iPAS Bridge API
Prove a real human approved a specific backend action, and get a signed receipt you verify before executing. Zero accounts, zero identity. Three calls.
1 · Lock the payload
POST /api/v1/bridge/payload/lock
Your backend hashes the action it is about to run and locks it. Returns the Hearts tap sequence the user must complete.
Request
Authorization: Bearer <api_key>
Content-Type: application/json
{
"action_id": "act_8f9a01b2",
"payload_hash": "<sha256 hex of the exact payload>",
"callback_url": "https://yourapp.com/hooks/inate",
"ttl_seconds": 60
}Response
{
"lock_id": "lock_9901aef",
"status": "LOCKED",
"hearts": { "sequence": "…", "tolerance": 0.35, "taps_required": 3 },
"expires_at": 1788514620
}2 · Human presence and receipt
POST /api/v1/bridge/verify
On your page, the user completes the Hearts sequence returned by the lock call. Send the three tap timestamps in milliseconds. INATE checks the sequence and returns a signed receipt.
Request
{
"lock_id": "lock_9901aef",
"hearts": [0, 3020, 9040]
}Response
{
"iva_token": "iva_tk_771a8291b",
"signed_receipt": { "payload": { ... }, "signature": "...", "alg": "Ed25519" },
"payload_hash": "<same hash>"
}The receipt is also POSTed to your callback_url (HMAC-signed) if set. Capture the three tap timestamps in the browser and send them as hearts.
3 · Validate before executing
Preferred: verify the receipt offline, no round-trip. Fetch the key once from GET /api/v1/public-key, then check the Ed25519 signature, that payload_hash matches what you locked, and that presence == "verified".
POST /api/v1/bridge/execute
Convenience endpoint if you would rather INATE check the receipt for you.
Request
{
"signed_receipt": { ... },
"payload_hash": "<hash>"
}Response
{ "verified": true, "status": "EXECUTION_AUTHORIZED" }Public receipt validation
GET /api/v1/public-key
The Ed25519 public key to verify any receipt offline.
POST /api/v1/receipts/verify
Paste any receipt, get { valid, payload }. No auth. Human-friendly page at /verify-receipt.