Docs

HTTPS gateway API

Use a trusted loopback service or an authenticated HTTPS gateway that authorizes the caller to use the chosen identifier. A key identifier alone grants no tenant isolation.

POST /v1/sign

{ "hash": "<SHA-256 hex digest>", "keyId": "release-ledger" }

{ "signature": "IRON3:<base64(kid1:ctr1:sig1|kid2:ctr2:sig2)>",
  "quorum": "2/3",
  "signers": [{ "kid": "...", "ctr": 42, "sig": "..." }],
  "missing": ["<kid>"] }

Fewer than two voters: 503 {"error":"QUORUM_NOT_MET","have":1,"need":2}.

POST /v1/verify

{ "data": "<the same SHA-256 hex digest>", "keyId": "release-ledger", "signature": "IRON3:..." }

Answers {"valid": true} when enough voters confirm. A receipt naming an unknown voter answers {"valid": false, "reason": "UNKNOWN_KID"}.

Hashing

The SDKs hash raw message bytes with SHA-256. If you call the API directly, send the digest. Passing the text of an existing digest to an SDK hashes it again.

Other endpoints

GET /v1/health and GET /v1/kill-switch report the proxy state.