Client API.

The integration API for upstream client systems. Open a case with your client-signed lifecycle events, follow it to sealed, and verify the record on a public endpoint. Every client event is verified on receipt — canonical hash and ed25519 signature — and linked as a precedent.

auth: x-api-key header · authorization: bearer·openapi 3.0

01 / endpoints

Six endpoints. Three authenticated, three public.

POST /client/cases Open a case. Submit the artifact, domain context, and client-signed upstream events; on success the case appears in the approver queue. due_at is required — every case carries an explicit approval SLA.

GET /client/cases/{id} Case status: pending with quorum progress, sealed with ledger_uuid, outcome and verify_url, or cancelled when the case expired.

POST /client/outcome Record what the client system did with the sealed decision — a client-signed outcome.executed event linked to the record, so an auditor sees not just what was approved but what was executed.

GET /verify/{uuid} Public. The decoded record and the result of every cryptographic check — claim hash, webauthn user signature, ed25519 trust signature, rekor set / inclusion / checkpoint, rfc 3161 timestamp.

GET /verify/{uuid}/attestation Public. The pii-free attestation (.sspa): record, anchors, rfc 3161 token and tsa ca in one zip. Verifiable offline.

GET /trust-key The ed25519 trust public key (pem). Supply it to the verifier out-of-band as the root of trust — a bundle never carries its own trust key.

02 / open a case

One request opens the case. The response names its precedents.

POST /client/cases

{
  "domain": "finance",
  "topic": "Vendor wire",
  "party": "ACME Supplies",
  "due_at": "2026-12-31T17:00:00Z",
  "artifact_b64": "UGF5IEFDTUUgMTIsNzUwIFVTRA==",
  "context": {
    "transaction_id": "TXN-1",
    "amount_usd": 12750,
    "account_id": "ACC-1"
  },
  "quorum": {
    "dsl": "Senior Credit Officer*2, Compliance",
    "mode": "parallelRoles",
    "workflow": { "type": "ratify" }
  },
  "client_events": [
    {
      "claim": { "type": "ai.inference.completed", "tenant": { "id": "acme-bank" } },
      "claim_canonical_hash": { "alg": "sha256", "value": "0c0aefa439f0..." },
      "signature": { "alg": "ed25519", "value": "MEUCIQ...", "public_key": "q1WrCN..." }
    }
  ]
}

201 created

{
  "submission_id": "d3057aae793ecc4e...",
  "tenant": "acme-bank",
  "precedents": [
    { "type": "policy.committed",       "hash": "94b54bd4f73d..." },
    { "type": "ai.inference.completed", "hash": "0c0aefa439f0..." },
    { "type": "guardrail.evaluated",    "hash": "8b3345c3c9e1..." }
  ],
  "quorum": { "required": 3, "collected": 0 },
  "approver_url": "https://app.sovereign.example/approver",
  "status_url": "/client/cases/d3057aae793ecc4e..."
}

03 / approval policies

One approver by default. A quorum when the policy demands it.

Composition is a one-line dsl — roles with counts, or named users. The workflow is ratify (co-sign one decision) or independent (vote or veto). The required count is derived from the slots; there is no threshold to misconfigure. Omit quorum for a single approver.

A webhook you register at create time fires once, when the decision seals. You author the payload; delivery retries three times and the attempt count lands in case status.

quorum

{
  "dsl": "Senior Credit Officer*2, Compliance",
  "mode": "parallelRoles",
  "workflow": { "type": "ratify" },
  "sla": {
    "approval_duration": "PT24H",
    "expire_by": "2026-07-01T00:00:00Z"
  }
}

// named users instead of roles:
// "dsl": "@jdoe, @bofficer"
// independent vote / veto:
// "workflow": { "type": "independent", "approval_mode": "vote" }

04 / verification

The verify endpoint returns every check, not a verdict.

Per-check booleans over the decoded record. The endpoint is public; raw domain context is only included for authenticated internal reviewers. For verification that trusts no server at all, download the attestation and use the offline verifier in the SDKs.

GET /verify/{uuid}

{
  "status": "verified",
  "ledger_uuid": "0000000075bcd156...",
  "user_signature_valid": true,
  "trust_signature_valid": true,
  "quorum": { "required": 3, "collected": 3, "met": true },
  "rekor_set_valid": true,
  "rekor_inclusion_valid": true,
  "rekor_checkpoint_valid": true,
  "tsa_valid": true,
  "tsa_time": "2026-06-15T11:02:44Z"
}