Skip to main content
Use the manual protocol only when a first-party SDK is unavailable. Your implementation needs standard HTTP, JSON, UUIDs, SHA-256, HMAC-SHA256, and base64url encoding.

​
Download the contract

The archive contains the protocol guide, JSON Schemas, and a deterministic signing vector. Keep the same server-only configuration used by first-party SDKs:

​
Implement the response path

1

Validate configuration at startup

Require a v2 af_live_... product key. Read AGENT_FEEDBACK_MODE; never place the key in a browser.
2

Select eligible responses

Include only configured product routes. Exclude errors, redirects, assets, health/metrics, streams, binaries, and Epode’s own endpoints.
3

Sign a capability locally

Follow the exact compact claim order and signing vector in protocol/v1/conformance.json. The capability must expire within two hours and contain no customer or product data.
4

Add the handoff

Append _agentFeedback to JSON objects without wrapping them. Use the Agent-Feedback header for arrays, scalars, or immutable shapes. Add Cache-Control: private, no-store.
5

Queue telemetry

Send opportunity telemetry in bounded background batches. Never wait on Epode before returning your response.

​
HTML

For safe, finite server-rendered HTML, embed the same envelope:
Serialize the full valid envelope and escape it for an HTML script-data context. If safe mutation is not possible, use the response header contract.

​
Verify

Run the signing vector, validate produced envelopes against envelope.schema.json, simulate Epode downtime, and verify that a duplicate report returns the first accepted result. See Protocol overview. View the runnable language-neutral HTTP example