API reference

The Vitrified API is a JSON-over-HTTPS REST API. Every SDK call eventually hits this surface. You can also call it directly with curl or any HTTP client.

Base URL

https://api.vitrified.glass

All endpoints are versioned under /v1/.

Authentication

Every request requires a Bearer token (API key). Generate keys from the dashboard's API keys page. Keys are scoped to a single project.

GET /v1/attestations/sub_01J... HTTP/1.1
Host: api.vitrified.glass
Authorization: Bearer vit_live_...

Idempotency

Mutating endpoints accept an optional Idempotency-Key header. Two requests with the same idempotency key within the retention window (default 24h) return the same resource. The idempotency key is per-API-key.

Resource identifiers

Vitrified uses ULID-style prefixed identifiers:

Error envelope

{
  "error": {
    "code": "submission.invalid_metadata",
    "message": "Metadata failed validation against schema 'slsa.provenance.v1'.",
    "details": {
      "schema": "slsa.provenance.v1",
      "errors": [{ "path": "/predicate/builder/id", "message": "must be a URI" }]
    },
    "request_id": "req_01J..."
  }
}

The full error code vocabulary is pinned in spec/errors.md.

Rate limits

Responses include X-RateLimit-Limit, X-RateLimit-Remaining, and X-RateLimit-Reset headers.

OpenAPI

A machine-readable OpenAPI 3.1 spec is published at:

https://api.vitrified.glass/openapi.json

Generate clients with openapi-typescript-codegen, openapi-generator, or any compatible tooling.

Endpoint reference

See Endpoints for the per-endpoint reference (request shapes, response shapes, error codes).

See also

• JavaScript SDK — preferred client for Node / browser.
• Python SDK — preferred client for Python.
• Webhooks — the events you can subscribe to.