Python SDK in 5 minutes

From pip install to your first verified event on the tape — honestly about five minutes, if your keys are ready. This is the short version of the journey; the full walk-through with every option lives in the Python quickstart.

1 · Install

1pip install wytness-ai

One package. It brings Microsoft's Agent Governance Toolkit with it, so the identity and hash-chain layer arrives as a dependency rather than a second integration project. If your agent already uses AGT, nothing conflicts — the wrapper is built around the toolkit you're running, not beside it.

2 · Keys, from the dashboard

On the Keys page, create an API key and generate a signing key — the signing keypair is created in your browser, the private half goes to your secrets manager, the public half registers automatically. If you want PII sealing (you do), generate the encryption keypair and HMAC secret the same way. Everything the SDK needs is then five environment values:

1WYTNESS_API_KEY=wyt_api_live_...
2WYTNESS_ENDPOINT=https://api.wytness.ai
3WYTNESS_SIGNING_KEY=<base64 Ed25519 private key>
4WYTNESS_PII_PUBKEY=<base64 X25519 public key>
5WYTNESS_PII_SECRET=<base64 HMAC secret>

Each value has one job: the API key authenticates your environment to ingest, the signing key puts your signature on every event, and the PII pair seals the personal fields you declare. In production these live in your secrets manager and load at process start — the same discipline as your database credentials, because they're the same class of secret. One deliberate strictness worth knowing up front: the wrapper refuses to start without a signing key. An unsigned event is a claim, not evidence, and the SDK won't produce one.

3 · Wire it in

Call init() once at process start. The pii_fields list is where you declare which fields hold personal data — the sealing boundary is explicit, and it's yours:

1import wytness_ai
2from wytness_ai import AuditLog
3 
4wytness_ai.init(pii_fields=["customer.email", "customer.name"])
5 
6audit = AuditLog()
7audit.log(
8    event_type="tool_invocation",
9    agent_did="billing-agent",
10    action="send_invoice",
11    policy_decision="allow",
12    data={
13        "customer": {"email": "alice@example.com", "name": "Alice"},
14        "amount": 99.99,
15    },
16)
17 
18wytness_ai.shutdown()  # drain the in-flight batch on exit

If your agent already uses AGT, nothing else changes — the wrapper hooks AGT's audit log, so every entry your agent was already chaining now also flows through signing and pseudonymisation on its way to the tape. And the LLM side comes free: init() also wraps the Anthropic and OpenAI clients your code already uses, so model calls — streams and token counts included — are recorded automatically with no per-call code. One function call, three capture paths.

4 · Watch it arrive

Run your agent, open Events in the dashboard, and there's your row: the action, the sealed customer fields showing tokens rather than the real values, and the verification mark confirming the envelope checked out against your registered key. That mark is the whole product in miniature — the event didn't just arrive, it proved itself on the way in. Click into the row and read the full record; it's worth doing once just to see what "alice@example.com" looks like from our side of the fence, which is to say: a token.

What you just set up, in audit terms

Five minutes of setup bought three properties your compliance team will use for years: every recorded action is signed with a key only you hold, personal data in declared fields never leaves your environment unsealed, and the trail that accumulates is verifiable by outsiders. There's also what you didn't set up: no log shipping, no correlation pipeline, no retention jobs — the parts that usually turn "add audit logging" into a quarter-long project are the platform's job, not yours. Not bad for one init call. TypeScript team? Same five minutes over there. Questions? Ask us.