Create a short-lived hosted Auth challenge after trusted issuer support and the client are configured. redirectUri must exactly match the client's server-side allowlist. Redirect only to the loginUrl returned by this endpoint.

Request Body

{
  "clientId": "hemsted_prod",
  "redirectUri": "https://hemsted.se/auth/callback",
  "scope": ["identity"],
  "state": "opaque-csrf-state"
}

Related endpoints

GET /api/v1/auth/challenge/:id, POST /api/v1/auth/prove, POST /api/v1/auth/verify, and GET /api/v1/auth/userinfo.

Get a challenge nonce and difficulty for claim proof-of-work. Challenges are single-use and expire server-side.

Response

{
  "challenge": "a1b2c3d4e5f6...",
  "difficulty": 16,
  "expires": "2026-05-19T12:15:00.000Z"
}

Submit a signed hash for timestamping.

Request Body

{
  "hash": "sha256-hex-of-content",
  "signature": "ed25519-signature-hex",
  "pubkey": "ed25519-public-key-hex",
  "pow": {
    "challenge": "challenge-from-/challenge",
    "nonce": "nonce-that-meets-difficulty"
  },
  "filename": "optional-display-name.pdf",
  "notify_email": "[email protected]",
  "notify_webhook": "https://your.app/hooks/otrust",
  "notify_webhook_secret": "optional-hmac-secret"
}

notify_email triggers a one-time Bitcoin confirmation email (stored separately, deleted after send). notify_webhook must be HTTPS; OTRUST POSTs once on confirm with optional X-OTRUST-Signature HMAC. See webhook docs.

Response

{
  "status": "ok",
  "timestamp": "2026-05-19T12:00:00.000Z",
  "receipt_id": "ot_abc123xyz",
  "blockchain_status": "submitted",
  "ots_proof": true
}

Submit up to 100 signed hashes with one proof-of-work challenge.

Request Body

{
  "pow": { "challenge": "...", "nonce": "..." },
  "claims": [
    {
      "hash": "sha256-hex",
      "signature": "ed25519-signature-hex",
      "pubkey": "ed25519-public-key-hex"
    }
  ],
  "notify_email": "[email protected]",
  "notify_webhook": "https://your.app/hooks/otrust"
}

One notify_email / notify_webhook applies to all newly created receipts in the batch.

Check whether a SHA-256 hash has timestamp claims in OTRUST.

Request Body

{
  "hash": "sha256-hex-of-content"
}

Response

{
  "status": "found",
  "hash": "sha256-hex",
  "claims": [
    {
      "receipt_id": "ot_abc123xyz",
      "pubkey": "ed25519-public-key-hex",
      "timestamp": "2026-05-19T12:00:00.000Z",
      "blockchain_confirmed": false,
      "proof_url": "/proof/ot_abc123xyz"
    }
  ]
}

Verify up to 100 hashes in one request.

Request Body

{
  "hashes": ["sha256-hex-1", "sha256-hex-2"]
}

Response

{
  "status": "ok",
  "results": [
    { "hash": "...", "status": "found", "claims": [] },
    { "hash": "...", "status": "not_found" }
  ]
}

Public transparency metrics: records, anchored claims, activity counters, latest Bitcoin block. See also Trust Log.

Compact stats for embed widgets (/embed). Cached 5 minutes.

{
  "service": "OTRUST",
  "anchored_records": 1234,
  "latest_block": 912345,
  "updated_at": "2026-07-04T12:00:00.000Z"
}

Browser-friendly lookup for a SHA-256 hash. Prefer POST /verify when you want to keep hashes out of URLs and logs.

Response

{
  "status": "found",
  "claims": []
}

Removed. Always returns 410 Gone with error: "local_history_only". Store receipt IDs client-side when you create timestamps.

Return a human-readable timestamp record page by default. Add ?format=json for metadata or ?format=ots to download the raw OpenTimestamps receipt.

Response

{
  "status": "pending",
  "receipt_id": "ot_abc123xyz",
  "hash": "sha256-hex",
  "download_url": "/proof/ot_abc123xyz?format=ots"
}

Verify that an Ed25519 signature matches a hash and public key.

Request Body

{
  "hash": "sha256-hex-of-content",
  "signature": "ed25519-signature-hex",
  "pubkey": "ed25519-public-key-hex"
}

Verify a SHA-256 hash against a base64 OpenTimestamps receipt payload.

Request Body

{
  "hash": "sha256-hex-of-content",
  "ots_proof": "base64-encoded-ots-file"
}