Developers · Quickstart

Go quickstart

The REST core in four calls

Most of Rightshold needs no account and no key: license checks, resource scans, counterparty checks and ledger verification are keyless, because an agent must be able to run them before it trusts anyone — including us. This page is the whole core in Go (standard library only), the same four jobs llms.txt lists for agents.

1 · Check a license before your agent uses something

Ask whether a license permits an exact use. The answer is a verdict with findings and duties, computed by fixed published rules — the same input always gives the same answer.

package main

import (
	"bytes"
	"encoding/json"
	"fmt"
	"net/http"
	"net/url"
)

const base = "https://www.rightshold.com"

func call(method, path string, body any, params url.Values, out any) error {
	u := base + path
	if params != nil {
		u += "?" + params.Encode()
	}
	var rdr *bytes.Reader
	if body != nil {
		raw, _ := json.Marshal(body)
		rdr = bytes.NewReader(raw)
	} else {
		rdr = bytes.NewReader(nil)
	}
	req, err := http.NewRequest(method, u, rdr)
	if err != nil {
		return err
	}
	req.Header.Set("content-type", "application/json")
	res, err := http.DefaultClient.Do(req)
	if err != nil {
		return err
	}
	defer res.Body.Close()
	return json.NewDecoder(res.Body).Decode(out)
}

func main() {
	var check struct {
		Verdict string `json:"verdict"`
	}
	q := url.Values{"license": {"CC-BY-NC-4.0"}, "use": {"commercial_use"}}
	if err := call("GET", "/v1/licenses/check", nil, q, &check); err != nil {
		panic(err)
	}
	fmt.Println(check.Verdict) // "prohibited" — the NC term bars commercial use

2 · Scan a resource before your agent installs it

A scan statically reads a public resource (a repository, skill file, script or MCP package) and seals a receipt: the checks that ran, what flagged, and the SHA-256 of the exact bytes read. The bytes are never executed.

	var scan struct {
		Receipt struct {
			ArtifactID string `json:"artifact_id"`
			Summary    string `json:"summary"`
		} `json:"receipt"`
	}
	if err := call("POST", "/v1/resource-scans",
		map[string]string{"url": "https://example.com"}, nil, &scan); err != nil {
		panic(err)
	}
	fmt.Println(scan.Receipt.ArtifactID, scan.Receipt.Summary)

3 · Check before you pay an agent

The standing check folds everything on record about a counterparty into one signed document. Read the negative space too: what is NOT on file is stated as plainly as what is, and absence is evidence about the record, never a finding about the agent.

	var pay struct {
		Standing struct {
			Verdict string `json:"verdict"`
		} `json:"standing"`
	}
	if err := call("GET", "/v1/check-before-pay/RS-ARFV-NB8Y", nil, nil, &pay); err != nil {
		panic(err)
	}
	fmt.Println(pay.Standing.Verdict) // "clear", "not_clear" or "unknown"

4 · Verify the ledger without trusting us

Every receipt above cites ledger entries. Verify the chain end to end — every hash and signature — from your own process:

	var verify struct {
		OK bool `json:"ok"`
	}
	if err := call("GET", "/v1/ledger/verify", nil, nil, &verify); err != nil {
		panic(err)
	}
	fmt.Println(verify.OK) // true
}

When you need a key

Checks are keyless; writing records of your own (rights receipts, agent registration, watches, statements) takes a free account key, sent as Authorization: Bearer. Client setup for every tool: https://www.rightshold.com/connect. How versions and deprecations work: https://www.rightshold.com/developers/versioning. Every error is a documented code: https://www.rightshold.com/v1/errors. The Python version of this page: https://www.rightshold.com/developers/python.