ACI FRAMEWORK v1.0 — METHODOLOGY

Published risk methodology for digital credit.

Methodology, computation engine, and verification layer

Effective1 April 2026

CRO sign-offrequired for changes

Risk Indicator calculations are deterministic when the approved inputs, methodology version, engine version and configuration are held constant

Version-controlled

API Documentation

ACI Framework v1.0 · base URL https://aethoncredit.com/api/v1

Authentication

API keys are passed via the x-api-key header. Keys are scoped to a workspace and a tier.

curl https://aethoncredit.com/api/v1/methodology \
  -H "x-api-key: sk_live_..."

Endpoints

Method	Path	Description
GET	/api/v1/scores	List ACI Risk Indicators
GET	/api/v1/scores/{providerId}	One provider's current ACI Risk Indicator
GET	/api/v1/methodology	Methodology version + threshold metadata
GET	/api/v1/status	Service status and framework version
GET	/api/public/changelog	Public Risk Indicator change feed (no auth)

HMAC signature verification

Webhooks are signed with HMAC-SHA-256 over the raw request body. The shared secret is shown once at workspace creation.

// Node.js
import crypto from 'crypto';
const sig = req.headers['x-aci-signature'];
const expected = crypto
  .createHmac('sha256', SECRET)
  .update(rawBody)
  .digest('hex');
if (sig !== expected) throw new Error('invalid signature');

# Python
import hmac, hashlib
expected = hmac.new(SECRET.encode(), raw_body, hashlib.sha256).hexdigest()
if request.headers['x-aci-signature'] != expected:
    raise ValueError('invalid signature')

Response shape (excerpt)

{
  "provider_id": "uuid",
  "provider_name": "Example Provider",
  "planner_type": "btc",
  "composite_score": 78,
  "risk_band": "MEDIUM",
  "methodology_version": "ACI Framework v1.0",
  "scored_at": "2026-06-30T00:00:00Z",
  "score_status": "PUBLISHED",
  "certified_at": null
}

Every weight, threshold, and hard cap is published here

Read full methodology →