API Documentation

Two interfaces, one CA: a REST API for portal-style integrations and a full RFC 8555 ACME directory for automated lifecycle management. Every algorithm offered is FIPS 204 / 205 / 206 compliant.

Quick start

1. Get a bearer token

2. Hit the public algorithms endpoint

Confirm reachability and discover supported PQC algorithms — no auth required.

curl https://ca.quantumsecure.app/api/v1/crypto/algorithms

Supported PQC algorithms

Algorithm	NIST level	Spec	Signature size	Use case
ML-DSA-44	2	FIPS 204	~2.4 KB	Constrained / IoT
ML-DSA-65 (default)	3	FIPS 204	~3.3 KB	General-purpose TLS
ML-DSA-87	5	FIPS 204	~4.6 KB	High-security / long-life
Falcon-512	1	FIPS 206 (draft)	~666 B	Bandwidth-sensitive TLS
Falcon-1024	5	FIPS 206 (draft)	~1.3 KB	High-security, compact
SLH-DSA-SHA2-128s	1	FIPS 205	~7.9 KB	Hash-based fallback / code signing

The same list is served live at /api/v1/crypto/algorithms and is the source of truth for clients and SDKs.

REST endpoints

GET/api/v1/crypto/algorithms

Public

List supported PQC signature algorithms with NIST level, OID, and recommended-default flag.

POST/api/v1/auth/login

Public

Exchange email + password for a short-lived JWT bearer token.

POST/api/v1/orders

Bearer token

Create a certificate order (basic, premium, enterprise_ev, wildcard, multi_domain, code_signing).

POST/api/v1/orders/{order_number}/validate

Bearer token

Trigger HTTP-01 / DNS-01 domain control validation for an order.

POST/api/v1/certificates/issue

Bearer token

Issue a certificate against a validated order. Returns the leaf, classical chain, and PQC alt-signature payload.

GET/api/v1/certificates/{id}/download

Bearer token

Download the PEM bundle (leaf || intermediate(s) || root).

POST/api/v1/certificates/{id}/renew

Bearer token

Issue a fresh certificate with the same SAN list and a new key pair.

POST/api/v1/certificates/{id}/revoke

Bearer token

Revoke a certificate; the next CRL/OCSP refresh propagates the status.

POST/api/v1/verify

Public

Stateless verification of a PEM certificate including hybrid PQC alt-signature checks.

GET/acme/directory

Public

RFC 8555 ACME directory entry-point. Hosted on api.quantumsecure.app for clients (certbot, acme.sh, lego).

ACME directory (RFC 8555 + PQC)

QuantumSecure speaks vanilla ACME with classical keys, plus the PQC extensions described in our IETF draft draft-quantumsecure-acme-pqc-00. certbot, acme.sh, lego, and Caddy all work out of the box for classical-only mode; PQC mode uses a JWS with kty=PQC and alg=ML-DSA-65 (or the algorithm of your choice).

GET https://api.quantumsecure.app/acme/directory

Read the draft: draft-quantumsecure-acme-pqc-00.

Working examples

# 1. Authenticate
curl -X POST https://ca.quantumsecure.app/api/v1/auth/login \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "username=you@example.com&password=YOUR_PASSWORD"
# => { "access_token": "eyJhbGciOi...", "token_type": "bearer" }

# 2. List supported algorithms (no auth required)
curl https://ca.quantumsecure.app/api/v1/crypto/algorithms

# 3. Create an order
curl -X POST https://ca.quantumsecure.app/api/v1/orders \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "certificate_type": "basic",
    "common_name": "api.example.com",
    "subject_alt_names": ["api.example.com", "www.example.com"],
    "algorithm": "ML-DSA-65",
    "validity_days": 365
  }'

# 4. Issue once domain validation has completed
curl -X POST https://ca.quantumsecure.app/api/v1/certificates/issue \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ "order_number": "ORD-20260418-AB12" }'

Looking for conceptual guidance instead of API specs? Visit the Help Center.