Mobile and device identity API

Verify mobile attestation and integrity, deliver app configuration, and manage passkeys, handoff, delegation, recovery, wallet state and offline capture.

These operations are called by your backend (typically the backend-for-frontend a mobile app authenticates to), never by the mobile app or the browser directly. Authenticate with an sk_ server API key: attestation, integrity and app configuration need read:device, passkeys need write:passkey, delegation, recovery, wallet and offline capture need write:identity, and handoff needs write:handoff. Most families are not enabled by default and answer the V1 endpoint not found 404 until they are enabled for your organisation. Base URL: https://collect.noxtica.com.

Credential: ApiKeyAuth. See Authentication.

Android Play Integrity attestation (mint / verify)

POST /v1/attest/android

Server-to-server relay for Android Play Integrity attestation. Your backend — typically the backend-for-frontend a mobile app authenticates to — calls this route with an sk_ key; the mobile app never calls it directly. Two actions are supported:

1. {"action":"mint"} returns a single-use nonce, valid for 300 seconds and bound to your organisation and domain, that the app binds a Play Integrity standard token to.
2. {"action":"verify","nonce":"...","token":"..."} (the older field name integrityToken is also accepted) claims the nonce exactly once, verifies the token with Google’s Play Integrity service, records the result and returns the verdict. A risk.flagged webhook may be sent to subscribed endpoints.

{"action":"assert"} is iOS-only and is refused on this route with the GatedNotFound 404. When verification with Google cannot complete, the verifier fails closed to verificationLevel: "unverified": the result is stored but no verification credit is implied, and an unverified result is never silently upgraded.

Authentication: Bearer token (ApiKeyAuth), scope read:device.

Request body

Content type application/json, required.

Responses

Response headers

Response fields (200, application/json)

Response example (200)

{
  "ok": true,
  "platform": "android",
  "nonce": "nonce_5f3a8c1e2d4b6f709182a3b4c5d6e7f8",
  "ttlSeconds": 3600,
  "verdict": "pass",
  "verificationLevel": "verified",
  "attestationId": "3fa85f64-5717-4562-b3fc-2c963f66afa6"
}

Example request

curl

curl -X POST "https://collect.noxtica.com/v1/attest/android" \
  -H "Authorization: Bearer $NOXTICA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "action": "mint",
  "domain_id": "dom_3f2a8c91d6e5f470",
  "nonce": "nonce_5f3a8c1e2d4b6f709182a3b4c5d6e7f8",
  "token": "tok_9f2a1c3e5d7b4a6f8091c2d3e4f5a6b7"
}'

Node.js (global fetch, Node 18 or later)

const response = await fetch('https://collect.noxtica.com/v1/attest/android', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.NOXTICA_API_KEY}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    action: 'mint',
    domain_id: 'dom_3f2a8c91d6e5f470',
    nonce: 'nonce_5f3a8c1e2d4b6f709182a3b4c5d6e7f8',
    token: 'tok_9f2a1c3e5d7b4a6f8091c2d3e4f5a6b7',
  }),
});
console.log(response.status, await response.text());

Python (standard library)

import json
import os
import urllib.request

request = urllib.request.Request(
    "https://collect.noxtica.com/v1/attest/android",
    data=json.dumps({
        "action": "mint",
        "domain_id": "dom_3f2a8c91d6e5f470",
        "nonce": "nonce_5f3a8c1e2d4b6f709182a3b4c5d6e7f8",
        "token": "tok_9f2a1c3e5d7b4a6f8091c2d3e4f5a6b7",
    }).encode(),
    headers={
        "Authorization": f"Bearer {os.environ['NOXTICA_API_KEY']}",
        "Content-Type": "application/json",
    },
    method="POST",
)
with urllib.request.urlopen(request) as response:
    print(response.status, response.read().decode())

iOS App Attest attestation (mint / verify / assert)

POST /v1/attest/ios

Server-to-server relay for iOS App Attest, with the same posture as POST /v1/attest/android: your backend calls it with an sk_ key and the app never does. Three actions are supported:

1. {"action":"mint"} returns a single-use nonce, valid for 300 seconds, that the app generates an App Attest key and attestation over.
2. {"action":"verify","nonce":"...","token":"..."} (the older field name attestationObject is also accepted) parses the attestation object, checks the nonce binding, records the result, may send a risk.flagged webhook and returns the verdict. Verification currently covers structure, rpIdHash and nonce binding (verificationLevel: "structure_only"); promotion to verified additionally requires certificate-chain validation against pinned Apple intermediate key material, which is available only when it is configured for the deployment.
3. {"action":"assert","nonce":"...","assertion":"...","keyId":"..."} is a destructive account-deletion possession proof, available only when it is enabled for your organisation (otherwise the GatedNotFound 404). It verifies an App Attest assertion against the stored enrollment binding for keyId, enforces a monotonic sign counter (replay defence) and on success returns the bound subjectId and the fixed actionScope. The nonce is consumed even when the assertion fails.

Authentication: Bearer token (ApiKeyAuth), scope read:device.

Request body

Content type application/json, required.

Responses

Response headers

Response fields (200, application/json)

Response example (200)

{
  "ok": true,
  "platform": "ios",
  "nonce": "nonce_5f3a8c1e2d4b6f709182a3b4c5d6e7f8",
  "ttlSeconds": 3600,
  "verdict": "pass",
  "verificationLevel": "verified",
  "attestationId": "3fa85f64-5717-4562-b3fc-2c963f66afa6"
}

Example request

curl

curl -X POST "https://collect.noxtica.com/v1/attest/ios" \
  -H "Authorization: Bearer $NOXTICA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "action": "mint",
  "domain_id": "dom_3f2a8c91d6e5f470",
  "nonce": "nonce_5f3a8c1e2d4b6f709182a3b4c5d6e7f8",
  "token": "tok_9f2a1c3e5d7b4a6f8091c2d3e4f5a6b7",
  "assertion": "example-assertion",
  "keyId": "example-keyId"
}'

Node.js (global fetch, Node 18 or later)

const response = await fetch('https://collect.noxtica.com/v1/attest/ios', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.NOXTICA_API_KEY}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    action: 'mint',
    domain_id: 'dom_3f2a8c91d6e5f470',
    nonce: 'nonce_5f3a8c1e2d4b6f709182a3b4c5d6e7f8',
    token: 'tok_9f2a1c3e5d7b4a6f8091c2d3e4f5a6b7',
    assertion: 'example-assertion',
    keyId: 'example-keyId',
  }),
});
console.log(response.status, await response.text());

Python (standard library)

import json
import os
import urllib.request

request = urllib.request.Request(
    "https://collect.noxtica.com/v1/attest/ios",
    data=json.dumps({
        "action": "mint",
        "domain_id": "dom_3f2a8c91d6e5f470",
        "nonce": "nonce_5f3a8c1e2d4b6f709182a3b4c5d6e7f8",
        "token": "tok_9f2a1c3e5d7b4a6f8091c2d3e4f5a6b7",
        "assertion": "example-assertion",
        "keyId": "example-keyId",
    }).encode(),
    headers={
        "Authorization": f"Bearer {os.environ['NOXTICA_API_KEY']}",
        "Content-Type": "application/json",
    },
    method="POST",
)
with urllib.request.urlopen(request) as response:
    print(response.status, response.read().decode())

Verify a CPU/GPU attestation proof

POST /v1/attest/verify

Returns a synchronous verdict for a one-off CPU/GPU proof-of-work attestation, driven by your backend on behalf of its web client outside the normal /client/submit flow. {"action":"verify","challengeId":"...","proof":{...}} redeems a challenge minted by POST /v1/attest/challenge.

Not enabled by default: when the capability is not enabled for your organisation this route does not answer 404: it fails open to a neutral HTTP 200. When the capability is not enabled, or on any internal fault, the response is {"ok":true,"featureEnabled":false,"tier":"unavailable","confidence":50,"anchored":false}. “No signal” is always a pass-through, never an outage.

Absence is not a penalty: a proof that reports no CPU/GPU capability scores neutral. Only a proof that is present but rejected (after a successful single-use nonce claim) is a failed signal, and every rejected proof collapses to the same public reason verification_rejected. The literal tier hardware is published only when publication of the hardware attestation level is enabled for your organisation; otherwise hardware and software are both reported as attested.

Authentication: Bearer token (ApiKeyAuth), scope read:device.

Request body

Content type application/json, required.

Responses

Response headers

Response fields (200, application/json)

Response example (200)

{
  "ok": true,
  "featureEnabled": true,
  "tier": "hardware",
  "confidence": 0,
  "anchored": true,
  "reasons": [
    "example-reasons"
  ],
  "verifiedAt": "2026-09-13T12:00:00.000Z"
}

Example request

curl

curl -X POST "https://collect.noxtica.com/v1/attest/verify" \
  -H "Authorization: Bearer $NOXTICA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "action": "verify",
  "domain_id": "dom_3f2a8c91d6e5f470",
  "kind": "gpu",
  "challengeId": "chal_3c9b2f7e4a3d4c8e",
  "proof": {}
}'

Node.js (global fetch, Node 18 or later)

const response = await fetch('https://collect.noxtica.com/v1/attest/verify', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.NOXTICA_API_KEY}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    action: 'verify',
    domain_id: 'dom_3f2a8c91d6e5f470',
    kind: 'gpu',
    challengeId: 'chal_3c9b2f7e4a3d4c8e',
    proof: {},
  }),
});
console.log(response.status, await response.text());

Python (standard library)

import json
import os
import urllib.request

request = urllib.request.Request(
    "https://collect.noxtica.com/v1/attest/verify",
    data=json.dumps({
        "action": "verify",
        "domain_id": "dom_3f2a8c91d6e5f470",
        "kind": "gpu",
        "challengeId": "chal_3c9b2f7e4a3d4c8e",
        "proof": {},
    }).encode(),
    headers={
        "Authorization": f"Bearer {os.environ['NOXTICA_API_KEY']}",
        "Content-Type": "application/json",
    },
    method="POST",
)
with urllib.request.urlopen(request) as response:
    print(response.status, response.read().decode())

Mint a CPU/GPU attestation challenge

POST /v1/attest/challenge

Mints a single-use, organisation- and domain-bound, origin-anchored challenge and returns the directive your client feeds to the attestation runtime. The URL path forces action: "challenge" whatever the body says. Redeem the returned challengeId at POST /v1/attest/verify.

The availability and fail-open posture are the same as for POST /v1/attest/verify: a missing Origin header, an authority fault or a missing integrity pin all collapse to {"ok":true,"featureEnabled":true,"challenge":null,"reason":"challenge_unavailable"} with HTTP 200, never a 5xx.

Authentication: Bearer token (ApiKeyAuth), scope read:device.

Request body

Content type application/json, optional.

Responses

Response headers

Response fields (200, application/json)

Response example (200)

{
  "ok": true,
  "featureEnabled": true,
  "reason": "challenge_unavailable",
  "challenge": {
    "challengeId": "chal_3c9b2f7e4a3d4c8e",
    "nonce": "nonce_5f3a8c1e2d4b6f709182a3b4c5d6e7f8",
    "loaderUrl": "https://example.com",
    "wasmUrl": "https://example.com",
    "wasmSha256": "example-wasmSha256",
    "seed": "seed-01",
    "level": 1,
    "rawEvidenceCommitmentVersion": 1,
    "expiresAt": 1768435200
  },
  "verifiedAt": "2026-09-13T12:00:00.000Z"
}

Example request

curl

curl -X POST "https://collect.noxtica.com/v1/attest/challenge" \
  -H "Authorization: Bearer $NOXTICA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "domain_id": "dom_3f2a8c91d6e5f470",
  "kind": "gpu"
}'

Node.js (global fetch, Node 18 or later)

const response = await fetch('https://collect.noxtica.com/v1/attest/challenge', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.NOXTICA_API_KEY}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    domain_id: 'dom_3f2a8c91d6e5f470',
    kind: 'gpu',
  }),
});
console.log(response.status, await response.text());

Python (standard library)

import json
import os
import urllib.request

request = urllib.request.Request(
    "https://collect.noxtica.com/v1/attest/challenge",
    data=json.dumps({
        "domain_id": "dom_3f2a8c91d6e5f470",
        "kind": "gpu",
    }).encode(),
    headers={
        "Authorization": f"Bearer {os.environ['NOXTICA_API_KEY']}",
        "Content-Type": "application/json",
    },
    method="POST",
)
with urllib.request.urlopen(request) as response:
    print(response.status, response.read().decode())

Combined web/webview integrity verdict

POST /v1/integrity/verify

Combines three existing signals into one integrity verdict for a web or webview session; it adds no new scoring path: (1) the CPU/GPU attestation verdict, from an optional challengeId / proof pair where absence is neutral, (2) the calibrated risk score over a caller-supplied signals payload, and (3) the virtualization-corroboration marker read from the score’s flags.

Not enabled by default. When the capability is not enabled for your organisation, or on any fault, the route fails open to a neutral HTTP 200 {"ok":true,"integrity":"unverified","signals":{"attestation":"unavailable","virtualization":"unavailable","score":"minimal"},"confidence":50}; it never answers 5xx or 404. The attestation label is masked exactly as on POST /v1/attest/verify.

Authentication: Bearer token (ApiKeyAuth), scope read:device.

Request body

Content type application/json, required.

Responses

Response headers

Response fields (200, application/json)

Response example (200)

{
  "ok": true,
  "featureEnabled": true,
  "integrity": "trusted",
  "signals": {
    "attestation": "hardware",
    "virtualization": "corroborated",
    "score": "example-score"
  },
  "confidence": 0,
  "reason": "user_requested",
  "verifiedAt": "2026-09-13T12:00:00.000Z"
}

Example request

curl

curl -X POST "https://collect.noxtica.com/v1/integrity/verify" \
  -H "Authorization: Bearer $NOXTICA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "domain_id": "dom_3f2a8c91d6e5f470",
  "kind": "gpu",
  "challengeId": "chal_3c9b2f7e4a3d4c8e",
  "proof": {},
  "signals": {}
}'

Node.js (global fetch, Node 18 or later)

const response = await fetch('https://collect.noxtica.com/v1/integrity/verify', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.NOXTICA_API_KEY}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    domain_id: 'dom_3f2a8c91d6e5f470',
    kind: 'gpu',
    challengeId: 'chal_3c9b2f7e4a3d4c8e',
    proof: {},
    signals: {},
  }),
});
console.log(response.status, await response.text());

Python (standard library)

import json
import os
import urllib.request

request = urllib.request.Request(
    "https://collect.noxtica.com/v1/integrity/verify",
    data=json.dumps({
        "domain_id": "dom_3f2a8c91d6e5f470",
        "kind": "gpu",
        "challengeId": "chal_3c9b2f7e4a3d4c8e",
        "proof": {},
        "signals": {},
    }).encode(),
    headers={
        "Authorization": f"Bearer {os.environ['NOXTICA_API_KEY']}",
        "Content-Type": "application/json",
    },
    method="POST",
)
with urllib.request.urlopen(request) as response:
    print(response.status, response.read().decode())

Forced-update and kill-switch decision for an app launch

POST /v1/app-config

Server-to-server call from your backend (for example the backend-for-frontend a mobile app authenticates to) that decides one launch outcome for a mobile app. Send platform, appVersion and, on Android, the client-asserted Play Integrity appRecognitionVerdict. The first rule that applies wins:

1. reason: "killed" — an emergency kill switch is active.
2. reason: "forced_update" — appVersion is below the minimum version configured for the platform. This is a forced-update nudge, not an anti-tamper control: a patched app can report any version.
3. reason: "app_not_recognized" — Android only, when appRecognitionVerdict is not PLAY_RECOGNIZED; a missing verdict counts as not recognised. This is advisory: the verdict is client-asserted and is not verified with Google, unlike /v1/attest/android. iOS is exempt.

Otherwise reason: "ok". Every decision is audited with coarse, non-personal facts. The request body is limited to 1024 bytes.

Authentication: Bearer token (ApiKeyAuth), scope read:device.

Request body

Content type application/json, required.

Responses

Response headers

Response fields (200, application/json)

Response example (200)

{
  "ok": true,
  "allowed": true,
  "reason": "ok",
  "minVersion": "example-minVersion"
}

Example request

curl

curl -X POST "https://collect.noxtica.com/v1/app-config" \
  -H "Authorization: Bearer $NOXTICA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "platform": "android",
  "appVersion": "example-appVersion",
  "appRecognitionVerdict": "example-appRecognitionVerdict"
}'

Node.js (global fetch, Node 18 or later)

const response = await fetch('https://collect.noxtica.com/v1/app-config', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.NOXTICA_API_KEY}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    platform: 'android',
    appVersion: 'example-appVersion',
    appRecognitionVerdict: 'example-appRecognitionVerdict',
  }),
});
console.log(response.status, await response.text());

Python (standard library)

import json
import os
import urllib.request

request = urllib.request.Request(
    "https://collect.noxtica.com/v1/app-config",
    data=json.dumps({
        "platform": "android",
        "appVersion": "example-appVersion",
        "appRecognitionVerdict": "example-appRecognitionVerdict",
    }).encode(),
    headers={
        "Authorization": f"Bearer {os.environ['NOXTICA_API_KEY']}",
        "Content-Type": "application/json",
    },
    method="POST",
)
with urllib.request.urlopen(request) as response:
    print(response.status, response.read().decode())

Mint a WebAuthn ceremony challenge

POST /v1/passkey/challenge

Server-to-server (sk_ key, scope write:passkey). Mints a single-use, time-limited WebAuthn ceremony challenge. You supply an opaque subject_id, the exact domain_id of one of your active domains and the ceremony purpose (register or assert). The subject’s existence is deliberately not checked at mint time. The domain must resolve to an active route of your organisation, and its origin is bound into the challenge, which prevents a later cross-domain ceremony.

Not enabled by default: when the passkey capability is not enabled for your organisation, every passkey endpoint answers the GatedNotFound 404.

Authentication: Bearer token (ApiKeyAuth), scope write:passkey.

Request body

Content type application/json, required.

Responses

Response headers

Response fields (200, application/json)

Variant variant 1

Variant variant 2

Response example (200)

{
  "ok": true,
  "challenge": "Y2hhbGxlbmdlLW5vbmNlLTAx",
  "purpose": "register",
  "ttlSeconds": 3600,
  "rp": {
    "id": "example-id",
    "origins": [
      "https://example.com"
    ]
  },
  "pubKeyCredParams": [
    {
      "type": "public-key",
      "alg": 1
    }
  ]
}

Example request

curl

curl -X POST "https://collect.noxtica.com/v1/passkey/challenge" \
  -H "Authorization: Bearer $NOXTICA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "subject_id": "subj_4821",
  "domain_id": "dom_3f2a8c91d6e5f470",
  "purpose": "register"
}'

Node.js (global fetch, Node 18 or later)

const response = await fetch('https://collect.noxtica.com/v1/passkey/challenge', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.NOXTICA_API_KEY}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    subject_id: 'subj_4821',
    domain_id: 'dom_3f2a8c91d6e5f470',
    purpose: 'register',
  }),
});
console.log(response.status, await response.text());

Python (standard library)

import json
import os
import urllib.request

request = urllib.request.Request(
    "https://collect.noxtica.com/v1/passkey/challenge",
    data=json.dumps({
        "subject_id": "subj_4821",
        "domain_id": "dom_3f2a8c91d6e5f470",
        "purpose": "register",
    }).encode(),
    headers={
        "Authorization": f"Bearer {os.environ['NOXTICA_API_KEY']}",
        "Content-Type": "application/json",
    },
    method="POST",
)
with urllib.request.urlopen(request) as response:
    print(response.status, response.read().decode())

Verify a WebAuthn attestation and register a passkey

POST /v1/passkey/register

Server-to-server (sk_ key, scope write:passkey). Verifies a WebAuthn attestation and registers the credential. In order: the register challenge is consumed (single use); the bound subject must have an active, verified device or KYC proof; the attestation is verified against only the exact active domain bound into the challenge; an optional authenticator (AAGUID) trust policy may reject the credential before storage when it runs in enforce mode; the credential is stored against the opaque subject_id, with no personal data.

Every ceremony or policy refusal returns the same closed reason-code catalogue at a uniform HTTP 200 {"ok":false}, except invalid_request and purpose_mismatch, which answer 400, so a status code never reveals whether a credential exists. Availability is the same as for POST /v1/passkey/challenge.

Authentication: Bearer token (ApiKeyAuth), scope write:passkey.

Request body

Content type application/json, required.

Responses

Response headers

Response fields (200, application/json)

Variant variant 1

Variant variant 2

Response example (200)

{
  "ok": true,
  "credentialId": "example-credentialId",
  "subjectId": "subj_4821"
}

Example request

curl

curl -X POST "https://collect.noxtica.com/v1/passkey/register" \
  -H "Authorization: Bearer $NOXTICA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "challenge": "Y2hhbGxlbmdlLW5vbmNlLTAx",
  "attestationObject": "example-attestationObject",
  "clientDataJSON": "example-clientDataJSON",
  "transports": [
    "example-transports"
  ]
}'

Node.js (global fetch, Node 18 or later)

const response = await fetch('https://collect.noxtica.com/v1/passkey/register', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.NOXTICA_API_KEY}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    challenge: 'Y2hhbGxlbmdlLW5vbmNlLTAx',
    attestationObject: 'example-attestationObject',
    clientDataJSON: 'example-clientDataJSON',
    transports: [
      'example-transports',
    ],
  }),
});
console.log(response.status, await response.text());

Python (standard library)

import json
import os
import urllib.request

request = urllib.request.Request(
    "https://collect.noxtica.com/v1/passkey/register",
    data=json.dumps({
        "challenge": "Y2hhbGxlbmdlLW5vbmNlLTAx",
        "attestationObject": "example-attestationObject",
        "clientDataJSON": "example-clientDataJSON",
        "transports": [
            "example-transports",
        ],
    }).encode(),
    headers={
        "Authorization": f"Bearer {os.environ['NOXTICA_API_KEY']}",
        "Content-Type": "application/json",
    },
    method="POST",
)
with urllib.request.urlopen(request) as response:
    print(response.status, response.read().decode())

Verify a WebAuthn assertion

POST /v1/passkey/assert

Server-to-server (sk_ key, scope write:passkey). Verifies a WebAuthn assertion against a stored credential. In order: the assert challenge is consumed (single use) and yields the bound subject_id; the active credential is looked up by credential id (an unknown id gives the closed credential_unknown); the credential must belong to the challenge’s subject (otherwise challenge_mismatch, so a challenge minted for subject A can never assert subject B’s credential); the signature is verified over authenticatorData || SHA-256(clientDataJSON) with the stored public key, against only the domain bound into the challenge; the signature counter must strictly advance (otherwise sign_count_regression, a replay defence). On success the counter is advanced and the bound subjectId is returned.

Every failure returns the same uniform HTTP 200 {"ok":false}; credential-level reasons are an integrator diagnostic, not an enumeration oracle, because this surface is intra-organisation and credential ids are high-entropy. Availability is the same as for POST /v1/passkey/challenge.

Authentication: Bearer token (ApiKeyAuth), scope write:passkey.

Request body

Content type application/json, required.

Responses

Response headers

Response fields (200, application/json)

Variant variant 1

Variant variant 2

Response example (200)

{
  "ok": true,
  "verified": true,
  "subjectId": "subj_4821"
}

Example request

curl

curl -X POST "https://collect.noxtica.com/v1/passkey/assert" \
  -H "Authorization: Bearer $NOXTICA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "challenge": "Y2hhbGxlbmdlLW5vbmNlLTAx",
  "credentialId": "example-credentialId",
  "authenticatorData": "example-authenticatorData",
  "clientDataJSON": "example-clientDataJSON",
  "signature": "MEUCIQDx1F2a3B4c5D6e7F8a9B0c1D2e3F4a5B6c7D8e9F0a1B2c3D4e5F6a7B8c"
}'

Node.js (global fetch, Node 18 or later)

const response = await fetch('https://collect.noxtica.com/v1/passkey/assert', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.NOXTICA_API_KEY}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    challenge: 'Y2hhbGxlbmdlLW5vbmNlLTAx',
    credentialId: 'example-credentialId',
    authenticatorData: 'example-authenticatorData',
    clientDataJSON: 'example-clientDataJSON',
    signature: 'MEUCIQDx1F2a3B4c5D6e7F8a9B0c1D2e3F4a5B6c7D8e9F0a1B2c3D4e5F6a7B8c',
  }),
});
console.log(response.status, await response.text());

Python (standard library)

import json
import os
import urllib.request

request = urllib.request.Request(
    "https://collect.noxtica.com/v1/passkey/assert",
    data=json.dumps({
        "challenge": "Y2hhbGxlbmdlLW5vbmNlLTAx",
        "credentialId": "example-credentialId",
        "authenticatorData": "example-authenticatorData",
        "clientDataJSON": "example-clientDataJSON",
        "signature": "MEUCIQDx1F2a3B4c5D6e7F8a9B0c1D2e3F4a5B6c7D8e9F0a1B2c3D4e5F6a7B8c",
    }).encode(),
    headers={
        "Authorization": f"Bearer {os.environ['NOXTICA_API_KEY']}",
        "Content-Type": "application/json",
    },
    method="POST",
)
with urllib.request.urlopen(request) as response:
    print(response.status, response.read().decode())

Mint a browser-to-app handoff claim

POST /v1/handoff/mint

Server-to-server (sk_ key, scope write:handoff): the caller is your own backend, never a browser or a mobile device. Mints a session-bound, single-use claim that hands a verified browser session to a native app. It returns two independent 256-bit secrets, stored only as hashes: exchangeCode, the only value meant for the QR code or deep link, and challenge, a separate binding secret that you convey through your own out-of-band channel and never embed in the QR code. Both are required together at POST /v1/handoff/consume. Minting again for the same sessionId atomically supersedes any pending claim for that session, which supports cross-device rescans.

Not enabled by default: when the capability is not enabled for your organisation both handoff endpoints answer the GatedNotFound 404.

Key scope availability. At the time of writing the write:handoff scope is not among the scopes that can be selected when creating a server API key in the Backoffice, so a key created there cannot call the handoff endpoints.

Authentication: Bearer token (ApiKeyAuth), scope write:handoff.

Request body

Content type application/json, required.

Responses

Response headers

Response fields (200, application/json)

Response example (200)

{
  "ok": true,
  "exchangeCode": "example-exchangeCode",
  "challenge": "Y2hhbGxlbmdlLW5vbmNlLTAx",
  "sessionId": "01J8Z3K7QN6R2S4T6V8W0X2Y4Z",
  "ttlSeconds": 3600,
  "expiresAt": 1768435200
}

Example request

curl

curl -X POST "https://collect.noxtica.com/v1/handoff/mint" \
  -H "Authorization: Bearer $NOXTICA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "sessionId": "01J8Z3K7QN6R2S4T6V8W0X2Y4Z"
}'

Node.js (global fetch, Node 18 or later)

const response = await fetch('https://collect.noxtica.com/v1/handoff/mint', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.NOXTICA_API_KEY}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    sessionId: '01J8Z3K7QN6R2S4T6V8W0X2Y4Z',
  }),
});
console.log(response.status, await response.text());

Python (standard library)

import json
import os
import urllib.request

request = urllib.request.Request(
    "https://collect.noxtica.com/v1/handoff/mint",
    data=json.dumps({
        "sessionId": "01J8Z3K7QN6R2S4T6V8W0X2Y4Z",
    }).encode(),
    headers={
        "Authorization": f"Bearer {os.environ['NOXTICA_API_KEY']}",
        "Content-Type": "application/json",
    },
    method="POST",
)
with urllib.request.urlopen(request) as response:
    print(response.status, response.read().decode())

Consume a browser-to-app handoff claim

POST /v1/handoff/consume

Server-to-server (sk_ key, scope write:handoff): called by your app’s own backend when it resolves the deep link, never by the mobile device. The caller must present all of sessionId, exchangeCode and challenge. An exact match on every bound field, a pending status and an unexpired claim are all required, and the claim is consumed atomically, so an incorrect attempt never burns the real claim.

Every mismatch — a replay, another organisation, another session, a swapped challenge or an expired claim — gives the same closed claim_invalid rejection at a uniform HTTP 200, never a 4xx, because revealing which field failed would expose the claim’s binding. Availability and the key-scope note are the same as for POST /v1/handoff/mint.

Authentication: Bearer token (ApiKeyAuth), scope write:handoff.

Request body

Content type application/json, required.

Responses

Response headers

Response fields (200, application/json)

Variant variant 1

Variant variant 2

Response example (200)

{
  "ok": true,
  "sessionId": "01J8Z3K7QN6R2S4T6V8W0X2Y4Z"
}

Example request

curl

curl -X POST "https://collect.noxtica.com/v1/handoff/consume" \
  -H "Authorization: Bearer $NOXTICA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "sessionId": "01J8Z3K7QN6R2S4T6V8W0X2Y4Z",
  "exchangeCode": "example-exchangeCode",
  "challenge": "Y2hhbGxlbmdlLW5vbmNlLTAx"
}'

Node.js (global fetch, Node 18 or later)

const response = await fetch('https://collect.noxtica.com/v1/handoff/consume', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.NOXTICA_API_KEY}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    sessionId: '01J8Z3K7QN6R2S4T6V8W0X2Y4Z',
    exchangeCode: 'example-exchangeCode',
    challenge: 'Y2hhbGxlbmdlLW5vbmNlLTAx',
  }),
});
console.log(response.status, await response.text());

Python (standard library)

import json
import os
import urllib.request

request = urllib.request.Request(
    "https://collect.noxtica.com/v1/handoff/consume",
    data=json.dumps({
        "sessionId": "01J8Z3K7QN6R2S4T6V8W0X2Y4Z",
        "exchangeCode": "example-exchangeCode",
        "challenge": "Y2hhbGxlbmdlLW5vbmNlLTAx",
    }).encode(),
    headers={
        "Authorization": f"Bearer {os.environ['NOXTICA_API_KEY']}",
        "Content-Type": "application/json",
    },
    method="POST",
)
with urllib.request.urlopen(request) as response:
    print(response.status, response.read().decode())

Create a subject-scoped device delegation

POST /v1/device-delegation/create

Creates a delegation of device authority for a subject. The delegation is born active, subject to a cap on active delegations per subject (device_delegation_limit_exceeded when the cap is reached). The organisation is always the authenticated one: a tenant id in the body is never used and is omitted from the response. Every id field must match ^[a-zA-Z0-9._:-]{1,128}$, except the server-generated delegation id, which is a UUID.

Not enabled by default: when the device-registry capability is not enabled for your organisation the route answers the GatedNotFound 404. The three delegation operations share one rate-limit bucket per API key.

Authentication: Bearer token (ApiKeyAuth), scope write:identity.

Request body

Content type application/json, required.

Responses

Response headers

Response fields (200, application/json)

Response example (200)

{
  "ok": true,
  "delegation": {
    "id": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
    "subjectId": "subj_4821",
    "delegatorId": "dev_7a2b9c4d1e6f3a8b",
    "delegateId": "dev_2b9c4d1e6f3a8b7a",
    "scope": "device_use",
    "status": "active",
    "evidenceRef": "obj-front",
    "expiresAt": 1768435200,
    "revokedAt": 1,
    "createdBy": "tenant_42",
    "createdAt": 1,
    "updatedAt": 1
  },
  "requestId": "req-test"
}

Example request

curl

curl -X POST "https://collect.noxtica.com/v1/device-delegation/create" \
  -H "Authorization: Bearer $NOXTICA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "subjectId": "subj_4821",
  "delegatorId": "dev_7a2b9c4d1e6f3a8b",
  "delegateId": "dev_2b9c4d1e6f3a8b7a",
  "scope": "device_use",
  "evidenceRef": "obj-front",
  "expiresAt": 1768435200,
  "createdBy": "tenant_42"
}'

Node.js (global fetch, Node 18 or later)

const response = await fetch('https://collect.noxtica.com/v1/device-delegation/create', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.NOXTICA_API_KEY}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    subjectId: 'subj_4821',
    delegatorId: 'dev_7a2b9c4d1e6f3a8b',
    delegateId: 'dev_2b9c4d1e6f3a8b7a',
    scope: 'device_use',
    evidenceRef: 'obj-front',
    expiresAt: 1768435200,
    createdBy: 'tenant_42',
  }),
});
console.log(response.status, await response.text());

Python (standard library)

import json
import os
import urllib.request

request = urllib.request.Request(
    "https://collect.noxtica.com/v1/device-delegation/create",
    data=json.dumps({
        "subjectId": "subj_4821",
        "delegatorId": "dev_7a2b9c4d1e6f3a8b",
        "delegateId": "dev_2b9c4d1e6f3a8b7a",
        "scope": "device_use",
        "evidenceRef": "obj-front",
        "expiresAt": 1768435200,
        "createdBy": "tenant_42",
    }).encode(),
    headers={
        "Authorization": f"Bearer {os.environ['NOXTICA_API_KEY']}",
        "Content-Type": "application/json",
    },
    method="POST",
)
with urllib.request.urlopen(request) as response:
    print(response.status, response.read().decode())

List a subject’s active device delegations

POST /v1/device-delegation/list

Lists the active, non-expired delegations of a subject. A subject with no active delegations, or an unknown subject, returns an empty array, never a distinguishing status (no existence oracle). Availability and rate-limit bucket are the same as for POST /v1/device-delegation/create; a 401 never consumes the bucket.

Authentication: Bearer token (ApiKeyAuth), scope write:identity.

Request body

Content type application/json, required.

Responses

Response headers

Response fields (200, application/json)

Response example (200)

{
  "ok": true,
  "delegations": [
    {
      "id": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
      "subjectId": "subj_4821",
      "delegatorId": "dev_7a2b9c4d1e6f3a8b",
      "delegateId": "dev_2b9c4d1e6f3a8b7a",
      "scope": "device_use",
      "status": "active",
      "evidenceRef": "obj-front",
      "expiresAt": 1768435200,
      "revokedAt": 1,
      "createdBy": "tenant_42",
      "createdAt": 1,
      "updatedAt": 1
    }
  ],
  "requestId": "req-test"
}

Example request

curl

curl -X POST "https://collect.noxtica.com/v1/device-delegation/list" \
  -H "Authorization: Bearer $NOXTICA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "subjectId": "subj_4821"
}'

Node.js (global fetch, Node 18 or later)

const response = await fetch('https://collect.noxtica.com/v1/device-delegation/list', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.NOXTICA_API_KEY}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    subjectId: 'subj_4821',
  }),
});
console.log(response.status, await response.text());

Python (standard library)

import json
import os
import urllib.request

request = urllib.request.Request(
    "https://collect.noxtica.com/v1/device-delegation/list",
    data=json.dumps({
        "subjectId": "subj_4821",
    }).encode(),
    headers={
        "Authorization": f"Bearer {os.environ['NOXTICA_API_KEY']}",
        "Content-Type": "application/json",
    },
    method="POST",
)
with urllib.request.urlopen(request) as response:
    print(response.status, response.read().decode())

Revoke a device delegation

POST /v1/device-delegation/revoke

Revokes a delegation. Revocation is terminal: a revoked delegation is never honoured again, and restoring access means creating a new delegation. A delegation id that belongs to another organisation answers device_delegation_not_found, byte-identical to an unknown id (no existence oracle). Availability and rate-limit bucket are the same as for POST /v1/device-delegation/create.

Authentication: Bearer token (ApiKeyAuth), scope write:identity.

Request body

Content type application/json, required.

Responses

Response headers

Response fields (200, application/json)

Response example (200)

{
  "ok": true,
  "revoked": true,
  "requestId": "req-test"
}

Example request

curl

curl -X POST "https://collect.noxtica.com/v1/device-delegation/revoke" \
  -H "Authorization: Bearer $NOXTICA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "id": "00000000-0000-4000-8000-000000000000"
}'

Node.js (global fetch, Node 18 or later)

const response = await fetch('https://collect.noxtica.com/v1/device-delegation/revoke', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.NOXTICA_API_KEY}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    id: '00000000-0000-4000-8000-000000000000',
  }),
});
console.log(response.status, await response.text());

Python (standard library)

import json
import os
import urllib.request

request = urllib.request.Request(
    "https://collect.noxtica.com/v1/device-delegation/revoke",
    data=json.dumps({
        "id": "00000000-0000-4000-8000-000000000000",
    }).encode(),
    headers={
        "Authorization": f"Bearer {os.environ['NOXTICA_API_KEY']}",
        "Content-Type": "application/json",
    },
    method="POST",
)
with urllib.request.urlopen(request) as response:
    print(response.status, response.read().decode())

Open a recovery case (currently always refused)

POST /v1/recovery/cases

Self-service recovery case opening is not available today. A well-formed request never creates a case: the route validates the shape of installId (a UUID, then discarded — it is never treated as a subject reference) and answers the same closed business rejection with HTTP 200, which is the status the mobile backend contract inspects. A request that carries a subjectId of any type is rejected with 400 invalid_request, so that no key holder can name a foreign subject.

Not enabled by default: when the device-registry capability is not enabled for your organisation the route answers the GatedNotFound 404. The four /v1/recovery/* operations share one rate-limit bucket per API key.

Authentication: Bearer token (ApiKeyAuth), scope write:identity.

Request body

Content type application/json, required.

Responses

Response headers

Response fields (200, application/json)

Response example (200)

{
  "ok": false,
  "reason": "subject_resolution_required",
  "requestId": "req-test"
}

Example request

curl

curl -X POST "https://collect.noxtica.com/v1/recovery/cases" \
  -H "Authorization: Bearer $NOXTICA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "installId": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
  "tier": "fresh_reverification",
  "evidenceRef": "obj-front",
  "subjectId": "subj_4821"
}'

Node.js (global fetch, Node 18 or later)

const response = await fetch('https://collect.noxtica.com/v1/recovery/cases', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.NOXTICA_API_KEY}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    installId: '3fa85f64-5717-4562-b3fc-2c963f66afa6',
    tier: 'fresh_reverification',
    evidenceRef: 'obj-front',
    subjectId: 'subj_4821',
  }),
});
console.log(response.status, await response.text());

Python (standard library)

import json
import os
import urllib.request

request = urllib.request.Request(
    "https://collect.noxtica.com/v1/recovery/cases",
    data=json.dumps({
        "installId": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
        "tier": "fresh_reverification",
        "evidenceRef": "obj-front",
        "subjectId": "subj_4821",
    }).encode(),
    headers={
        "Authorization": f"Bearer {os.environ['NOXTICA_API_KEY']}",
        "Content-Type": "application/json",
    },
    method="POST",
)
with urllib.request.urlopen(request) as response:
    print(response.status, response.read().decode())

Read a recovery case’s status

GET /v1/recovery/cases/{caseId}

Polls the status of a recovery case. The stored case is redacted before it is returned: subjectId, evidenceRef, refereeId, fraudReviewVerdict, createdBy and resolutionReasonCode are never part of the response. A caseId that belongs to another organisation answers the same 404 as an unknown id (no existence oracle). Availability and rate-limit bucket are the same as for POST /v1/recovery/cases.

Authentication: Bearer token (ApiKeyAuth), scope write:identity.

Parameters

Responses

Response headers

Response fields (200, application/json)

Response example (200)

{
  "ok": true,
  "case": {
    "id": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
    "tenantId": "tenant_42",
    "tier": "fresh_reverification",
    "status": "opened",
    "resultingVerificationLevel": "example-resultingVerificationLevel",
    "resultingStatus": "active",
    "slaDueAt": 1,
    "resolvedAt": 1,
    "createdAt": 1,
    "updatedAt": 1
  },
  "requestId": "req-test"
}

Example request

curl

curl "https://collect.noxtica.com/v1/recovery/cases/example-caseId" \
  -H "Authorization: Bearer $NOXTICA_API_KEY"

Node.js (global fetch, Node 18 or later)

const response = await fetch('https://collect.noxtica.com/v1/recovery/cases/example-caseId', {
  method: 'GET',
  headers: {
    Authorization: `Bearer ${process.env.NOXTICA_API_KEY}`,
  },
});
console.log(response.status, await response.text());

Python (standard library)

import os
import urllib.request

request = urllib.request.Request(
    "https://collect.noxtica.com/v1/recovery/cases/example-caseId",
    headers={
        "Authorization": f"Bearer {os.environ['NOXTICA_API_KEY']}",
    },
    method="GET",
)
with urllib.request.urlopen(request) as response:
    print(response.status, response.read().decode())

Open an appeal (currently always refused)

POST /v1/recovery/appeals

Opening an appeal is not available today. Because no case can be opened, the route refuses unconditionally with the same closed reason as POST /v1/recovery/cases, and it does not read or validate the request body: any body, or none, produces the identical response. Availability and rate-limit bucket are the same as for the other recovery routes.

Authentication: Bearer token (ApiKeyAuth), scope write:identity.

Request body

Content type application/json, optional.

Responses

Response headers

Response fields (200, application/json)

Response example (200)

{
  "ok": false,
  "reason": "subject_resolution_required",
  "requestId": "req-test"
}

Example request

curl

curl -X POST "https://collect.noxtica.com/v1/recovery/appeals" \
  -H "Authorization: Bearer $NOXTICA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{}'

Node.js (global fetch, Node 18 or later)

const response = await fetch('https://collect.noxtica.com/v1/recovery/appeals', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.NOXTICA_API_KEY}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({}),
});
console.log(response.status, await response.text());

Python (standard library)

import json
import os
import urllib.request

request = urllib.request.Request(
    "https://collect.noxtica.com/v1/recovery/appeals",
    data=json.dumps({}).encode(),
    headers={
        "Authorization": f"Bearer {os.environ['NOXTICA_API_KEY']}",
        "Content-Type": "application/json",
    },
    method="POST",
)
with urllib.request.urlopen(request) as response:
    print(response.status, response.read().decode())

Read an appeal’s status

GET /v1/recovery/appeals/{appealId}

Polls the status of an appeal. Unlike a case, no field of an appeal is redacted. A missing appeal reuses the case reason recovery_case_not_found; there is no separate appeal-not-found code. Availability and rate-limit bucket are the same as for the other recovery routes.

Authentication: Bearer token (ApiKeyAuth), scope write:identity.

Parameters

Responses

Response headers

Response fields (200, application/json)