Four primitives. Everything else is composition.
Manav is smaller than it looks. It does four things, each behind one or two API calls.
The four primitives
Receipts
A signed, offline-verifiable record that a specific human confirmed a specific action — including what they were shown when they confirmed it. POST /v2/statement then POST /v2/sign.
Step-up signing
Require a fresh human signature at a risk threshold, mid-session. A valid session is not enough; the action fails without the signature. POST /v2/sign/options.
Agent delegation
One human signs a scoped grant; an agent acts under it, and every action remains traceable to the person who authorised the scope. GET /v2/grants/{id}.
Revocation
A signed, strictly-increasing revocation list that offline verifiers can cache and still trust. A verifier that cannot verify the list must reject. GET /v2/revocations.
What makes a receipt different from a log line
| A database row says | A receipt proves |
|---|---|
| Someone with a valid session pressed a button | A specific credential, with user verification, signed this action |
| A user id and a timestamp | The hash of the exact statement, including the rendered text shown |
| Trust our database | Check it against a published key, offline, with no call to us |
| We could alter it | Altering one byte invalidates the signature |
The second row is the one a dispute, an audit or an insurance claim turns on: what was the person shown when they said yes?
Presence tiers
Not every signature is equal, and we do not pretend otherwise. Each receipt records the tier that was actually achieved, worked out from what ran: whether the device verified the person, and which authenticator model (AAGUID) signed.
| Tier | What ran |
|---|---|
P3 | User verification on a known roaming security key |
P2 | User verification (Face ID, fingerprint or PIN) on a phone, laptop or unknown authenticator |
P1 | A signature without user verification |
An unknown authenticator is never rated above P2.
tier_too_low.See the primitives working
Real flows you can click through, no account needed.