Authentication and key security
All API requests must be authenticated with a valid API key or token issued to your account. You are responsible for keeping your API credentials secure. Do not embed production API keys in client-side code, public repositories, or any environment accessible to unauthorized parties. If a key is compromised, revoke it immediately through the operator console and notify Veritan at security@provenanceverified.org. Veritan is not liable for unauthorized use of an API key that occurred through your failure to protect it.
Permitted uses
You may use the API to: verify the authenticity and current lifecycle state of a specific PROVENANCE VERIFIED™ credential by public ID; look up registry projections for public records; receive webhook events for your account's credential lifecycle changes; integrate the MCP tool contract into AI-assisted verification workflows; and build your own applications and integrations for your customers, provided those integrations accurately represent the scope and limitations of PV credentials.
Prohibited uses
You may not: (a) scrape, bulk-download, or index the registry or verification endpoints for commercial resale or competitive intelligence; (b) use the API to represent or imply a certification outcome that differs from the authoritative registry response; (c) automate evidence submission or credential issuance outside the documented submission workflow; (d) share API keys across multiple unrelated organizations or customers; (e) reverse engineer, decompile, or attempt to extract source code from the API or platform; (f) attempt to identify, enumerate, or reconstruct records that you have not been authorized to access; or (g) use the API in any way that violates applicable law.
Rate limits and availability
The API operates under rate limits published in the API documentation. Veritan reserves the right to adjust rate limits with reasonable notice. Veritan does not guarantee continuous availability of API endpoints, though it uses commercially reasonable efforts to maintain uptime. Enterprise customers may negotiate specific SLA terms. Test Mode endpoints are clearly separated from production endpoints; test responses are non-authoritative and must not be presented as production outcomes.
Webhook delivery and security
Webhook payloads are signed. Verify the signature of every incoming webhook before processing the body. Do not rely on IP address filtering alone for webhook security. Veritan will retry failed deliveries according to the schedule published in the documentation. Manual replay is available for authorized operators and requires an explicit reason. Do not use webhook delivery infrastructure for any purpose other than receiving credential lifecycle events for your authorized records.
Liability limitation
Veritan's liability for API failures, incorrect responses, or service unavailability is limited as described in the main Terms of Use. No API response should be treated as a legal determination, appraisal, or guarantee of value. Applications built on the API must accurately communicate the scope and limitations of PV credentials to their end users.