v1.0.0
Dashboard

REST Endpoints

The full set of public REST endpoints. Base URL: https://api.certilayer.net.

Endpoints

POST
/v1/ingest

Submit a raw behavioral event batch for scoring. Served by the ingestion gateway.

GET
/v1/session/:session_id

Fetch the stored HCS result and verdict for a previously scored session.

POST
/v1/demo/live-score

Compute a live HCS score from a real 34-dimensional feature vector — used by the public demo.

GET
/v1/org/usage

Current plan, sessions used this billing month, and the plan's session limit.

POST
/v1/support/tickets

Create a support ticket linked to your organization.

POST
/v1/leads

Capture a marketing lead — used by the pricing page and chat widget.

POST
/auth/register

Start account creation. Returns an OTP-required state, not a session.

POST
/auth/login

Start login. Returns an OTP-required state before issuing tokens.

POST
/auth/refresh

Rotate an access/refresh token pair.

POST
/auth/logout

Revoke the current refresh token.

GET
/health

Liveness check. Returns 200 if the service is up.

Ingesting a session

Most integrations never call /v1/ingest directly — the SDK handles batching and flush intervals for you. Direct calls are useful for server-side scoring or testing.

curl
curl -X POST https://api.certilayer.net/v1/ingest \
  -H "X-API-Key: certilayer_live_sk_xxx" \
  -H "Content-Type: application/json" \
  -d '{
    "session_id": "550e8400-e29b-41d4-a716-446655440000",
    "sdk_type": "web",
    "captured_at": "2026-08-07T12:00:00Z",
    "signals": [],
    "features": [0.0, 0.0]
  }'

Checking a result

curl
curl https://api.certilayer.net/v1/session/550e8400-e29b-41d4-a716-446655440000 \
  -H "X-API-Key: certilayer_live_sk_xxx"
Response
{
  "session_id": "550e8400-e29b-41d4-a716-446655440000",
  "hcs": 0.7424,
  "m3_score": 0.8991,
  "verdict": "human_verified"
}
ℹ️
All authenticated endpoints accept the key via the X-API-Key header. See Authentication for key types and where each one is safe to use.