Public API · v0.1 preview

RILLA Verified Payee

A cryptographically signed attestation that a payee (ABN, optionally BSB + account last-4) has been cross-checked by RILLA Shield. Xero, MYOB, banks, and ERP payment approvals can verify the signature before releasing funds — no callback to RILLA required.

▶ Try the interactive demo Partner sandbox View JWKS

Why this exists

Detection alone doesn't prevent payments. This primitive lets any payment surface — bank UI, Xero bill approval, ERP payment run — check a signed fact from RILLA before the money moves. RILLA never touches funds and holds no AFSL exposure; verifiers do the release.

1. Fetch an attestation

GET https://rillashield.app/api/public/attest/payee/{ABN}
        ?bsb=062000&last4=1234   # optional account binding

Response body includes a signed JWT (attestation) plus a non-sensitive summary. Rate-limited to 120 req/min/IP. Cached 60s.

2. Verify the signature

import { jwtVerify, createRemoteJWKSet } from 'jose'

const JWKS = createRemoteJWKSet(
  new URL('https://rillashield.app/api/public/.well-known/jwks.json')
)

const { payload } = await jwtVerify(attestation, JWKS, {
  issuer: 'https://rillashield.app',
  audience: 'urn:rilla:verified-payee',
})

// payload.trust_level === 'verified' | 'known' | 'new'
// payload.trust_score, payload.observations, payload.bsb, payload.account_last4

3. Claim shape

Claim	Type	Notes
iss	string	Always `https://rillashield.app`
aud	string	Always `urn:rilla:verified-payee`
sub	string	`abn:{abn}`
exp	int	Unix seconds, default TTL 24h
abn	string	11-digit ABN, no spaces
name	string	Legal/trading name as observed
bsb	string?	6 digits, present if account-bound
account_last4	string?	Last 4 only, never the full number
trust_level	enum	`verified` · `known` · `new`
trust_score	int	0–100
observations	int	Distinct RILLA tenants who've seen this payee
last_checked_at	string	ISO 8601 timestamp

4. Refusals (non-200)

400 invalid_abn — ABN failed checksum
404 unknown_payee — no RILLA observations; refuses to sign
409 payee_flagged — RILLA has flagged this payee; do not pay
429 rate_limited — per-IP burst limit

Regulatory positioning

RILLA does not hold or move funds. We publish a signed fact. Verifiers make the release decision. No AFSL, AUSTRAC RSP, or PayTo Payment Initiator status required to consume this API — check with your own compliance team for your side of the flow.

Key rotation

Current key: rilla-payee-2026-01 · ES256 · P-256. Rotation announced 30 days ahead at /status. Always resolve the signing key by kid from the JWKS.