H33 API Documentation
The complete post-quantum authentication API. FHE biometrics, ZK proofs, quantum signatures, blockchain attestation. All in one platform, at 2,648 microseconds.
Quick Start
Get started in 3 steps
Authentication
All API requests require authentication using your API key in the Authorization header.
h33_test_* - Test keys, sandbox environment (no auths consumed)
Key Management
API keys can be created, rotated, and revoked from your dashboard. We recommend:
- Using different keys for different environments
- Rotating keys every 90 days
- Never committing keys to version control
Pricing & Usage
H33 uses per-auth pricing with included monthly auths. Annual plans get 2 months free (~17% off).
Security Level Surcharges
Higher security levels add a per-auth surcharge:
| Tier | Surcharge | Latency | Description |
|---|---|---|---|
| H0 ⚠️ | 1 | 356µs | Dev/testing only (~57-bit) |
| H1 | 3 | ~480µs | Lightweight FHE (~86-bit) |
| H2 ✓ | 4 | removed | Full FHE, deep circuits (NIST L1) |
| H33 ⭐ | 10 | 1.36ms | Zero exposure flagship (NIST L1) |
| H-256 ✓ | 25 | 5.98ms | NIST L5 + k-of-n threshold |
KYC / Identity (Fixed Pricing)
| Service | Price | Includes |
|---|---|---|
| KYC Basic + SBT | $49 | ID, Selfie, Liveness, Soulbound NFT |
| KYC Enhanced + SBT | $79 | + Proof of Address verification |
| AML/PEP Screening | $19 | Sanctions, PEP, Adverse Media |
| Full Bundle | $99 | KYC + AML + Soulbound NFT |
Full Stack Auth
Complete post-quantum authentication in a single call. Combines FHE-encrypted biometric matching, zero-knowledge proof generation, quantum-resistant signature, and blockchain attestation.
Request Body
| Parameter | Type | Required | Description |
|---|---|---|---|
userId |
string | Required | Unique identifier for the user |
biometric |
object | Required | Biometric data (face, voice, or fingerprint) |
biometric.type |
string | Required | "face" | "voice" | "fingerprint" |
biometric.data |
string | Required | Base64-encoded biometric data |
mode |
string | Optional | "h0" (dev only ~57-bit) | "h1" (fast non-NIST) | "h2" (NIST L1) | "h33" (1.36ms NIST L1, default) | "h-256" (5.98ms NIST L5) |
zkClaims |
object | Optional | Additional claims to include in ZK proof |
blockchain |
object | Optional | Blockchain attestation options |
Example Request
Example Response
Biometric Enroll
Enroll a new biometric template. The template is encrypted using FHE before storage — we never see or store raw biometric data. Accepts base64-encoded images or pre-extracted float32 embedding vectors.
Request Body
| Parameter | Type | Required | Description |
|---|---|---|---|
userId |
string | Required | Unique identifier for the user |
biometric |
object | Optional | Biometric data to enroll (use this OR embedding) |
biometric.type |
string | Required | "face" | "voice" | "fingerprint" | "iris" |
biometric.data |
string | Optional | Base64-encoded biometric image/audio |
embedding |
number[] | Optional | Pre-extracted float32 embedding vector. 512-D (face), 192-D (voice), 256-D (fingerprint), 1024-D (iris). Use instead of biometric.data when sending model output directly. |
adapter |
string | Optional | "arcface" | "speechbrain" | "sourceafis" — auto-validates dimension, checks for NaN, and L2-normalizes. See SDK Guide |
mode |
string | Optional | "q-dev" | "q2" | "q-256" |
Biometric Verify
Verify a biometric sample against an enrolled template. Matching is performed entirely on encrypted data using FHE — the raw biometric never leaves your device. Accepts base64 images or pre-extracted embedding vectors.
Request Body
| Parameter | Type | Required | Description |
|---|---|---|---|
userId |
string | Required | User to verify against enrolled template |
embedding |
number[] | Optional | Pre-extracted float32 embedding vector. Use instead of biometric.data. |
biometric |
object | Optional | Biometric data (use this OR embedding) |
adapter |
string | Optional | "arcface" | "speechbrain" | "sourceafis" — auto-validates and normalizes |
Liveness Session
Create a challenge-response anti-spoofing session. Returns challenges (blink, head turn, speech phrase) that the user must complete before biometric verification proceeds. Detects photo attacks, replays, deepfakes, and synthetic media.
Request Body
| Parameter | Type | Required | Description |
|---|---|---|---|
biometricType |
string | Required | "face" | "voice" |
riskLevel |
string | Optional | "low" | "medium" | "high" — controls number and difficulty of challenges. Default: "medium" |
Verify + Liveness
Liveness check first, then FHE biometric verification. If the liveness check fails (spoofing detected), the FHE verification is never executed — no compute wasted on attacks. Returns both liveness result and verification result.
Request Body
| Parameter | Type | Required | Description |
|---|---|---|---|
userId |
string | Required | User to verify against enrolled template |
embedding |
number[] | Required | Pre-extracted float32 embedding vector |
sessionId |
string | Required | Liveness session ID from /biometric/liveness-session |
capture |
object | Required | Biometric capture data for liveness analysis |
capture.faceFrames |
object[] | Optional | Array of face frames with timestamps, landmarks, and frame hashes |
capture.voiceSegments |
object[] | Optional | Array of voice segments with audio features and spectral data |
capture.challengeResults |
object[] | Optional | Completed challenge-response results from the liveness session |
Voice: Replay detection, synthetic speech, frequency analysis, environmental consistency
Deepfake: GAN artifact detection, temporal coherence, challenge-response verification
Unenroll (Delete)
Cryptographically delete an enrolled biometric template. The BFV ciphertext is destroyed and a Dilithium-signed deletion receipt is returned as proof of destruction. Satisfies BIPA 15(a), GDPR Article 17, CCPA 1798.105.
Request Body
| Parameter | Type | Required | Description |
|---|---|---|---|
userId |
string | Required | User whose template to delete |
enrollmentId |
string | Optional | Specific enrollment to delete. If omitted, deletes all enrollments for user. |
FHE Encryption
Encrypt data using Fully Homomorphic Encryption. Encrypted data can be processed without decryption, enabling privacy-preserving computation.
FHE Modes
| Mode | Latency | Parameter N | Use Case |
|---|---|---|---|
| H0 | 356µs | N=1,024 | Dev/testing only (~57-bit) |
| H1 | ~480µs | N=2,048 | Fast non-NIST (~85-bit) |
| H2 | removed | N=4,096 | Deep circuits (128-bit NIST L1) |
| H33 | 1.36ms | N=4,096 | Production default (128-bit NIST L1) |
| H-256 | 5.98ms | N=16,384 | Max security (256-bit NIST L5) |
FHE Compute
Perform computations on encrypted data. Supports addition, multiplication, comparison, and custom operations without ever decrypting.
Zero-Knowledge Proofs
Generate a zero-knowledge proof. Prove statements about your data without revealing the data itself. Uses H33 ZKP STARK Lookup — SHA3-256 hash, post-quantum safe, no trusted setup.
Supported Proof Types
| Scheme | Proof Size | Verify Time | Notes |
|---|---|---|---|
| H33 ZKP Stark Lookup (Production) | 105 bytes | 2.09ns (cached) | Production auth ZK. STARK Lookup, SHA3-256 hash, PQ-safe |
| KZG | ~200 bytes | ~3ms | Biometric ZKP commitment scheme |
| IPA | ~1KB | ~10ms | No trusted setup, biometric ZKP |
Verify a zero-knowledge proof. Returns true if the proof is valid for the given public inputs and verification key.
Quantum Signatures
NIST FIPS 203/204 compliant post-quantum digital signatures. Resistant to attacks from both classical and quantum computers.
CRYSTALS-Kyber - Key encapsulation (FIPS 203)
Sign data using a quantum-resistant algorithm. Default: Dilithium3 (NIST security Level 3).
Blockchain Attestation
Create an immutable attestation record on Solana. Perfect for audit trails, compliance records, and tamper-proof logging.
Mint a Soulbound Token (non-transferable NFT) representing verified identity credentials. Included with KYC packages.
KYC Verification
Complete KYC verification with FHE-encrypted biometrics, ZK proofs, and blockchain attestation. Includes Soulbound NFT minting.
Pricing
| Package | Price | Includes |
|---|---|---|
| KYC Basic + SBT | $49 | ID + Selfie + Liveness + Soulbound NFT |
| KYC Enhanced + SBT | $79 | Basic + Proof of Address |
| Full Bundle | $99 | Enhanced KYC + AML + Soulbound NFT |
Continuous Authentication
Real-time continuous authentication using multi-modal behavioral biometrics. LSTM-based temporal modeling of keystroke, mouse, face, and voice patterns.
Invisible Authentication
Zero-transmission authentication. No codes displayed on screen. Authentication keys are hardware-secured and never transmitted over the network.
Estate Fraud Detection
Detect behavioral anomalies indicating potential estate fraud. Analyzes shifts from deceased user baselines and detects beneficiary collusion patterns. Generates court-admissible evidence packages.
Bundled Services
High-performance bundled endpoints using h33_fhe and h33_stark internally—our fastest, most secure implementations.
Complete authentication in one call. Uses h33_fhe for encryption and h33_stark for proof generation. Returns verified identity with quantum-resistant signatures.
Request Body
Response
Encrypt and Prove
FHE encryption with ZK proof in one call. Encrypts data using h33_fhe and generates a H33 ZKP STARK Lookup proof of correct encryption. 2.0µs (async) prove, 2.09ns (cached) verify, 105-byte proof.
Request Body
Response
Secure Compute
FHE computation with correctness proof. Performs operations on encrypted data and generates a H33 ZKP Stark Lookup proof that the computation was performed correctly.
Request Body
Response
Key Ceremony
Multi-party key generation ceremony. Securely generates shared keys across multiple participants using MPC protocols with quantum-resistant algorithms.
Request Body
Response
SDK Initialization
Initialize the H33 SDK with your configuration. Returns optimized settings and pre-computed parameters for subsequent API calls.
Request Body
Response
Bundled Status
Health check for bundled services. Returns status of h33_fhe, h33_stark, and all bundled endpoint availability.
Response
Error Codes
All API errors return a consistent JSON structure with an error code and message.
| Code | HTTP | Description |
|---|---|---|
INVALID_API_KEY |
401 | API key is missing, invalid, or revoked |
QUOTA_EXCEEDED |
429 | Monthly auth quota exceeded |
INVALID_BIOMETRIC |
400 | Biometric data is malformed or unreadable |
USER_NOT_ENROLLED |
404 | No biometric template found for user |
VERIFICATION_FAILED |
200 | Biometric match failed (not an error) |
LIVENESS_FAILED |
403 | Anti-spoofing liveness check failed |
SPOOFING_DETECTED |
403 | Spoofing attack detected (photo, replay, deepfake) |
SESSION_EXPIRED |
410 | Liveness session expired — create a new session |
ADAPTER_VALIDATION_FAILED |
400 | Embedding failed adapter validation (wrong dimension, NaN, zero vector, L2 norm out of range) |
CIRCUIT_NOT_FOUND |
404 | ZK circuit ID not found |
PROOF_INVALID |
400 | ZK proof verification failed |
BLOCKCHAIN_ERROR |
502 | Blockchain network error |
SDKs & Libraries
Official client libraries with TypeScript definitions, async/await support, and automatic retries.
SDK Features
- Full TypeScript definitions
- Automatic retry with exponential backoff
- Request/response logging
- Webhook signature verification
- Secure enclave integration (mobile)
- Biometric capture helpers
- Biometric SDK Integration Guide → ArcFace, SpeechBrain, SourceAFIS adapters
Implementation Boundary
The canonical STARK engine, verifier, protocol hardening suite, and security regression suite are implemented in Rust. No JavaScript, browser runtime, or scripting layer participates in proving, verification, transcript construction, field arithmetic, challenge derivation, or security-critical execution.
JSON artifacts are used only as portable conformance vectors for independent implementations. The proving and verification hot path is Rust-native, fully deterministic, and produces identical outputs across runs, machines, and architectures.