n8n-nodes-signatrust

Sign every AI decision in your n8n workflow with Signatrust — the trust, verification and accountability layer for autonomous AI agents.

This community node lets any n8n workflow generate, verify and retrieve cryptographically signed AI Decision Receipts against Signatrust Cloud or your self-hosted enterprise endpoint.

• One unified credential for Cloud and Self-Hosted (Connection Type selector)
• Three focused operations — nothing more, by design
• Privacy-first — raw prompts and outputs are SHA-256 hashed; only the hash is stored unless you opt in
• MIT-licensed, open source
• Production-deployed adapter at https://signatrust.net/api/v1/n8n

Full landing page, recipes and FAQ: https://signatrust.net/n8n

What this node is — and what it isn't

Install

In your n8n instance go to Settings → Community Nodes → Install and enter:

n8n-nodes-signatrust

Or, in a self-hosted n8n:

npm install n8n-nodes-signatrust

Requires n8n >= 1.0 and Node.js >= 20.

Set up the credential

1. Sign up at https://signatrust.net/register — register an agent and copy the sk_live_… API key it issues (shown once).
2. In n8n, create a new Signatrust API credential.
3. Pick the Connection Type:
   • Signatrust Cloud (default) — Base URL is https://signatrust.net/api/v1/n8n, no further config needed.
   • Self-Hosted Enterprise — Base URL field appears; set it to e.g. https://signatrust.your-company.com/api/v1/n8n.
4. Paste the API key.
5. Click Test — the node hits GET /ping against your endpoint; a green check means the credential resolved to a live, non-suspended agent.

Operations

Generate Decision Receipt

The node also automatically attaches workflow_id, execution_id and node_name from n8n's execution context.

Response (handed to the next n8n step verbatim):

{
  "ok": true,
  "receipt_id": "STR-3525207773",
  "sequence": 324,
  "timestamp": "2026-06-26T15:20:26.592Z",
  "hash": "sha256:3a58bff6...",
  "signature": "fj9FpBMPgP...",
  "public_key": "MCowBQYDK2VwAyEA0Cv4w...",
  "algorithm": "ed25519",
  "verify_url": "https://signatrust.net/api/v1/n8n/receipts/STR-3525207773/verify",
  "share_url": "https://signatrust.net/verify?id=STR-3525207773",
  "fetch_url": "https://signatrust.net/api/v1/n8n/receipts/STR-3525207773",
  "trace": { "trace_id": "exec_123", "receipt_mode": "every_agent_step", "step_count": 4, "steps": [] },
  "receipt": { "id": "STR-3525207773", "type": "decision_receipt", "...": "..." }
}

Verify Decision Receipt

Looks up a receipt by id and returns the four-pillar verdict used on the public verify portal:

{
  "ok": true,
  "receipt_id": "STR-3525207773",
  "valid": true,
  "signed": true,
  "integrity": true,
  "chain": true,
  "checks": { "hash_matches": true, "signature_valid": true, "chain_linked": true },
  "errors": [],
  "timestamp": "...",
  "sequence": 324,
  "share_url": "https://signatrust.net/verify?id=STR-3525207773"
}

Get Decision Receipt

Fetches the full canonical receipt body for archival, downstream signing, or to render inside Slack / Notion / your CRM alongside the original decision.

Decision Boundary Disclosure (DBD)

New in v0.4.0 — Declare what your AI agent evaluated and what it explicitly excluded from scope. This creates a cryptographically signed boundary map inside the receipt, proving transparency about AI decision limits.

How it works

1. Set the Boundary Disclosure Schema field to a sector schema (e.g. automotive_collision.v1, medical_diagnosis.v1).
2. Fill in Domains Evaluated with the domains your AI actually assessed:

[
  { "domain_id": "physics_impact_force", "confidence": "high", "method": "calculated" },
  { "domain_id": "vehicle_structural_integrity", "confidence": "medium", "method": "estimated" }
]

3. Fill in Domains Excluded with any domains your AI did NOT evaluate:

[
  { "domain_id": "regulatory_jurisdiction", "reason": "not_in_scope", "note": "Client did not request regulatory analysis" }
]

The server validates your declaration against the sector schema and classifies coverage as full, partial, or minimal. The signed receipt then carries:

• What was evaluated (with confidence levels and methods)
• What was excluded (with explicit reasons)
• A coverage percentage and classification
• A SHA-256 hash of the scope declaration itself

Available schemas

Query live schemas: GET https://signatrust.net/api/v1/schemas

Example workflows

A minimal example workflow ships in this package as example-workflow.json. Three full recipes are documented at https://signatrust.net/n8n:

• Loan rejection → signed receipt → Slack
• Claude approval → signed receipt → CRM
• Inbound webhook → verify → IF branch → fulfilment

Release notes (0.3.5)

• Removed dead requestDefaults config from the programmatic node (n8n review fix); request headers are handled per-request via json: true and the credential's X-API-Key authenticate block.
• Published from the dedicated GitHub repository via GitHub Actions with npm provenance.

Release notes (0.3.3)

• Added Receipt Mode controls: final_decision_only, every_tool_call, every_agent_step, custom.
• Added trace controls in Generate operation: trace_id, step_index, step_type, step_name, tool_name.
• Node now forwards trace fields to the Signatrust n8n API so responses can include execution timeline metadata.

Error handling

• 401 — missing or revoked API key
• 402 — plan quota exceeded; response carries tier, used, limit, upgrade_url
• 403 — agent suspended
• 404 — receipt id not found (on Verify / Get)

Enable Continue On Fail on the node to route over-quota or invalid-receipt errors to a fallback branch.

Links

• Landing page: https://signatrust.net/n8n
• REST docs: https://signatrust.net/docs
• Receipt specification (ADR v1.0): https://signatrust.net/adr
• Discovery document: https://signatrust.net/.well-known/signatrust.json
• Public verify portal: https://signatrust.net/verify
• Source: https://github.com/abokenan444/Signatrust/tree/main/n8n-node

Compatibility

• n8n >= 1.0.0
• Node.js >= 20

License

MIT © Signatrust