> ## Documentation Index > Fetch the complete documentation index at: https://docs.truthlocks.com/llms.txt > Use this file to discover all available pages before exploring further. # Mint through the collection route > Mint Attestation This is the collection-route variant of attestation minting. Use the structured-record or encoded-payload option shown in Try It and retain the same Idempotency-Key when retrying the same request. Verification packs and record types remain selectable in the request schema. ## OpenAPI ````yaml mint-openapi.yaml POST /v1/attestations openapi: 3.0.3 info: title: Truthlocks API description: > Truthlocks is a universal verification infrastructure for documents, credentials, and digital assets. This specification defines the canonical API for interacting with Truthlocks services. ## Base URLs - **Production**: `https://api.truthlocks.com` - **Sandbox**: `https://sandbox-api.truthlocks.com` ## Authentication - **API Keys**: Use `X-API-Key` header for machine-to-machine operations - **Bearer Tokens**: Use `Authorization: Bearer ` for user-initiated operations ## Tenant Identity In production, tenant identity is derived from the authenticated context (API key or JWT). The `X-Tenant-ID` header is ignored in production to prevent spoofing. version: 1.0.0 contact: name: Truthlocks Support url: https://truthlocks.com/support email: support@truthlocks.com servers: - url: https://api.truthlocks.com description: Production API - url: https://sandbox-api.truthlocks.com description: Sandbox Environment security: - APIKey: [] - BearerAuth: [] tags: - name: Authentication description: API key and token management - name: Issuers description: Issuer registration and trust management - name: Keys description: Cryptographic key management for issuers - name: Attestations description: Attestation lifecycle (mint, revoke, supersede) - name: Verification description: Attestation verification and proof bundles - name: Governance description: Issuer governance workflows (admin only) - name: Identity description: Organization, user, and role management - name: Audit description: Audit event queries - name: Tenant Console description: Tenant profile and lifecycle endpoints - name: Health description: Service health and readiness endpoints - name: Risk description: Risk signal ingestion and fraud detection - name: Risk Enforcement description: Risk enforcement actions — block, challenge, quarantine, and configuration - name: Billing description: Billing, subscription, and addon management - name: Machine Identity description: >- Machine Agent Identity Protocol (MAIP) — agent registration, sessions, trust, witness, compliance, orchestration, and observability externalDocs: description: Transparency read-only API (separate service spec) url: >- https://github.com/truthlocks/truthlock/blob/main/docs/transparency/openapi.yaml paths: /v1/attestations: post: tags: - Attestations summary: Mint Attestation description: >- Signs a structured record or an encoded payload with an available issuer key. Select the matching input format and retain Idempotency-Key for retries. parameters: - name: Idempotency-Key in: header required: true schema: type: string requestBody: required: true content: application/json: schema: description: >- Choose Structured record to select a record type and enter claims, or Encoded payload to sign existing bytes. Never combine both input formats. oneOf: - title: Structured record type: object required: - issuer_id - kid - alg - schema - claims properties: alg: $ref: '#/components/schemas/SigningAlgorithm' description: Must match the selected issuer signing key. attestation_id: type: string content_type: type: string description: >- MIME type of the original bytes, such as application/json, application/pdf or image/png. Structured schema/claims input requires application/json. example: application/json document_hash: type: string description: >- Optional hexadecimal SHA-256 document hash. An embedded claims.document.sha256 takes precedence; otherwise this field is used, then the decoded payload hash. issuer_id: type: string description: The UUID of the issuer creating the attestation format: uuid example: 550e8400-e29b-41d4-a716-446655440000 kid: type: string description: Key identifier for the signing key example: es256-key-1 pack_id: type: string description: >- Optional workspace verification-pack UUID. Use List verification packs with the same API key to select an existing active pack; omit for a standalone record. format: uuid expires_at_unix: type: integer format: int64 minimum: 1 maximum: 253402300799 description: >- Optional future Unix timestamp in seconds for structured schema/claims input. It is included in the signed JSON payload. For payload_b64url input, omit this request field and embed expires_at_unix at the root of the exact JSON payload instead. Expiry cannot be changed in place. recipient_email: type: string description: >- Optional recipient for asynchronous notification after minting. A successful mint response does not confirm delivery. format: email schema: type: string description: >- Record type for structured input. Provide claims and omit payload_b64url. This label does not independently validate the truth of claims. enum: - verifiable-id - passport - drivers-license - government-id - self-sovereign-id - employment-verification - professional-role - membership-card - professional-certification - license - accreditation - degree - completion-cert - course-credit - transcript - micro-credential - training-completion - medical-license - dea-registration - board-certification - health-credential - vaccination-record - aml-kyc - security-clearance - sam-gov - jurisdiction-approval - attestation-of-will - bank-verification - credit-attestation - income-verification - skill-badge - competency - industry-cert - product-authenticity - chain-of-custody - origin-verification - custom - attestation example: verifiable-id claims: type: object additionalProperties: true description: >- Structured record fields. Required with schema; cannot be combined with payload_b64url. example: full_name: Example recipient employee_id: QA-001 - title: Encoded payload type: object required: - issuer_id - kid - alg - payload_b64url properties: alg: $ref: '#/components/schemas/SigningAlgorithm' description: Must match the selected issuer signing key. attestation_id: type: string content_type: type: string description: >- MIME type of the original bytes, such as application/json, application/pdf or image/png. Structured schema/claims input requires application/json. example: application/json document_hash: type: string description: >- Optional hexadecimal SHA-256 document hash. An embedded claims.document.sha256 takes precedence; otherwise this field is used, then the decoded payload hash. issuer_id: type: string description: The UUID of the issuer creating the attestation format: uuid example: 550e8400-e29b-41d4-a716-446655440000 kid: type: string description: Key identifier for the signing key example: es256-key-1 pack_id: type: string description: >- Optional workspace verification-pack UUID. Use List verification packs with the same API key to select an existing active pack; omit for a standalone record. format: uuid recipient_email: type: string description: >- Optional recipient for asynchronous notification after minting. A successful mint response does not confirm delivery. format: email payload_b64url: type: string description: >- Unpadded base64url of the exact bytes to sign. Use this OR schema plus claims. responses: '201': description: Attestation minted content: application/json: schema: $ref: '#/components/schemas/Attestation' '400': description: Invalid request content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' '413': description: Payload too large content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' '429': description: Rate limit or quota exceeded content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' security: - APIKey: [] components: schemas: SigningAlgorithm: type: string enum: - Ed25519 - ES256 - ES384 - ES512 - RS256 - RS384 - RS512 - PS256 - PS384 - PS512 description: Signing algorithm for key generation Attestation: type: object properties: id: type: string format: uuid issuer_id: type: string format: uuid kid: type: string status: type: string enum: - VALID - REVOKED - SUPERSEDED payload: type: object signature: type: string log_index: type: integer created_at: type: string format: date-time ErrorEnvelope: type: object required: - code - message - http_status properties: code: type: string description: Machine-readable error code enum: - AUTH_REQUIRED - AUTH_INVALID - PERMISSION_DENIED - TENANT_IDENTITY_UNVERIFIED - NOT_FOUND - VALIDATION_ERROR - CONFLICT - PAYLOAD_TOO_LARGE - RATE_LIMIT_EXCEEDED - QUOTA_EXCEEDED - SERVICE_UNAVAILABLE - INTERNAL_ERROR message: type: string description: Human-readable error message http_status: type: integer description: HTTP status code retry_after_ms: type: integer description: Milliseconds to wait before retrying (for rate limits) details: type: object description: Additional error context example: code: AUTH_REQUIRED message: Authentication required http_status: 401 securitySchemes: APIKey: type: apiKey in: header name: X-API-Key description: API key for machine-to-machine authentication BearerAuth: type: http scheme: bearer bearerFormat: JWT description: JWT for user-initiated operations ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.