ZTXBAS Overview

Welcome to the ZTXBAS Authentication Server API. This API provides phishing-resistant biometric authentication for SaaS applications.

Base URL

https://ztxbas01.corezt.com (example only, can be different depending on licensing model)

All API requests (except /health) require HMAC-SHA256 signature authentication.

The signature is calculated over the following string:

{METHOD}|{URL}|{TIMESTAMP}|{NONCE}|{BODY}

Example:

POST|/api/v1/auth/challenge|1706140800|a1b2c3d4...|{"user_email":"user@example.com","origin":"https://app.example.com"}

Sign this string using HMAC-SHA256 with your client_secret as the key.

Endpoint	Method	Description
`/health`	GET	Server health check (no auth)
`/api/v1/origins/register`	POST	Register an allowed origin
`/api/v1/auth/challenge`	POST	Create authentication challenge
`/api/v1/auth/status`	POST	Poll challenge status
`/api/v1/auth/respond`	POST	Submit device response (internal)
`/api/v1/users/register`	POST	Register a user
`/api/v1/users/deregister`	POST	Deregister a user

All errors follow this format:

{
  "error": "ERROR_CODE",
  "message": "Human readable description"
}

Code	HTTP Status	Description
`MISSING_AUTH`	401	Authentication headers missing
`INVALID_SIGNATURE`	401	HMAC signature verification failed
`INVALID_CLIENT`	401	Client ID not found or inactive
`TIMESTAMP_EXPIRED`	401	Request timestamp too old (>5 min)
`RATE_LIMITED`	429	Too many requests
`UNREGISTERED_ORIGIN`	403	Origin not registered (phishing protection)
`POOL_EXHAUSTED`	503	Server busy, retry later