Connect KYE to the systems that already run your business.

Every connector ships a kye.connector_manifest.v1 document. The manifest declares what the connector does, which profiles it supports, which integration points it exposes, what it subscribes to, what it publishes, what side effects it can produce, and how it authenticates. Schema: https://schemas.kye.dev/connector-manifest.json.

{
  "schema_version": "kye.connector_manifest.v1",
  "connector_id":   "kye:connector:ipg:example_gateway",
  "name":           "Example IPG Connector",
  "display_name":   "Example Internet Payment Gateway Connector",
  "connector_type": "internet_payment_gateway",
  "category":       "payments",
  "version":        "1.0.0",
  "publisher": {
    "publisher_entity_id":  "kye:org:kye_protocol",
    "maintainer_entity_ids": ["kye:user:maintainer_001"]
  },
  "description": "Adds KYE authority pre-checks to IPG flows.",
  "supported_profiles": [
    "kye.core.v1", "kye.payment_authority.v1",
    "kye.agent_purchasing.v1", "kye.webhooks.v1", "kye.evidence.v1"
  ],
  "integration_points": [
    { "name": "pre_authorisation_check", "direction": "outbound_to_kye",
      "method": "POST", "path": "/v1/authority:decide", "required": true },
    { "name": "payment_result_webhook",  "direction": "inbound_to_kye",
      "method": "POST", "path": "/v1/events", "required": false }
  ],
  "capabilities": [
    "agent_purchase_check", "payment_authority_check",
    "basket_hash_binding", "merchant_category_scope",
    "approval_threshold", "evidence_pack_generation"
  ],
  "auth": {
    "auth_type": "api_key_or_oauth_client_credentials",
    "supports_key_rotation": true,
    "supports_mtls": true
  },
  "events": {
    "subscribes_to": [
      "kye.authority.revoked", "kye.decision.requires_approval",
      "kye.payment_authority.revoked"
    ],
    "publishes": [
      "kye.purchase_authority.allowed",
      "kye.purchase_authority.denied",
      "kye.purchase_authority.requires_approval"
    ]
  },
  "risk": {
    "risk_level":                    "high",
    "side_effect_level":             "move_money",
    "requires_signature_verification": true,
    "requires_idempotency":          true,
    "requires_audit_event":          true
  },
  "runtime": {
    "deployment_modes":   ["hosted", "byoc", "on_prem"],
    "supported_languages": ["typescript", "python", "go"]
  },
  "integrity": {
    "manifest_hash":     "...",
    "signature_required": true,
    "signature_ref":     "kye:signature:connector_manifest_001"
  },
  "status":     "active",
  "created_at": "2026-05-06T00:00:00Z",
  "updated_at": "2026-05-06T00:00:00Z"
}

Connector registry endpoints (publishers):

• POST /v1/connectors · GET /v1/connectors · GET /v1/connectors/{id} · PATCH
• POST /v1/connectors/{id}:validate · :publish · :deprecate · :quarantine · :revoke

Connector installation endpoints (operators):

• POST /v1/connector-installations · GET · GET .../{id} · PATCH · DELETE
• POST /v1/connector-installations/{id}:test · :rotate-credentials

Connector event endpoints:

• POST /v1/connectors/{id}/events · GET /v1/connectors/{id}/events · POST /v1/connectors/{id}:replay-events

Why this split? The schema must be open or the ecosystem doesn't grow. Anyone can author, test, and publish a connector against the manifest without depending on a hosted service. The managed runtime, health monitoring, hub UI, and SLA-backed connectors are where the operational moat sits and is part of the patent track.