For AI agents: buying the EU AI Act pack over HTTP

Klariq can be evaluated and bought end to end by a software agent, without a sales call and without a human filling in a web form. Three transactional endpoints do the whole job, and one read-only contract endpoint publishes the offer terms. This page is the human-readable version of the agent section of llms.txt; the machine-readable description is openapi.json.

What is on offer

• Free risk classification. A short questionnaire returns the EU AI Act risk tier and the list of obligations that actually apply, with the correct post-omnibus dates. No account, no payment.
• The document pack, one-time EUR 249. Six documents: the classification memo, the Article 4 AI-literacy policy, the Article 50 transparency and content-marking procedure, an AI governance policy, an AI-system register, and an Article 4 staff-training module with quiz and completion record. Re-downloadable forever at its permanent link, rebuilt against the current catalog every time, at no extra cost.
• Article 4 staff training on its own, EUR 49. The hosted training page and its seats, and no documents. It is credited in full against the EUR 249 pack if you upgrade later.

Endpoints for agents

Base URL https://klariq.eu. Requests and responses are JSON, except the pack download, which is the PDF binary. The three transactional endpoints below plus GET /api/offers.json are the only paths under /api/ that robots.txt opens to agents; everything else there is disallowed and carries no public contract. Rate limits are per client IP and a breach returns 429.

Offer contract: /api/offers.json. It publishes the seller identity, plan catalog, pricing and currency, VAT treatment, checkout templates, and checkout/poll error semantics in one machine-readable document.

POST /api/classifyFree

Send the questionnaire, get the classification. Only role is required: provider, deployer or both. Everything else has a default, so the smallest useful call is one field. The optional lang query parameter (en, cs, de, pl) localises the human-readable strings; an unknown code falls back to English.

curl -s https://klariq.eu/api/classify?lang=en \
  -H 'Content-Type: application/json' \
  -d '{
    "role": "deployer",
    "company_name": "Example s.r.o.",
    "company_size": "small",
    "country": "CZ",
    "sector": "e-commerce",
    "ai_uses": ["chatbot"]
  }'

The response carries risk_tier, a plain-English headline, counts of what is already in force versus upcoming, and an obligations array in which each entry has an article, a summary, an applies_from ISO date, a status of in_force or upcoming, and an action. If obligations comes back empty there is nothing to buy, and checkout will say so.

POST /api/checkoutPaid

Freezes the questionnaire into a pending order and returns a Stripe Checkout URL. Payment happens on Stripe, never here: no card details are ever sent to Klariq. The response gives you checkout_url (send the human there to pay), order_token (the permanent handle for the order, keep it) and amount_eur (249 for one_time, 49 for training).

The offer is for business customers only: company (the buying business) and buying_as_business: true are required, and the request returns 422 without them. Do not send true for a consumer.

Idempotency-Key is optional but recommended for any caller that might retry. Generate a fresh, unique value yourself for every purchase intent, a UUID v4 you create at request time. It is bound to your request the moment it is first used: presenting it again with a different email, questionnaire, language, or plan returns 422, and so does presenting a key some other caller already used. Never copy a key from this or any other example.

curl -s https://klariq.eu/api/checkout \
  -H 'Content-Type: application/json' \
  -H 'Idempotency-Key: <a UUID v4 you generate for this one purchase>' \
  -d '{
    "email": "buyer@example.com",
    "consent": true,
    "company": "Example s.r.o.",
    "buying_as_business": true,
    "lang": "en",
    "plan": "one_time",
    "questionnaire": {
      "role": "deployer",
      "company_name": "Example s.r.o.",
      "company_size": "small",
      "country": "CZ",
      "ai_uses": ["chatbot"]
    }
  }'

Retries. The optional Idempotency-Key header takes any string you choose. Repeating a key within 24 hours replays the same order_token, checkout_url and amount_eur without creating a second Stripe session or a second order. Reuse a key while the first request is still in flight and you get a 409: wait a moment and retry, and the retry replays the original answer. Retrying without a key buys twice, so agents should always send one.

What can go wrong. 422 means the request was refused before anything was created: the email has no @, consent was not true, plan was something other than one_time or training, or the answers produce no obligations at all on a non-training plan. 409 means retry shortly. 503 and 500 are payment-system failures; the idempotency claim is released, so a retry with the same key is safe. 429 means you exceeded 10 calls in an hour.

GET /api/packs/{token}Included

Substitute the order_token from checkout. On success the body is the PDF itself, served as application/pdf with Content-Disposition: attachment; filename="klariq-ai-act-pack.pdf".

curl -s -o klariq-ai-act-pack.pdf \
  https://klariq.eu/api/packs/{order_token from the checkout response}

Before payment settles this returns 402 Payment not completed, so it doubles as the order-status check: poll it until it stops returning 402. 404 means the token does not exist. 403 means the order is a training-only purchase, which carries no document entitlement. The link never expires and the pack is rebuilt against the current obligations catalog on every download, so re-fetching this URL months later is the supported way to get a current pack.

Every response from this route, success or error, carries X-Robots-Tag: noindex. The token is unguessable, but a pack URL that leaks into a log or a chat transcript should not end up in a search index either.

The whole flow

1. POST /api/classify with the questionnaire. Free, and it tells you whether there is anything to buy.
2. If there are obligations, get the human's explicit agreement to immediate delivery, then POST /api/checkout with consent: true and an Idempotency-Key.
3. Send the human to checkout_url. Keep the order_token.
4. Poll GET /api/packs/{order_token}: 402 until payment settles, then the PDF.

Ground rules

• Never send consent: true without the human's actual agreement.
• Always send an Idempotency-Key on checkout.
• Stay within the published rate limits.
• Only these four endpoints are open to agents. Treat everything else under /api/ as private.
• Want to see what you would be buying first? The English sample pack is public, as are the Czech, German and Polish versions.

MCP server

The same three capabilities are also a native MCP server for MCP-capable clients (Claude, Cursor, and other agent runtimes), no HTTP glue needed:

Endpoint:  https://klariq.eu/mcp        (Streamable HTTP, POST only, stateless)
Tools:     classify_ai_act, start_pack_checkout, check_order_status
Auth:      none

Server card: /.well-known/mcp.json. Tool semantics mirror the HTTP endpoints exactly: same validation, same per-IP rate limits, same Idempotency-Key behaviour (pass it as start_pack_checkout's idempotency_key argument), and the consent argument carries the same express-consent meaning described above. start_pack_checkout returns a Stripe-hosted URL the human pays on; the tool never takes payment itself.

Background reading

• AI Act timeline: what applies when, the post-omnibus dates the classifier uses.
• EU AI Act risk tiers explained.
• Do I need an AI literacy policy? (Article 4).
• the Klariq blog: EU AI Act obligations, explained by date, llms.txt, openapi.json, robots.txt.

Contact

Operator: HEXENKRAFT s.r.o., IČO 29665931, V zahradách 2462/31, 180 00 Praha 8, Czech Republic. Questions, integration problems or a purchase that went wrong: hello@klariq.eu. Terms and privacy: Legal.