Authentication
Production API keys: Authorization: Bearer pv_live_xxxx (SHA-256 hash stored in pv_api_keys). Scopes: trust:read, receipt:read, receipt:write, mcp:call, actionability:read, subscription:write. Rate limit: per-key RPM enforced server-side. Daily quota: per-key per-day checked against pv_api_key_usage. Internal qualification only: x-pv-internal-token header (operator use only — never for external consumers). API key provisioning: POST /api/v1/api-keys (operator-auth required). Human-readable verification: GET /api/v1/trust/:publicId/human (no API key required — public BFF proxy).
GET /api/v1/trust/:publicId/machine
Auth: Authorization: Bearer <api_key> with trust:read scope (or x-pv-internal-token for operator use). publicId must be a DET-V1-* or QUAL-V1-* determination identifier. Returns MachineTrustResponse (schema pv.machine-trust.v1). Key response fields: schema, trust_state_digest, subject (subject_id, physical_subject_id, identity_state), claims[], evidence[], determination (tier, determination_id, determination_digest, eligible, why_this_tier, why_not_higher), authority (issuance_authorized=false, authority_state=NOT_AUTHORIZED), lifecycle (state: NOT_ISSUED), freshness (state, as_of, valid_until), integrity, limitations[], prohibited_inferences[], allowed_claims[]. 401 if no valid API key. Use GET /api/v1/trust/:publicId/human for unauthenticated browser access.
POST /api/v1/reliance-receipts
Auth: x-pv-internal-token. Server-derived receipt — caller supplies consumer identity only. Required body fields: tenant_id, organization, principal, subject_public_id, purpose_id, requested_action, claim_scope. Prohibited: decision, trust_state_digest, policy_version, policy_digest, tier, verdicts, authority_state, lifecycle_state, determination_id. Prohibited fields return 422. The server resolves canonical trust, evaluates actionability, and persists atomically. Response always includes authority_state=ISSUANCE_NOT_AUTHORIZED and credential_state=NOT_ISSUED. Receipt schema: pv-reliance-receipt-v1. Status 201 on create, 200 on idempotent re-issue.
POST /api/v1/mcp
Auth: Authorization: Bearer <api_key> with mcp:call scope, or x-pv-internal-token for operator use. JSON-RPC 2.0 protocol. Method tools/list returns the full tool registry. Method tools/call invokes a named tool. The 8 callable tools: resolve_trust, resolve_subject, evaluate_actionability, create_reliance_receipt, get_reliance_receipt, compare_current, resolve_lifecycle, subscribe_trust_changes. Errors use standard JSON-RPC error codes (-32601 for unknown tools). API consumer: any key with mcp:call scope.
GET /api/v1/events
Auth: Bearer pk_live_xxxx with trust:read scope. Returns signed events for a determination. Each event includes sequence, previousEventHash, eventHash. Event chaining allows consumers to detect missing or reordered records.