Skip to main content
Parmana Client. Main entry point for the Parmana Python SDK.

ParmanaClient Objects

Parmana SDK Client. Parmana ensures AI executes only policy-compliant actions.

Example

client = ParmanaClient( … endpoint=“http://localhost:3000”, … )
trust_record = client.execution.execute(transaction)
verification = client.verification.verify( … transaction.business_transaction_id, … )

__init__

Create a Parmana SDK client.

Raises

ConfigurationError: If endpoint is missing or empty. Mirrors typescript/src/client/ParmanaClient.ts’s identical fail-fast check. This client is synchronous only. There is no async variant.

Parameters

endpoint: Base URL of the Parmana Runtime. api_key: Caller bearer key, minted by scripts/generate-api-key.ts. Sent as Authorization: Bearer <api_key> on every request. Omit only against a Runtime started with PARMANA_AUTH_DISABLED=true (local development only); every other deployment rejects an unauthenticated request with a 401 before a Business Transaction is even constructed. See /api-reference/authentication. timeout: HTTP timeout in seconds, applied per request. max_retries: Retry attempts for idempotent (GET) requests that fail with a connection error or a 429/502/503/504 response. POST requests (execute, verify, receipt, replay) are never retried. backoff_factor: Exponential backoff factor between retries, in seconds. debug: Enable request/response debug logging on the “parmana” logger.

endpoint

Parmana Runtime endpoint.

version

Parmana SDK version.

health

Returns the Runtime health status.

execute

Execute a Business Transaction.

verify

Run a fresh verification of an Execution Trust Record, appending a new Verification to its history. Distinct from get_latest_verification(), which reads the most recent one without re-verifying.

get_latest_verification

Returns the latest Verification, without performing a fresh one.

create_transaction

Creates (executes) a Business Transaction via POST /transactions, a second, independent entry point into the identical execution pipeline as execute() (POST /execute).

transaction

Retrieves a Business Transaction.

trust_record

Retrieves an Execution Trust Record.

policy_in_effect

The policy a request for capability must declare right now, and what the request must carry (GET /policies/in-effect). Call it before every request and declare policy exactly as returned.

validate_policy

Validates that a policy (name + version) is loadable.

refusal_record

Retrieves a Refusal Record by Business Transaction ID.

verify_refusal_record

Verifies a Refusal Record’s signature.

execution_intent

Retrieves an Execution Intent and its status (ADR-0012). The intent is the signed statement, stored before an action is released, of what was about to be released.

verify_execution_intent

Verifies an Execution Intent’s hash and signature. Needs no credential. True proves the intent is genuine and unaltered. It does not prove the action was released, or what its result was.

unfinalized_execution_intents

Lists Execution Intents that never reached a signed Trust Record and were not closed by hand, oldest first. Needs a credential provisioned as a verified human.

finalize_execution_intent

Rebuilds the signed Trust Record for a released action whose record was never produced. Never calls a connector. Safe to run twice. Needs a credential provisioned as a verified human.

resolve_execution_intent

Closes a PREPARED or ERRORED intent that a verified human reconciled at the connector. The note is required. The resolution is an attributed operator statement in unsigned status, not a Trust Record.

verify_audit_event

Verifies a signed caller-authentication or Razorpay-webhook audit event’s signature.

latest_receipt

Retrieve the most recent receipt without generating a new one. See ReceiptApi.get_latest.

caller

Who this API key belongs to and what it may do (GET /callers/me).

public_key

A signing public key of the deployment (GET /keys/{keyId}), for the offline verifiers. Records are signed with “default”.

propose_policy_change

Propose a policy change. See PolicyApi.propose_change.

policy_changes

List policy changes for review. See PolicyApi.list_changes.

approve_policy_change

Approve a policy change with a signed step up authorization. See PolicyApi.approve_change and parmana.crypto.sign_policy_change_step_up.

reject_policy_change

Reject a policy change with a reason and a signed step up authorization. See PolicyApi.reject_change.

list_approvers

Every approver key the server trusts or trusted. See ApproverApi.list.

approver_changes

List approver changes. See ApproverApi.list_changes.

approve_approver_change

Approve and apply an approver change. See ApproverApi.approve_change.

reject_approver_change

Reject an approver change. See ApproverApi.reject_change.

list_external_connectors

Every external connector registration, active and revoked. See ExternalConnectorApi.list.

external_connector_changes

List external connector changes. See ExternalConnectorApi.list_changes.

approve_external_connector_change

Approve and apply an external connector change. See ExternalConnectorApi.approve_change.

reject_external_connector_change

Reject an external connector change. See ExternalConnectorApi.reject_change.

list_business_signal_sources

Every business signal source registration, active and revoked. See BusinessSignalSourceApi.list.

business_signal_source_changes

List business signal source changes. See BusinessSignalSourceApi.list_changes.

approve_business_signal_source_change

Approve and apply a business signal source change. See BusinessSignalSourceApi.approve_change.

reject_business_signal_source_change

Reject a business signal source change. See BusinessSignalSourceApi.reject_change.

list_authority_grants

Every authority grant, active and revoked. See AuthorityGrantApi.list.

authority_grant_changes

List authority grant changes. See AuthorityGrantApi.list_changes.

approve_authority_grant_change

Approve and apply an authority grant change. See AuthorityGrantApi.approve_change.

reject_authority_grant_change

Reject an authority grant change. See AuthorityGrantApi.reject_change.