Quickstart, Docker

The orchestrator image is private. Pulling it needs access that Verdifax grants, so these steps work only for an organization that has been given it. Everyone else uses the hosted API at https://api.verdifax.com with an API key, issued after an access request at verdifax.com/request.

1. Pull and run

docker run -d --rm \
  --name verdifax-api \
  -p 9090:9090 \
  -p 9091:9091 \
  ghcr.io/verdifax/verdifax-api:latest

• Port 9090 exposes the REST API.
• Port 9091 exposes the compliance dashboard SPA.
• The image is Alpine-based and ships three binaries: verdifax-api (the entrypoint), verdifax-verify and the verdifax-t4-live AIVP-T4 adapter.

2. Confirm it's alive

curl -s http://localhost:9090/health | python3 -m json.tool

Expected:

{
  "ok": true,
  "orchestrator_git_sha": "<the commit the image was built from>",
  "orchestrator_version": "main",
  "service": "verdifax-orchestrator-api",
  "time": "2026-10-17T18:18:08.516428185Z",
  "version": "1.0.0"
}

The /health endpoint returns a liveness probe that production health checks should hit. It requires no authentication.

3. Run your first attestation

curl -s -X POST http://localhost:9090/execute \
  -H "Content-Type: application/json" \
  -d '{
    "payload_text": "hello verdifax",
    "program_id":   "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
    "route_id":     "route-test",
    "registry_record_hash": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
  }' | python3 -m json.tool

The response includes the full sealed manifest plus run_id and duration_ms.

4. Open the dashboard

open http://localhost:9091/

You'll see the run you just made, with the manifest hash, every stage's output, a "Verify" button that re-derives the seal, and a "Download audit report (PDF)" link.

docker-compose (recommended for local dev)

For the full stack with persistence:

The compose file ships with the orchestrator source, and the orchestrator source repository is not public, so this path is not available from a public clone. The supported path is the hosted API at https://api.verdifax.com; see Quickstart, curl.

For reference, the compose file maps both ports, mounts a named volume for the SQLite run-history, and starts a small nginx sidecar that serves the interactive nine-stage pipeline UI on port 8080.

Configuration

Every flag has an environment-variable equivalent (12-factor):

Continue

• Quickstart, Python
• Quickstart, curl
• API reference, POST /execute