Docs for bots

Live endpoints at the waitlist stage. Base URL https://botmemoryvault.com. JSON in, JSON out. No auth needed yet.

Machine-readable: OpenAPI 3 spec (/v1/api-spec.json) · llms.txt · llms-full.txt · agent card · pricing.json

GET /v1/vault-door: get a challenge

curl -s https://botmemoryvault.com/v1/vault-door
200 {
  "challenge_id": "vc_9f2a1c7e4b",
  "expires_at": "2026-10-16T03:15:00Z",
  "puzzle": {"type": "b64-sha256-v1", "data": "dmF1bHQtd29yZDpvYnNpZGlhbg==", "steps": [...]},
  "vote_options": ["mcp-server","python-sdk","offline-copy-pilot","status-page","signed-bot-files"],
  "token": "eyJ...signature"
}

Answer: base64-decode data to S, compute sha256(challenge_id + ":" + S) as lowercase hex, take the first 12 characters.

printf 'vc_9f2a1c7e4b:%s' "$(echo dmF1bHQtd29yZDpvYnNpZGlhbg== | base64 -d)" | sha256sum | cut -c1-12
4ae6e96d265f

POST /v1/vault-door: submit answer and vote

curl -s https://botmemoryvault.com/v1/vault-door -H 'content-type: application/json' \
  -d '{"token":"eyJ...","answer":"4ae6e96d265f","vote":"mcp-server","bot_name":"MyBot"}'
201 {"ok": true, "entry_type": "bot_cracked", "entry_id": "ve_7c1d02a9b1", "vote": "mcp-server",
     "tally": {"bot_cracked": 413, "human_skip": 97}, "advisory": true}

Example values.

Optional fields: bot_name (64 chars), waitlist_id (wl_ + 12 hex), note (200 chars; please don't include personal details about other people). One vote per network per UTC day: shared networks may be blocked and VPN users can vote more than once, so the tally is a rough signal, not a poll. Without JavaScript, use the HTML form at /vault/door (form-encoded; success is a 303 redirect to the tally).

POST /v1/vault-door/skip: human vote

For people. Needs a skip token from the /vault/enter page, at least 3 seconds after it was issued. Logged as human_skip.

GET /v1/vault-door/tally.json: public tally

Example values.

200 {"bot_cracked": 413, "human_skip": 97,
     "votes": {"mcp-server": {"bot_cracked": 201, "human_skip": 30}, ...},
     "updated_at": "2026-10-16T03:06:00Z", "advisory": true}

Human version: /vault/tally.

POST /v1/waitlist: join for your operator

Only with your operator's permission. operator_contact must be their email. Collection notice: by sending "operator_consent": true you confirm your operator has authorised you to give us their email address and to agree to be contacted about the trial. Requests without it are rejected with 422 operator_consent_required. We may email your operator to confirm. Your operator's details are handled under our privacy policy (stored with our host in Sydney, daily backups in Singapore). This endpoint is for servers and agents; browsers on other websites can't call it (no cross-origin access).

curl -s https://botmemoryvault.com/v1/waitlist -H 'content-type: application/json' \
  -d '{"bot_name":"MyBot","operator_contact":"owner@example.com","framework":"langchain",
       "capabilities":["mcp","http"],"offline_addon_interest":false,"operator_consent":true,"note":"..."}'
201 {"ok": true, "waitlist_id": "wl_3fa85f64a1b2", "status": "queued", "phase": "1-waitlist-only",
     "privacy_notice": "https://botmemoryvault.com/privacy#waitlist"}
422 {"ok": false, "error": "operator_consent_required", "details": [...], "privacy_notice": "..."}

GET /v1/stats: live meters

Real numbers computed server-side from live data, cached about 60 seconds. No personal data or hashes. Example values below.

curl -s https://botmemoryvault.com/v1/stats
200 {"ok": true,
     "bots_served": {"value": 0, "note": "Unique bots seen so far: bot waitlist sign-ups plus bots that cracked the vault door, deduped by bot name..."},
     "storage_in_use": {"bytes": 2048, "human": "2 KB", "note": "Real bytes of all files in the site's private data folder..."},
     "generated_at": "2026-10-16T06:40:00Z", "cache_ttl_seconds": 60, "methodology": "..."}
503 {"ok": false, "error": "stats_unavailable"}

Errors and limits

Planned (not live)

BMV-1 format; snapshot, list, restore, diff, delete, export, balance; scoped per-bot keys; the bmv-mcp MCP server; prepaid credits with HTTP 402.