# IndyKite Developer Hub

> A collection of developer resources, code samples, guides, and tutorials to implement IndyKite products: ContX IQ, KBAC / AuthZEN authorization, Token Introspect, Trust Score, External Data Resolver, Outbound Events, MCP Server, and Agent Gateway.

## Site Structure

- /: Home page with featured resources and categories
- /resources: Code samples and API usage examples
- /guides: Step-by-step implementation guides
- /tutorials: Multi-chapter end-to-end walkthroughs with downloadable Postman collections
- /terraform: Terraform configuration examples
- /api: API reference overview

## Machine-Readable Endpoints (for agents)

### Quick Start

To discover all available code examples, fetch:

```
GET https://developer.indykite.com/api/resources.json
```

This returns a JSON array of 44 resources with metadata. Use this to:
- Search by category — currently: ContX IQ, KBAC, Token Introspect, TrustScore, External Data Resolver, Outbound Events, MCP, Capture, Environment
- Filter by tags or API type
- Find relevant openApiEndpoints and relatedGuides
- Get links to full content (markdown or JSON)

### Available Endpoints

| Endpoint | Description |
|----------|-------------|
| /api/resources.json | Index of all code examples with metadata |
| /api/terraform.json | Index of all Terraform configurations with metadata |
| /api/tutorials.json | Index of all tutorials with chapter lists and links |
| /resources/{id}.json | Full resource data as JSON (includes code) |
| /resources/{id}.md | Resource content as markdown |
| /terraform/{id}.json | Full Terraform config as JSON (includes HCL code) |
| /terraform/{id}.md | Terraform example as markdown |
| /guides/{id}.md | Guide content as markdown |
| /tutorials/{tutorialId}.json | Full tutorial as JSON (overview + every chapter body) |
| /tutorials/{tutorialId}.md | Tutorial overview + all chapters concatenated as markdown |
| /tutorials/{tutorialId}/{chapter}.md | One chapter as markdown (chapter is the integer 1, 2, …) |
| /assets/downloads/music-dataset.postman_collection.json | Downloadable Postman collection used by the music tutorial (~18 MB) |
| /api/skills.json | Index of all agent skills with full descriptions, file lists, and install commands |
| /agent-skills/{skill}/SKILL.md | Complete skill instructions, verbatim from github.com/indykite/skills (relative links to references/ and scripts/ resolve) |
| /llms-full.txt | Every guide, resource, Terraform example, tutorial, and agent skill concatenated into one markdown file (~1.5 MB) — single-fetch ingestion |

### Available Guides

| Guide | Description |
|-------|-------------|
| /guides/guide-products.md | **Start here** - All products, architecture, and relationships |
| /guides/guide-sandbox.md | Getting started with the Sandbox environment |
| /guides/guide-demos.md | IndyKite product demos and end-to-end walkthroughs |
| /guides/guide-environment.md | Projects, applications, and credentials hierarchy |
| /guides/guide-credentials.md | Service Account vs Application Agent credentials |
| /guides/guide-graph-database.md | Why a graph database powers identity and authorization |
| /guides/guide-data-residency.md | Data residency and composite databases: regions, read replicas, routing nodes to locations via the Config and Capture REST APIs, and location-aware AuthZEN authorization with 3.0-kbac policies |
| /guides/guide-contx-iq.md | ContX IQ: context-aware data queries and policies |
| /guides/guide-ciq-cypher.md | Cypher for ContX IQ: the Neo4j-adapted dialect used in CIQ policy conditions and Knowledge Queries, its rules, and worked examples |
| /guides/guide-dynamic-authz.md | Dynamic authorization with Knowledge Graphs |
| /guides/guide-authzen.md | AuthZEN standard compliance, request shape, KBAC policy versions (2.0/3.0), and location parameters for data residency |
| /guides/guide-token-introspect.md | Token Introspect: validate external IdP tokens and bind to graph nodes |
| /guides/guide-external-data-resolver.md | External Data Resolver: fetch external API data during queries |
| /guides/guide-trust-score.md | Trust Score: assess data trustworthiness |
| /guides/guide-outbound-events.md | Outbound Events: stream graph changes to Kafka, Event Grid, Service Bus, Pub/Sub |
| /guides/guide-mcp.md | MCP Server: expose IndyKite to Model Context Protocol clients |
| /guides/guide-skills.md | Agent Skills: drive ContX IQ, MCP, and Agent Gateway from prompts in Claude Code, Gemini CLI, and other coding agents |
| /guides/guide-terraform.md | Infrastructure as code with the IndyKite Terraform provider |

### Available Tutorials

Multi-chapter walkthroughs. Each tutorial has a top-level page (description + prerequisites) and N chapter pages. Many ship a downloadable Postman collection so the chapters can be followed against a live environment.

| Tutorial | Chapters | Topic |
|----------|----------|-------|
| /tutorials/tutorial-music-dataset | 10 | Build IndyKite end-to-end with the music dataset: environment setup, Token Introspect, MCP Server, ingest 16k+ nodes / 31k+ relationships, KBAC + AuthZEN, ContX IQ policies / queries / executes. Comes with a downloadable Postman collection (link above). |
| /tutorials/tutorial-agent-gateway | 8 | Protect agent-to-agent (A2A) workflows - and MCP servers (protected_agent.protocol: mcp) - with the IndyKite Agent Gateway (IAG). Models a workflow in the IKG, writes the CAN_TRIGGER policy and ContX IQ query, configures IAG, and runs the iag-demo with three protected agents. |
| /tutorials/tutorial-agent-gateway-mcp | 8 | Protect an MCP server with the Agent Gateway's MCP proxy mode (protected_agent.protocol: mcp), demonstrated with a Google Drive MCP server in the iag-mcp-demo: wrap a stdio MCP server into Streamable HTTP, model the wf-drive workflow (CAN_TRIGGER / INVOKES with workflow_name, one workflow per call shape), configure drive-mcp-iag, run a full-text Drive search through the gateway, and verify 403 denials plus audit records. |

### Resource Schema

Each resource in /api/resources.json contains:

```json
{
  "id": "ciq-basic",
  "title": "ContX IQ: Query License Numbers...",
  "description": "Query the IndyKite Knowledge Graph...",
  "category": "ContX IQ",
  "tags": ["ContX IQ Policy", "Graph Traversal"],
  "api": "ContX IQ",
  "lastUpdated": "2026-03-20",
  "openApiEndpoints": ["/contx-iq/v1/execute", "/configs/v1/knowledge-queries"],
  "relatedGuides": ["/guides/guide-contx-iq", "/guides/guide-sandbox"],
  "commonErrors": [
    {
      "code": "401",
      "message": "UNAUTHENTICATED",
      "solution": "Check credentials: ServiceAccount Bearer token for config APIs, X-IK-ClientKey for execution"
    }
  ],
  "links": {
    "html": "/resources/ciq-basic",
    "markdown": "/resources/ciq-basic.md",
    "json": "/resources/ciq-basic.json"
  }
}
```

### Terraform Schema

Each terraform config in /api/terraform.json contains:

```json
{
  "id": "terraform-3",
  "title": "Kafka Outbound Events / Signal - Config",
  "description": "Create an Outbound Events configuration with a Kafka provider.",
  "category": "Outbound Events",
  "lastUpdated": "2026-03-20",
  "terraformProviderDocs": [
    "https://registry.terraform.io/providers/indykite/indykite/latest/docs/resources/event_sink"
  ],
  "relatedGuides": ["/guides/guide-terraform", "/guides/guide-outbound-events"],
  "commonErrors": [
    {
      "code": "ALREADY_EXISTS",
      "message": "Only one event sink per project",
      "solution": "Delete the existing event sink before creating a new one"
    }
  ],
  "links": {
    "html": "/terraform/terraform-3",
    "markdown": "/terraform/terraform-3.md",
    "json": "/terraform/terraform-3.json"
  }
}
```

### Example Workflow

**For REST API examples:**
1. Fetch /api/resources.json to discover resources
2. Filter by category, tags, or api field to find relevant examples
3. Fetch full content via links.markdown or links.json
4. Check openApiEndpoints for API documentation at https://openapi.indykite.com
5. Check relatedGuides for step-by-step instructions
6. Use commonErrors for troubleshooting

**For Terraform configurations:**
1. Fetch /api/terraform.json to discover Terraform examples
2. Filter by category (Token Introspect, Environment, Outbound Events)
3. Fetch full content via links.markdown or links.json
4. Check terraformProviderDocs for Terraform registry documentation
5. Use commonErrors for troubleshooting Terraform apply failures

## Product Overview

For a comprehensive guide to all IndyKite products and how they relate:
- /guides/guide-products.md - Products overview with architecture diagram

## Main Topics

- Identity Knowledge Graph (IKG): Store nodes and relationships
- ContX IQ (CIQ): Context-aware data queries with authorization
- KBAC / AuthZEN: Knowledge-Based Access Control for allow/deny decisions, exposed as the AuthZEN standard
- Token Introspect: Validate external IdP tokens and map to IKG nodes
- External Data Resolver: Fetch external API data at query time
- Trust Score: Assess data quality and use in authorization
- Outbound Events: Push notifications on data changes (Kafka, Event Grid, Service Bus, Pub/Sub)
- MCP Server: Expose IndyKite capabilities to Model Context Protocol clients
- Agent Gateway (IAG): Protect agent-to-agent workflows - or an MCP server - with policy-controlled enforcement in front of each agent
- Terraform: Infrastructure as code for IndyKite

## Agent Skills

If your coding agent supports installable skills, install the full set with `npx skills add indykite/skills` (Claude Code: `/plugin marketplace add indykite/skills`; Gemini CLI: `gemini extensions install https://github.com/indykite/skills`). Agents without skill support can fetch any skill's instructions directly from this site and follow them in-context — see the catalog below and /guides/guide-skills.md.

<!-- agent-skills-catalog:start -->

22 skills, served verbatim from https://github.com/indykite/skills. Each skill is a self-contained instruction bundle: fetch its SKILL.md and follow the relative links (references/, scripts/) for the full workflow. Machine index: /api/skills.json. Install into a coding agent with `npx skills add indykite/skills`.

### Agent Gateway

| Skill | What it does |
| --- | --- |
| [indykite-agent-gateway](/agent-skills/indykite-agent-gateway/SKILL.md) | Deploy and configure IndyKite Agent Gateway (IAG) in front of agent-to-agent (A2A) workflows or MCP servers. |

### AuthZEN / KBAC

| Skill | What it does |
| --- | --- |
| [indykite-authzen-evaluation](/agent-skills/indykite-authzen-evaluation/SKILL.md) | Make a single KBAC authorization decision via the IndyKite AuthZEN REST API (`POST /access/v1/evaluation`) - returns a boolean `decision` for one (subject, action, resource) triple, optionally with per-request `contex... |
| [indykite-authzen-evaluations](/agent-skills/indykite-authzen-evaluations/SKILL.md) | Run many KBAC authorization decisions in one call via the IndyKite AuthZEN REST API (`POST /access/v1/evaluations`), with top-level subject/action/resource/context as defaults overridden per entry; returns one `decisi... |
| [indykite-authzen-kbac-policies](/agent-skills/indykite-authzen-kbac-policies/SKILL.md) | Author and manage an IndyKite KBAC (Knowledge-Based Access Control) authorization policy - a single subject type, an actions list, a single resource type, and a Cypher condition over the IKG - through the Config API (... |
| [indykite-authzen-search-action](/agent-skills/indykite-authzen-search-action/SKILL.md) | List the actions a subject is allowed to perform on a resource via the IndyKite AuthZEN REST API (`POST /access/v1/search/action`) - returns the granted action names for one pinned (subject, resource) pair. |
| [indykite-authzen-search-resource](/agent-skills/indykite-authzen-search-resource/SKILL.md) | List the resources a subject is allowed to perform a given action on via the IndyKite AuthZEN REST API (`POST /access/v1/search/resource`) - given a subject and an action, returns the matching resource instances of a ... |
| [indykite-authzen-search-subject](/agent-skills/indykite-authzen-search-subject/SKILL.md) | List the subjects allowed to perform a given action on a resource via the IndyKite AuthZEN REST API (`POST /access/v1/search/subject`) - given a resource and an action, returns the matching subject instances of a type. |

### Capture API

| Skill | What it does |
| --- | --- |
| [indykite-capture-delete-node-properties](/agent-skills/indykite-capture-delete-node-properties/SKILL.md) | Build the request-body JSON for the IndyKite Capture API batch node-property delete (`POST /capture/v1/nodes/properties/delete`) - a `nodes` array (1-250 per request) where each entry names a node (`external_id` + `ty... |
| [indykite-capture-delete-node-property-metadata](/agent-skills/indykite-capture-delete-node-property-metadata/SKILL.md) | Build the request-body JSON for the IndyKite Capture API batch property-metadata delete (`POST /capture/v1/nodes/properties/metadata/delete`) - a `nodes` array (1-250 per request) where each entry names a node (`exter... |
| [indykite-capture-delete-nodes](/agent-skills/indykite-capture-delete-nodes/SKILL.md) | Build the request-body JSON for the IndyKite Capture API batch node delete (`POST /capture/v1/nodes/delete`) - a `nodes` array (1-250 per request) of `{external_id, type}` references, each removing one whole node from... |
| [indykite-capture-delete-relationship-properties](/agent-skills/indykite-capture-delete-relationship-properties/SKILL.md) | Build the request-body JSON for the IndyKite Capture API batch relationship-property delete (`POST /capture/v1/relationships/properties/delete`) - a `relationships` array (1-250 per request), each entry identifying a ... |
| [indykite-capture-delete-relationships](/agent-skills/indykite-capture-delete-relationships/SKILL.md) | Build the request-body JSON for the IndyKite Capture API batch relationship delete (`POST /capture/v1/relationships/delete`) - a `relationships` array (1-250 per request), each entry identifying a relationship by `sou... |
| [indykite-capture-upsert-nodes](/agent-skills/indykite-capture-upsert-nodes/SKILL.md) | Build the request-body JSON for the IndyKite Capture API batch node upsert (`POST /capture/v1/nodes`) - a `nodes` array (1-250 per request) of entities, each with `external_id`, `type`, optional `is_identity` / `label... |
| [indykite-capture-upsert-relationships](/agent-skills/indykite-capture-upsert-relationships/SKILL.md) | Build the request-body JSON for the IndyKite Capture API batch relationship upsert (`POST /capture/v1/relationships`) - a `relationships` array (1-250 per request), each entry connecting a `source` node to a `target` ... |

### ContX IQ

| Skill | What it does |
| --- | --- |
| [indykite-ciq-add-property](/agent-skills/indykite-ciq-add-property/SKILL.md) | Author an IndyKite ContX IQ (CIQ) policy plus its Knowledge Query that sets one or more properties on an existing node in the IndyKite Graph (IKG), then run it via `POST /contx-iq/v1/execute`. |
| [indykite-ciq-add-relationship-property](/agent-skills/indykite-ciq-add-relationship-property/SKILL.md) | Author an IndyKite ContX IQ (CIQ) policy plus its Knowledge Query that sets one or more properties on an existing relationship in the IndyKite Graph (IKG), then run it via `POST /contx-iq/v1/execute`. |
| [indykite-ciq-create-node](/agent-skills/indykite-ciq-create-node/SKILL.md) | Author an IndyKite ContX IQ (CIQ) policy plus its Knowledge Query that creates a brand-new node in the IndyKite Graph (IKG), then run it via `POST /contx-iq/v1/execute`. |
| [indykite-ciq-create-node-with-link](/agent-skills/indykite-ciq-create-node-with-link/SKILL.md) | Author an IndyKite ContX IQ (CIQ) policy plus its Knowledge Query that creates a brand-new node AND links it to one or more existing nodes via new relationships in a single `POST /contx-iq/v1/execute` call. |
| [indykite-ciq-create-relationship](/agent-skills/indykite-ciq-create-relationship/SKILL.md) | Author an IndyKite ContX IQ (CIQ) policy plus its Knowledge Query that creates a brand-new relationship between two existing nodes in the IndyKite Graph (IKG), then run it via `POST /contx-iq/v1/execute`. |
| [indykite-ciq-delete](/agent-skills/indykite-ciq-delete/SKILL.md) | Author an IndyKite ContX IQ (CIQ) policy plus its Knowledge Query that deletes a node, a relationship, or one or more properties from the IndyKite Graph (IKG), then run it via `POST /contx-iq/v1/execute`. |
| [indykite-ciq-read](/agent-skills/indykite-ciq-read/SKILL.md) | Author a read-only IndyKite ContX IQ (CIQ) policy plus its Knowledge Query, then run it via `POST /contx-iq/v1/execute`. |

### MCP Server

| Skill | What it does |
| --- | --- |
| [indykite-mcp-server](/agent-skills/indykite-mcp-server/SKILL.md) | Make live IndyKite authorization decisions (AuthZEN/KBAC) and run ContX IQ graph queries from an AI agent over the Model Context Protocol - one Bearer-token JSON-RPC session, no bespoke REST wiring. |
<!-- agent-skills-catalog:end -->

## External Resources

- Documentation: https://docs.indykite.com/
- OpenAPI Definitions: https://openapi.indykite.com/
- GitHub (developer hub): https://github.com/indykite/developer-hub
- GitHub (agent skills): https://github.com/indykite/skills

## Contact

- Website: https://indykite.com
- Twitter: @indykite