Implementation note: This page describes the TumiTrust reference implementation API. For the vendor-neutral Trust Lookup API specification, see RFC-004 Trust Lookup API.
Trust Platform API Reference
The authoritative machine-readable API specification for the TumiTrust reference implementation is served live:
| Surface | URL |
|---|---|
| Swagger UI | tumitrust.com/api/docs/ |
| ReDoc | tumitrust.com/api/redoc/ |
What to integrate (by job)
| Job | Auth | Canonical surface | Guide |
|---|---|---|---|
| Consume trust reports | X-API-Key (institution) | Directory → POST /api/v1/trust-reports/reports/generate/ → poll | Trust Platform API |
| Produce events (LOS / VAS) | HMAC X-Partner-Signature | POST /api/v1/partner/webhooks/{partner_id}/ | Connector configuration |
| Integrator fan-out | Integrator HMAC + X-Client-Partner-Id | Same webhook URL on the integrator id | Integrator guide |
| Embed portable trust card | Public iframe | /embed/v1/{partner_id}/{context_id}/{entity_id}/ | Connector configuration § Embeds |
| Embed screening | Partner API key → token | POST …/partner/embed/screening/{id}/token/ then iframe | Same § |
| Receive trust-signals | Verify X-Webhook-Signature | Register with Bearer JWT under /api/v1/trust-signals/webhooks/ | Trust Platform API § Webhooks |
Integration guide
Golden path for report consumers: Trust Platform API (directory → generate → poll → inbound webhooks).
PTI abstract API
The vendor-neutral abstract API (Trust Lookup, Exchange, Registry) is defined in the Reference API Specification and RFC-004.
Generate local reference
cd docs && npm run gen-api-docs
Generated endpoint pages are produced from tumitrust/api/openapi.yaml. Some endpoints with complex descriptions may require manual MDX fixes before inclusion in the static docs build.