Developers · Powstik

Quickstart

cURL

# No key needed. Is this seal valid?
curl https://powstik.com/api/v1/seals/<seal-id>

# The signed head of the public log
curl https://powstik.com/api/v1/log/sth

# With a key: 10x the rate limit, and capability search
curl -H "Authorization: Bearer pwk_xxxxxxxx_…" "https://powstik.com/api/v1/capabilities/search?class=V1&limit=10"

TypeScript

const base = "https://powstik.com";

const seal = await fetch(`${base}/api/v1/seals/${id}`).then((r) => r.json());
if (seal.valid) console.log("signature checks out", seal.key_id);

// Respect the limit: on 429, wait Retry-After seconds.
const res = await fetch(`${base}/api/v1/log/sth`);
if (res.status === 429) await new Promise((r) => setTimeout(r, Number(res.headers.get("retry-after")) * 1000));

MCP (Claude, or any MCP client)

{
  "mcpServers": {
    "powstik": {
      "url": "https://powstik.com/api/mcp",
      "headers": { "Authorization": "Bearer pwk_xxxxxxxx_…" }   // optional: needed only for search_capabilities
    }
  }
}

The MCP server is read-only with three tools: verify_seal, get_credential and search_capabilities (needs a key). It follows the same limits and the same privacy rules as the API.

Run it live

These buttons call the real API from your browser.

Seal id

There is no public seal of an adult to pre-fill yet, so paste one: every verified proof page shows its seal id.

Reference

Every endpoint is GET, returns JSON, allows any origin (CORS) and may be cached by you for a minute. The full description is the OpenAPI 3.1 document, generated from the same schemas the server checks requests with.

Endpoints
Endpoint	What it does	Key
`GET /api/v1/seals/{id}`	A Proof Seal and whether it is valid	No
`GET /api/v1/credentials/{sealId}`	The seal as a W3C Verifiable Credential (Open Badges 3.0)	No
`GET /api/v1/log/sth`	The latest signed tree head of the public log	No
`GET /api/v1/log/inclusion`seal*, tree_size	Proof that a seal is in the log	No
`GET /api/v1/log/consistency`first, second	Proof that the log only ever grew	No
`GET /api/v1/capabilities/search`outcome, class, verified_since, limit, before	Verified capabilities of adults who chose to be found	Needs capabilities:search
`POST /api/mcp`	The remote MCP server (Streamable HTTP, read-only)	Only for search

* required. A credential is served as application/vc. Anything that is missing, or that you may not see, answers the same 404.

Rate limits

60 requests a minute without a key, counted per address.
600 requests a minute with a key.
Over the limit you get 429 and a Retry-After header (seconds). Every answer carries X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset.
We keep a per-minute count only. We do not keep your address, and not what you asked.

What the API never returns

Anything about a person under 18, or whose age is unknown, beyond that a seal exists and is valid.
Email addresses, phone numbers, or any way to contact a person.
AI review scores or traces. They are advisory feedback, not part of the record.
Private proofs and clinical (LONGEVITY) proofs.
Anyone who has not turned on "Let employers find me by my verified skills" (search only).
Raw IP addresses or the content of your requests (we store per-minute counts only).

How we check work is explained in plain English on the protocol page.