Endpoint, request, response, error codes, and provenance schema for the live service at api.quantumsecuregateway.com.
Verify entropy proofs against recorded provenance. Verified and Enterprise tiers only.
Retrieve a single provenance record by ID. Verified and Enterprise tiers only.
Service availability and status. No authentication required.
Submit a sandbox access request with workload details.
The full schema reference ships with the API client SDKs. Field summary:
| Field | Type | Description |
|---|---|---|
provenance_id | string | Record key (e.g. prov_2026_06_23_abc123) |
issued_at | string | ISO 8601 timestamp |
api_key_id | string | Truncated key identifier |
source_id | string | Opaque backend identifier |
source_class | enum | hardware-derived-premium | conditioned-archive-derived | hardware-derived | csprng-fallback |
entropy_score | float | 0 to 1, admission threshold ≥ 0.99 |
size_bytes | int | Number of entropy bytes drawn |
entropy_hash | string | SHA-256 of the entropy payload, base64-prefixed |
key_exchange | string | Hybrid KEM (currently X25519+ML-KEM-1024) |
health_check.rct_passed | bool | SP 800-90B RCT result |
health_check.apt_passed | bool | SP 800-90B APT result |
fallback.is_fallback | bool | true when CSPRNG fallback engaged |
fallback.reason | string | null | Reason code (see Entropy API) |
fallback.original_source | string | null | Source that would have been served |
prev_hash | string | Hash of the prior record in the chain |
signature | string | ML-DSA-65 signature over the payload |
Draws are billed per unit. A unit weight is computed from size_bytes and the draw's source class:
| Source Class | Unit Weight | Billing Multiplier |
|---|---|---|
hardware-derived-premium | 1.0× | Standard rate per tier |
conditioned-archive-derived | 1.0× | Standard rate per tier |
hardware-derived | 1.0× | Standard rate per tier |
csprng-fallback | 0.25× | Discounted — 25% of standard rate |
Size weight: each draw is billed at ceil(size_bytes / 32) base units. A 32-byte draw is 1 unit; a 256-byte draw is 8 units.
Overage: when monthly usage exceeds the included units, additional draws are billed at the tier's published overage rate. See Pricing for tier breakdown.
Authenticated endpoints accept a bearer token in the Authorization header:
Authorization: Bearer qsg_live_…
API keys are scoped to a single tier and a single billing account. Tier upgrades do not invalidate existing keys; new keys are issued and old keys remain valid until rotation.
For mTLS with customer-managed certificates, contact info@quantumsecuregateway.com.
Sandbox keys provisioned within 24–48 hours. Full response shape, full audit chain.