English 
Tiếng ViệtTrusted SIC signing
Request, approval, WebAuthn, activation, routing, signing, ASiC and evidence.
Open →QUANTUMSAFE API CENTER
Understand the resource lifecycle. Then use the machine-readable contract.
The HTML documentation explains business purpose, state transitions, authorization, idempotency, callbacks, evidence and failure behavior. OpenAPI YAML/JSON and Postman are export formats—not the primary user journey.
01
API journeys
Authentication & trust
OAuth2/OIDC, mTLS, scopes, request signatures and tenant/RP identity.
Open →Resource lifecycle
Signing states, cancellation, expiry, retry and partial verification.
Open →Webhooks & events
Subscription, signature validation, delivery, replay and retry.
Open →Errors & operations
RFC 9457 problem details, rate limits, timeouts and retries.
Open →SDKs & samples
cURL, Java 21, C#, JavaScript and Python.
Open →Interactive explorer
Browser-local mock explorer with safe sample data.
Open →Specifications
OpenAPI YAML/JSON, Postman and legacy architecture skeleton.
Open →02
Common request controls
| Control | Contract |
|---|---|
| Authorization | OAuth2 scope and/or mTLS identity by operation |
| X-Correlation-Id | End-to-end diagnostic and evidence correlation |
| Idempotency-Key | Required for create/activation/signing/packaging operations |
| X-Request-Timestamp | Freshness control where signed requests are enabled |
| X-Request-Signature | Optional/required by channel policy |
| traceparent | Distributed tracing without exposing sensitive payloads |
| application/problem+json | RFC 9457-style error response |