Current system state

The platform is in PRODUCTION_DATA state: determination and evidence records are live, the machine trust endpoint serves real data, and reliance receipts are durable. Credential issuance authority is NOT_AUTHORIZED — issuance_authorized=false, signing_keys=0. No authoritative credential has been issued. Do not infer an issued credential from any API response.

1. Resolve machine trust

Public browser access: GET /api/v1/trust/{publicId}/human — no API key required; returns the identical canonical MachineTrustResponse via server-side proxy. Machine API access: GET /api/v1/trust/{publicId}/machine — requires Authorization: Bearer <pv_live_xxxx> with trust:read scope (or x-pv-internal-token for operator use). publicId is a DET-V1-* determination identifier. Both endpoints return MachineTrustResponse (schema pv.machine-trust.v1) including tier, claims, evidence, determination, freshness, authority, lifecycle, integrity, trust_state_digest, policy, engine, purchase, and prohibited_inferences.

2. Verify the authority boundary

Inspect authority in the response. authority.issuance_authorized is always false. authority.authoritative_state is NOT_AUTHORIZED — authority is BOUNDED to the evidence scope confirmed at determination time. credential.authoritative is always false. integrity.credential_signature.state is NOT_APPLICABLE. Never treat a 200 response as evidence of an issued or signed credential.

3. Create a reliance receipt

POST /api/v1/reliance-receipts with header x-pv-internal-token. Body: { tenant_id, organization, principal, subject_public_id, purpose_id, requested_action, claim_scope }. Never supply decision, trust_state_digest, tier, verdicts, or policy fields — these are prohibited and return 422. The server resolves canonical trust, evaluates actionability, and derives all decision fields. Response schema: pv-reliance-receipt-v1.

4. Check lifecycle and freshness

Inspect lifecycle.state (NOT_ISSUED, ACTIVE, SUSPENDED, REVOKED, EXPIRED, SUPERSEDED) and freshness.state (CURRENT, APPROACHING_STALE, STALE, EXPIRED). Do not treat a successful resolution as permission to rely without evaluating these fields and the disclosed claim scope.