API Reference

DXA Trustway API

Seal provenance for records & AI results

DXA Trustway is a secure gateway that attaches a digital proof to every record or AI result, answering: who issued it and is it still intact. Trustway signs a manifest (P-256 + secp256k1), issues a receipt, anchors the fingerprint to DXA Blockchain, and enables independent verification — without the source data.

Base URL

https://trustway.dxa.io.vn

Authentication

Sealing uses the `xv_session` SSO session (the issuer comes from DXA Identity; demo mode allows a sample `issuerId`). High-value operations (Tier 2+) may require stepping up assurance (AAL3, passkey). Verification and JWKS are public. The on-chain relayer key is held by DXA Blockchain — Trustway holds no on-chain key.

Seal & Verify

POST /api/seal

Sign & seal an AI result with issuer identity

Auth: SSO `xv_session` session (or demo)

Body parameters

Field	Type	Description
`modelId`*	`string`	Model ID, e.g. `claude-3-sonnet`
`output`*	`any`	The AI result/decision to seal
`input`	`object`	Model input (SHA-256 hashed; not stored by default)
`tier`	`number`	Tier level (default 1); Tier 2+ may need step-up
`anchorNow`	`boolean`	Anchor the manifest to the blockchain immediately

Example request

curl -X POST 'https://trustway.dxa.io.vn/api/seal' \
  -H 'Content-Type: application/json' \
  -H 'Cookie: xv_session=<token>' \
  -d '{ "modelId": "claude-3-sonnet", "output": { "decision": "approve" }, "anchorNow": true }'

Example response

{
  "receiptId": "rcpt_8a1…",
  "outputHash": "sha256-…",
  "manifestHash": "sha256-…",
  "issuerId": "org_12ab",
  "issuerName": "Đối tác ABC",
  "identityVerified": true,
  "authLevel": "AAL2",
  "p256Sig": "…",
  "ethSig": "0x…",
  "anchor": { "mode": "onchain", "txHash": "0x…", "explorerUrl": "https://sepolia.basescan.org/tx/0x…" }
}

Error codes

`400`	Missing `modelId` or `output`
`403 stepup_required`	High-value record needs phishing-resistant auth (AAL3)

GET /api/verify

Verify a proof by receiptId

Auth: None (public)

Parameters

Name	Type	Description
`receiptId`*	`string`	Receipt ID (`rcpt_…`)

Example response

{
  "status": "valid",
  "manifestHash": "sha256-…",
  "issuer": { "orgId": "org_12ab", "orgName": "Đối tác ABC", "verified": true },
  "anchor": { "onChain": true, "txHash": "0x…" }
}

POST /api/verify

Verify by manifest JSON (+ optional public JWK)

Auth: None (public)

Body parameters

Field	Type	Description
`proof`*	`string`	Serialized manifest JSON (claim + signatures)
`publicJwk`	`object`	JWK to verify the signature (defaults to /api/keys/jwks)

Example response

{ "status": "valid", "integrity": "intact", "issuer": { "orgId": "org_12ab" } }

Anchor & Attest

POST /api/anchor

Anchor the manifest hash to DXA Blockchain

Auth: None (public)

Body parameters

Field	Type	Description
`receiptId`*	`string`	Receipt ID to anchor

Example response

{ "mode": "onchain", "txHash": "0x…", "ref": "0x…", "explorerUrl": "https://sepolia.basescan.org/tx/0x…" }

POST /api/attestation

Issue a signed attestation (EAS-style)

Auth: None (issuer from body or demo)

Body parameters

Field	Type	Description
`schema`*	`string`	Attestation schema URI
`subject`*	`string`	Subject DID/ID
`claim`*	`any`	Claim data (hashed & signed)

Example response

{
  "attestationId": "att_8a1…",
  "digest": "sha256-…",
  "sig": "…",
  "verifyUrl": "https://trustway.dxa.io.vn/verify/rcpt_8a1…"
}

GET /api/keys/jwks

Publish issuer public keys (P-256 + ETH address)

Auth: None (public)

Example response

{
  "keys": [
    {
      "kid": "org_12ab",
      "did": "did:web:identity.dxa.io.vn:o:org_12ab",
      "jwk": { "kty": "EC", "crv": "P-256", "x": "…", "y": "…" },
      "ethAddress": "0x…"
    }
  ]
}