unanchored, fund-never-anchored, pre-contract, test-resolved or in-progress trade is settled by the joule movement in `ledger_payout_anchor`, NOT by a missing anchor. Bridge-Ledger (contribution/fee) events are not in THIS ENYAL lookup, but they ARE anchored — batched into the hourly transparency attestation (bridge_root; five attestations per OP_RETURN transaction, roughly every five hours), and checkable with the `bridge_proof` tool (newest rows read anchoring "pending" until their batch is broadcast, then carry the batch txid). Graph edges are not verifiable here. This tool never decides — it relays ENYAL's verdict fields; a proof-ref it does not return does not exist as far as this lookup can see.

  shallow
• wallet_transfer

  Direct wallet-to-wallet transfer (POST /wallet/transfer). Requires wallet:transfer scope. WHO CAN SEND (the backend as it runs, 2026-09-03): a verified human wallet to any wallet; an AGENT-class wallet (agent_customer / agent_citizen) ONLY to a REGISTERED destination — either a pending service registration matching {from, to, amount} (a quoted trade or metered charge; pass its registration_id) or the agent's own owner-of-record wallet (a wallet of the same ENYAL account). Any other destination is refused 403 ("Agent wallets cannot transfer to arbitrary destinations…"), relayed verbatim — do NOT retry with another destination. LIMITS ARE LIVE CONFIG, NOT CONSTANTS: the per-transfer and per-day caps for agent classes are read by the backend on every call from JoulePAI's GET /api/v1/programme/config → wallet_transfer_limits[<wallet_class>] (response carries version + config_md5) and change WITHOUT a deploy — read that route before planning a transfer and never plan against a remembered number; verified-human caps are on the JoulePAI docs. A transfer fee is charged to the sender (rate per the JoulePAI docs). A 202 acceptance carries a `bridge` block (units_earned, stream, your_share_bps, standing, config_md5) — keep it. Ineligible callers get the backend's real 403/402/422 verbatim. Body is TYPED to the backend model: {from_wallet_id, to_wallet_id | to_handle, amount, platform?, note?, idempotency_key?, privacy_mode?, include_proof?, registration_id?} — any other field is refused here.

  shallow

Embed this server’s score

Tool count and median score across every tool in this server’s corpus — honest in a way a single cherry-picked tool’s badge wouldn’t be.

[![Vouch score](https://vouch.tools/api/servers/56061273-7ed6-4816-bcd2-f2b9e9a6535d/badge.svg)](https://vouch.tools/servers/56061273-7ed6-4816-bcd2-f2b9e9a6535d)