Tumaini Core · for developers
Add verification to the services people already use.
The same engine behind Tumaini Assist and Tumaini Trust, through a JSON API. Verify a signed communication at the moment of payment, analyse media, and record evidence.
curl -X POST https://tumaini-tau.vercel.app/api/v1/verify/receipt \
-H 'content-type: application/json' \
-d '{
"receipt": "<compact JWS from the bank>",
"content": { "title": "Annual card fee", "body": "…" },
"audience": "tumaini:customer:TUM-SANDBX",
"intended_action": { "type": "payment", "payment": {
"amount_minor": 15000, "currency": "AED",
"beneficiary_name": "Falcon Demo Bank — Card Services",
"beneficiary_account": "AE07 0331 2345 6789 0123 456" } }
}'
→ { "outcome": "valid", "valid": true, "checks": [ … 11 checks … ] }Where to begin
- Bank integration exampleA fictional bank verifies a payment request against the live API before paying. Start here.
- SandboxGet a real signed receipt, tamper with it, and watch each check fail.
- Integration guideReceipt format, verification order, outcomes and the protected-action flow.
- API referenceEndpoints, request and response shapes, error codes and rate limits.
Platform overview
- AuthenticationPartly availablePublic verification needs no key and is rate-limited per IP. Consumer routes use an httpOnly session cookie; institution routes use an institution session. Production API keys and OAuth client credentials are planned.
- Institutional identityAvailableEd25519 signed receipts, trust registry at /.well-known/tumaini-trust-registry.json, revocation and single use.
- Media analysisAvailableVoice deepfake scoring, transcription and C2PA checks run through cases (POST /api/cases/{id}/media).
- Contextual analysisPartly availablePOST /api/context/analyze — Gemini adapter with consent and schema validation. Returns 503 context_unavailable until enabled.
- Risk and safe actionsAvailableEvery case returns a deterministic assessment: decision, reasons, required checks and safe actions in English and Arabic.
- Evidence recordsAvailableSigned case reports (JWS) verifiable at POST /api/v1/verify/evidence.
- Incident reportingAvailablePOST /api/reports routes impersonation reports to the named organisation.
- WebhooksPlannedPush verification outcomes and incident alerts into your systems. Not built yet.
- Privacy controlsAvailableUploads ≤ 4 MB, analysed and discarded; fingerprints and results kept; tenant isolation by row-level security.
Errors
One envelope: { error: { code, message, details } }. Codes are stable and documented.
Rate limits
Verify 60/min/IP · sandbox 10/min/IP · evidence 30/min/IP · consumer mutations 120/min/workspace.
Environments
This deployment is a sandbox: fictional organisations, synthetic data, no real money.