aere-cloud-sdk/csharp/README.md

Aere.Cloud (.NET)

The official .NET client for the Aere Cloud API on Aere Network (chain 2800). No dependencies beyond the .NET base library (System.Net.Http, System.Text.Json, System.Security.Cryptography). Targets .NET 8 (LTS) and runs on later versions. Same routes and semantics as the JS, Python, Go and Java clients 1.6.0, including VerifyAsync, the Trust API.

JSON routes return the server's JSON as a JsonElement, so you bind it to the types you already use. The two routes that return files (the audit export and the check of a kept export) return typed results, with the SHA-256 computed locally from the bytes received.

Use

using Aere.Cloud;

using var c = new AereCloudClient(Environment.GetEnvironmentVariable("AERE_KEY")!);
var head = await c.DataHeadAsync();                        // {"block":...,"chainId":2800,...}
ulong n = await c.BlockNumberAsync();

// the Trust API: any AERE Proof Protocol (AIP-23) envelope -> VALID / INVALID / PARTIAL, with the levels checked
var verdict = await c.VerifyAsync(JsonDocument.Parse(File.ReadAllText("envelope.json")).RootElement); // chain: 2800 or 28001, default = the one the envelope declares
// pass the parsed JsonElement (key order kept): the verdict hashes the statement in its own key order

// quantum-readiness scan of a domain's TLS edge: free, no key is sent unless you attest the report
var report = await c.ReadinessAsync("example.com");

// the audit log of a day as a file; Verified is true only if the sha256 of the bytes you received equals the digest
AuditExport day = await c.AuditExportAsync("2026-09-24");

// a kept export still matches the day we hold, or the tombstone a deleted day left behind
KeptCheck k = await c.AuditVerifyKeptAsync("2026-05-01", keptBytes);

// verify a webhook delivery (constant-time HMAC-SHA256 over the exact bytes received)
bool ok = AereCloudClient.VerifyWebhook(rawBody, request.Headers["x-aere-signature"], secret);

Non-2xx answers are thrown as AereCloudException with Status, Body and Path (Status 0 = no answer; the message never carries your key). The client does not follow redirects: a 3xx is returned as an answer, so your API key is never sent to a host you did not name.

Tests

dotnet run --project Aere.Cloud.Tests -c Release     # offline: a recording HTTP handler, plus a real local server for the redirect test
bash control-negativ.sh                               # breaks ten guards in a copy of the source; each one's test must fail

Measured 2026-09-28 (WSL, .NET SDK 10.0.302): 9 tests green; the negative control 10 of 10 red, the untouched source green.