AML Mate

Developers & AI agents

AML Mate for developers and AI agents

AML Mate publishes its AUSTRAC Tranche 2 knowledge base in machine-readable form. Every public URL below serves Markdown as well as HTML, and nothing here needs an API key or an account.

Machine-readable endpoints

All public, all unauthenticated, all cached for an hour.

/llms.txt

text/plain

Site index in the llms.txt format: what AML Mate is, when an agent should use it, every public page with a one-line summary, and the current Tranche 2 key facts.

/llms-full.txt

text/plain

The same overview followed by the complete text of every published article, so the whole knowledge base can be ingested in a single request.

/sitemap.xml

application/xml

Every indexable URL with last-modified dates. Regenerated daily so new articles appear without a deploy.

/robots.txt

text/plain

Crawl policy. AI and answer-engine crawlers are named and explicitly allowed on all public content.

Markdown content negotiation

Every public page serves Markdown from the same URL that serves HTML, following the acceptmarkdown.com convention. No separate .md URLs to discover.

Ask for Markdown

curl -H "Accept: text/markdown" https://amlmate.com.au/guide/austrac-tranche-2

Responses carry Content-Type: text/markdown; charset=utf-8 and Vary: Accept, Accept-Encoding, so a shared cache keeps the HTML and Markdown variants apart.

Blog posts return their original source

A post requested as Markdown returns the full article text with its front-matter summarised as a header — not a rendering of the page.

curl -H "Accept: text/markdown" https://amlmate.com.au/blog

Rules worth knowing

  • q-values are honoured. Markdown is served only when it outranks HTML, so a browser sending */*;q=0.8 still gets the page.
  • Unknown paths return 404 with a short Markdown body listing the sitemap, llms.txt and the section index, so a wrong guess is recoverable in one request.
  • Unsupported types return 406. Asking for a media type we cannot produce is rejected rather than answered with the wrong one.
  • The signed-in product is excluded. Negotiation covers public content only; nothing under /dashboard or /api is published.

Crawl policy

AI and answer-engine crawlers are welcome on all public content. These user agents are named explicitly in robots.txt:

GPTBotOAI-SearchBotChatGPT-UserClaudeBotanthropic-aiClaude-WebPerplexityBotGoogle-ExtendedApplebot-ExtendedCCBot

The signed-in product (/dashboard), the APIs (/api) and onboarding are disallowed for every crawler.

Free tools, no signup

These run without an account, so an agent can send a user straight to a result.

AML/CTF compliance check

Returns a 0-100 readiness score across the six obligations plus an action register citing AUSTRAC sources.

Open

Privacy Act readiness check

Checks which of the four privacy documents a reporting entity still needs.

Open

Compliance cost calculator

Estimates annual cost from client numbers and monthly identity checks.

Open

Partner API — identity verification

AML Mate runs a partner API that lets an integrator create an identity verification for their own end customer and receive the result. It supports a hosted document-and-selfie capture flow (with an embeddable script) and a synchronous Australian document data-match check.

Not self-serve — talk to us first

There is no open signup and no self-serve key provisioning: each integration is set up with us directly, and the endpoint reference and sandbox details are shared as part of that. If identity verification inside your own product is something you need, tell us what you are building and we will take it from there.

How the integration works

  • Authentication. A bearer API key sent as Authorization: Bearer <key>. Keys are issued per partner in a test or live mode and are stored only as a hash, so a key is shown once at issue time.
  • Versioning. The version is in the path: /api/partner/v1/….
  • Results. A verification is created against your own clientReference, and the outcome is readable by id. Terminal outcomes are verified or unverified.
  • Webhooks. When a hosted verification reaches a terminal state we POST a verification.completed event to your endpoint, signed with X-AMLMate-Signature — an HMAC-SHA256 of the raw request body in lowercase hex, using the shared secret issued with your key. Verify over the raw body before parsing, and dedupe on the verification id, because failed deliveries are retried with an identical payload.
Talk to us about an integration

Everything above this section is already open and needs no arrangement with us.