chio api

Protect an existing HTTP API with a sidecar built from its OpenAPI document, so each request is admitted before it reaches your code.

On this page

Protect an HTTP API with Chio using an OpenAPI spec-backed sidecar.

Command synopsistext

chio api [OPTIONS] <COMMAND>

Start the Chio HTTP sidecar/reverse proxy.

Command synopsistext

chio api protect [OPTIONS] --upstream <UPSTREAM>

--upstream <UPSTREAM> Upstream base URL to proxy to. Required.
--spec <SPEC> Optional local OpenAPI spec path. Auto-discovered when omitted.
--listen <LISTEN> Address to listen on. Default 127.0.0.1:9090.
--receipt-store <RECEIPT_STORE> Optional SQLite receipt store path.
--allow-ephemeral-receipts Permit in-memory receipts, whose audit evidence is lost on every restart. Required to boot without --receipt-store. For local development only.
--upstream-timeout-secs <UPSTREAM_TIMEOUT_SECS> Wall-clock ceiling in seconds on a single upstream hop, including reading the full response. Raise it for upstreams with legitimately slow calls or large bounded responses. Defaults to 20 seconds.
--trust <FILE> Trust file whose issuer pins admit presented capabilities. Defaults to ~/.chio/trust.toml. Reads CHIO_TRUST.
--computer <COMPUTER> Attach to a Computer’s kernel state: verify the grants its kernel issued, read the policy in force, consult its revocations and budgets, and append receipts to its history. Replaces the individual store options.
--service <SERVICE> Service name the protected operations are registered under on the Computer; receipts and grants name it.