> ## Documentation Index
> Fetch the complete documentation index at: https://docs.truthlocks.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Protect Content (Consumer Mint)
> Mint a cryptographic attestation for content you want to protect. Your personal issuer and signing key are resolved automatically. Hash the content client-side (SHA-256) and submit the hash with file metadata.
Mint a cryptographic attestation for a piece of content you want to protect. Your personal issuer and signing key are resolved automatically — you do not need to create an issuer or register a key.
Hash your content client-side with SHA-256 and submit the hash along with file metadata. The endpoint returns a protection record with a shareable proof URL you can use to demonstrate authorship.
Rate limits depend on your plan tier:
| Plan | Protections per month |
| ------- | --------------------- |
| Free | 50 |
| Creator | 500 |
| Pro | Unlimited |
The response includes `content_hash` and `protected_at` so you can confirm which content was protected and the exact timestamp without making a follow-up call.
### Parameters
SHA-256 hash of the file content, computed client-side before upload.
Human-readable title for the protection (e.g. the file name or a short description).
Optional description providing additional context about the protected content.
MIME type of the content (e.g. `image/png`, `application/pdf`, `text/x-python`).
Original file name including extension.
File size in bytes.
Content category. One of `code`, `research`, `design`, `media`, `dataset`, `ai-output`, `writing`, `digital-art`, or `other`. Defaults to `other`.
Optional AI-extracted metadata object (e.g. from the [AI metadata extraction](/guides/ai-metadata) flow).
Controls whether the protection appears on your public [portfolio](/guides/portfolio). Either `public` or `private`. Defaults to `private`.
### Responses
## OpenAPI
````yaml mint-openapi.yaml POST /v1/consumer/mint
openapi: 3.0.3
info:
title: Truthlocks API
description: >
Truthlocks is a universal verification infrastructure for documents,
credentials, and digital assets.
This specification defines the canonical API for interacting with Truthlocks
services.
## Base URLs
- **Production**: `https://api.truthlocks.com`
- **Sandbox**: `https://sandbox-api.truthlocks.com`
## Authentication
- **API Keys**: Use `X-API-Key` header for machine-to-machine operations
- **Bearer Tokens**: Use `Authorization: Bearer ` for user-initiated
operations
## Tenant Identity
In production, tenant identity is derived from the authenticated context
(API key or JWT).
The `X-Tenant-ID` header is ignored in production to prevent spoofing.
version: 1.0.0
contact:
name: Truthlocks Support
url: https://truthlocks.com/support
email: support@truthlocks.com
servers:
- url: https://api.truthlocks.com
description: Production API
- url: https://sandbox-api.truthlocks.com
description: Sandbox Environment
security:
- APIKey: []
tags:
- name: Authentication
description: API key and token management
- name: Issuers
description: Issuer registration and trust management
- name: Keys
description: Cryptographic key management for issuers
- name: Attestations
description: Attestation lifecycle (mint, revoke, supersede)
- name: Verification
description: Attestation verification and proof bundles
- name: Governance
description: Issuer governance workflows (admin only)
- name: Identity
description: Organization, user, and role management
- name: Audit
description: Audit event queries
- name: Platform
description: Platform administration (super admin only)
- name: Platform Review
description: Staff review workflows for issuer applications
- name: Tenant Console
description: Tenant profile and lifecycle endpoints
- name: Health
description: Service health and readiness endpoints
- name: Risk
description: Risk signal ingestion and fraud detection
- name: Risk Enforcement
description: Risk enforcement actions — block, challenge, quarantine, and configuration
- name: Billing
description: Billing, subscription, and addon management
- name: Machine Identity
description: >-
Machine Agent Identity Protocol (MAIP) — agent registration, sessions,
trust, witness, compliance, orchestration, and observability
externalDocs:
description: Transparency read-only API (separate service spec)
url: >-
https://github.com/truthlocks/truthlock/blob/main/docs/transparency/openapi.yaml
paths:
/v1/consumer/mint:
post:
tags:
- Consumer
summary: Protect Content (Consumer Mint)
description: >-
Mint a cryptographic attestation for content you want to protect. Your
personal issuer and signing key are resolved automatically. Hash the
content client-side (SHA-256) and submit the hash with file metadata.
requestBody:
required: true
content:
application/json:
schema:
type: object
required:
- content_hash
properties:
content_hash:
type: string
description: SHA-256 hash of the file content, computed client-side.
title:
type: string
description: Human-readable title for the protection.
description:
type: string
description: Optional description of the protected content.
content_type:
type: string
description: MIME type of the content (e.g. image/png).
file_name:
type: string
description: Original file name including extension.
file_size:
type: integer
description: File size in bytes.
category:
type: string
enum:
- code
- research
- design
- media
- dataset
- ai-output
- writing
- digital-art
- other
description: Content category. Defaults to other.
ai_metadata:
type: object
description: Optional AI-extracted metadata object.
visibility:
type: string
enum:
- public
- private
description: >-
Whether the protection appears on your public portfolio.
Defaults to private.
responses:
'201':
description: Content protected
content:
application/json:
schema:
type: object
properties:
protection_id:
type: string
format: uuid
attestation_id:
type: string
format: uuid
verify_url:
type: string
format: uri
share_url:
type: string
format: uri
content_hash:
type: string
description: SHA-256 hash echoed back from the request.
protected_at:
type: string
format: date-time
description: Timestamp when the content was protected (RFC 3339).
status:
type: string
enum:
- protected
'400':
description: Missing required field
'401':
description: Unauthorized
'429':
description: Monthly protection limit reached
security:
- APIKey: []
- BearerAuth: []
components:
securitySchemes:
APIKey:
type: apiKey
in: header
name: X-API-Key
description: API key for machine-to-machine authentication
BearerAuth:
type: http
scheme: bearer
bearerFormat: JWT
description: JWT for user-initiated operations
````