API reference

All endpoints are authenticated with an API key (Authorization: Bearer et_…) over HTTPS. This page covers the contract you integrate against; the full endpoint schema — parameters and request/response shapes — is available to customers on request via support.

Authentication

Platform-to-platform calls use an API key (et_…), created in the dashboard and shown once. Dashboard sessions use a separate JWT — never send a dashboard JWT on server-side API calls. Keys can be rotated and revoked; revocation is immediate.

Verification sessions

POST /v1/verifications/sessions creates a human or agent session; /start initiates the provider flow for human sessions. These are metered actions and require an active subscription — see Errors & rate limits.

Credentials

Issue (POST /v1/credentials/issue/{session_id}), verify (POST /v1/credentials/verify), revoke, list, and display a badge. Verification is server-authoritative; offline signature checks use the public JWKS. Cross-org verification requires an active, consented credential share.

Webhooks

Subscribe at POST /v1/webhooks/subscriptions with a URL and an events list. Every delivery is HMAC-SHA256 signed (X-EniyanTrust-Signature) — verify it before processing. The subscribable events are:

session.verified
session.failed
credential.issued
credential.revoked
credential.requires_reverification
credential.expiring
operator.reattested
operator.deactivated
agent.jit_waked

Next: Errors & rate limits.