REST referansı

Issues a one-time device-pairing secret plus 10 recovery codes. The user scans `qrCodeDataUrl` with the Touchque app within 5 minutes; you then receive a `DEVICE_LINKED` event webhook. If the user has an unlinked secret whose 5 minutes have passed, it is rotated in place (new secret, new recovery codes). WAF limit: 15/min per IP.

Kimlik: HMAC imzalı (x-api-key, x-timestamp, x-nonce, x-signature)

Rotates the user's secret in place and returns the new one immediately: unlinks the phone, lifts a freeze, clears the rejection counter and issues 10 new recovery codes (old ones stop working). The user must link again within 5 minutes. WAF limit: 5/min per IP.

Kimlik: HMAC imzalı (x-api-key, x-timestamp, x-nonce, x-signature)

Lower-assurance fallback when the phone is unavailable: confirms a PENDING request (`confirmedVia: RECOVERY_CODE`) and burns the code; fires the SUCCESS webhook. Refused for passkey-only requests and, unless `TenantPolicy.allowRecoveryForCritical`, for critical action types. The request's `expiresAt` is not checked — any request still in status PENDING can be approved. 10 attempts per user per 15 minutes.

Kimlik: HMAC imzalı (x-api-key, x-timestamp, x-nonce, x-signature)

Sends an approval request (push + socket) to the user's linked phone and returns its `requestId`. Poll `GET /login/status/{id}` or wait for the webhook; the request expires after 30 seconds.

Kimlik: HMAC imzalı (x-api-key, x-timestamp, x-nonce, x-signature)

Returns the state of a request of your workspace plus what it is bound to (user, action, reference, details), so you can check an approval is for THIS user and transaction. `assurance` and `approvalProof` are only set for CONFIRMED requests. This path bypasses the WAF entirely (no per-IP rate limit), so polling is safe.

Kimlik: HMAC imzalı (x-api-key, x-timestamp, x-nonce, x-signature)

Atomically marks a CONFIRMED request as used and returns what was approved. The first call wins; every later call answers 409 `already_used` (replayed token, second tab, retried form post). Call it right before running the protected action. No request body. There is no time limit once a request is CONFIRMED — an approval can be consumed at any later time.

Kimlik: HMAC imzalı (x-api-key, x-timestamp, x-nonce, x-signature)

For Touchque's own SSO: a request it sent for a customer organization (header `x-touchque-on-behalf-of`, honoured only for a platform organization's key), as that organization's case view shows it: status, how it was answered, the number the sign-in page showed once the request is over, the phone's platform, the risk score and reasons, and the phone-side case code. Any other caller, or another organization, gets 404.

Kimlik: HMAC imzalı (x-api-key, x-timestamp, x-nonce, x-signature)

For a sign-in or transaction you later learned was fraudulent (chargeback, account takeover, social engineering). Recorded in the audit log and, when a person acted on the request (see `trainingLabel`), sent to the risk engine as a strong training label. Does not change the request's status. Idempotent (`alreadyReported: true` on repeats). At most 60 reports per minute per workspace; WAF limit: 120/min per IP.

Kimlik: HMAC imzalı (x-api-key, x-timestamp, x-nonce, x-signature)

Called from the END USER's browser by the `@touchque/web` behavioral widget — not by your backend and not HMAC-signed. Authorised by the request's `telemetryToken`. When the browser sends an `Origin` and the workspace's organization has verified domains (Organization → Domains), the origin's host must be one of them or under one (`localhost` outside production); one that is not even on the same site counts as Mirror Alarm evidence, like the canary. Advisory: may raise the request's risk score, never changes its status. Always answers 200 once authorised (`accepted: false` when ignored). WAF limit: 20/min per IP.

Kimlik: Telemetri token'ı (tarayıcı)

For when the phone is offline: returns a QR encrypted for the user's device. The user scans it, the app shows a 7-character code, you check it with `POST /offline/verify`. Requires `TenantPolicy.offlineSignEnabled` and a phone enrolled for offline sign. Critical actions need `offlineAllowedForCritical` and `details`. At most 5 open challenges per user. The risk engine, the workspace's country rules, its access rules and the post-approval step-up mark apply as for a push, also when `requestId` names one: a refusal is a 403, a step-up puts a number on the QR (`challengeCode`, or the linked push's own number). `requireNumberMatch` is read as on `POST /login/request` (`"true"` and `1` count). WAF limit: 20/min per IP; 600/min per workspace.

Kimlik: HMAC imzalı (x-api-key, x-timestamp, x-nonce, x-signature)

For your own server to check a typed time-based code while it cannot reach Touchque (the Touchque RADIUS proxy uses it): salted, slow digests of each user's codes for the next steps, never a key. Requires `offlineSignEnabled`, `offlineTotpEnabled` and `outageVerifiersEnabled`; refused under a passkey-only policy. Users who cannot use time-based codes now get no entries: drop them. Fetch again every few minutes from the step you have, so removed and frozen users fall out within that time. Up to 480 steps (4 hours) ahead and 24,000 user-steps per call (50 users for 4 hours, 1,000 for 12 minutes); 30 calls a minute per workspace.

Kimlik: HMAC imzalı (x-api-key, x-timestamp, x-nonce, x-signature)

Lower-assurance fallback without a QR: the user opens the app and types its rolling 7-character code. Requires `offlineSignEnabled` and `offlineTotpEnabled`; refused when the workspace requires phishing resistance, and for critical action types (the linked push's type, or `type`; with a linked push a critical `type` is refused too). Each time step can be used once. A correct code is still a sign-in: the risk engine, the workspace's country rules, its access rules and the post-approval step-up mark apply as for a push, also when `requestId` names one. A code has no number to match, so any step-up answers `step_up_required` (show the QR instead), as does a linked push that was number-matched for a reason a typed code cannot answer (see `riskFactors`). An unreachable risk engine alone, and `alwaysRequireChallenge`, do not refuse it. On success, PENDING push requests of the user (of `type`, or of every type when omitted) are expired. No webhook. WAF limit: 30/min per IP.

Kimlik: HMAC imzalı (x-api-key, x-timestamp, x-nonce, x-signature)

Checks the 7-character code. 5 attempts per challenge; wrong codes also count towards a per-user lockout (`TenantPolicy.maxFailedChallenges`, default 5 per hour). On success, PENDING push requests of the same user and action type are expired (superseded). It does NOT confirm the linked push request and sends no webhook — treat `approved: true` as the approval. WAF limit: 30/min per IP.

Kimlik: HMAC imzalı (x-api-key, x-timestamp, x-nonce, x-signature)

Pair a browser (an extension, a desktop app) to a user by a QR code they scan with the Touchque app, like signing in to a messenger on the web. Put the pairing id, a one-time nonce and the browser key's thumbprint in the code: `touchque://pair-browser?v=1&p=<pairingId>&n=<nonce>&k=<keyThumbprint>`.

Kimlik: HMAC imzalı (x-api-key, x-timestamp, x-nonce, x-signature)

Where a pairing stands; once scanned, the account the phone holds with your workspace and how near the phone was to the browser. Poll it every second or two while the code is shown.

Kimlik: HMAC imzalı (x-api-key, x-timestamp, x-nonce, x-signature)

Your own checks refused a pairing that was scanned (an organization rule, a computer an administrator must approve first, too many browsers): the phone shows `message`, and the case or device code.

Kimlik: HMAC imzalı (x-api-key, x-timestamp, x-nonce, x-signature)

A user's recoveries (also completed transfers, `method: transfer`), newest first, or with `open=true` every running one of the workspace (e.g. for an admin's veto screen). At most 50.

Kimlik: HMAC imzalı (x-api-key, x-timestamp, x-nonce, x-signature)

For a user whose phone is lost, dead or replaced, after you checked the first factor (password, upstream IdP). Show `bindUri` as a QR: the Touchque app on the new phone scans it and binds its hardware key to this recovery. Then each voucher gets a number-matched approval on their own phone; the numbers appear in `vouchers[].code` (show them to the user, who reads one to each colleague on a call). The old phone, if alive, gets a request too: approving moves the account at once, rejecting stops it.

Kimlik: HMAC imzalı (x-api-key, x-timestamp, x-nonce, x-signature)

The colleagues the user named to vouch for a move to a new phone, and whether each can vouch today (`eligible`, or `reason`: `no_phone`, `no_hardware_key`, `keys_lost`, `frozen`, `on_probation`, `same_phone`). `probationUntil` is set while the user's own account is on probation after a vouch recovery.

Kimlik: HMAC imzalı (x-api-key, x-timestamp, x-nonce, x-signature)

Replaces the list (at most 5 other users of this workspace; the user themself and duplicates are dropped). Ask for the user's phone (or a passkey) before you call it: whoever can change the list chooses who may move the account. A list changed in the last 72 hours asks a recovery for one more voucher.

Kimlik: HMAC imzalı (x-api-key, x-timestamp, x-nonce, x-signature)

Moves the recovery on from what the phones answered, then returns it with the receipt chain. Poll it every few seconds while the user waits; the codes are present only while they can be used.

Kimlik: HMAC imzalı (x-api-key, x-timestamp, x-nonce, x-signature)

E.g. an organization admin who does not believe it. Does not freeze the user's 2FA.

Kimlik: HMAC imzalı (x-api-key, x-timestamp, x-nonce, x-signature)

A person's sessions, or every open one, newest first (50 at most).

Kimlik: HMAC imzalı (x-api-key, x-timestamp, x-nonce, x-signature)

Call it before your help desk acts on someone's account: a short-lived session bound to the agent and the person. By default their phone gets a calm notice, nothing to approve: "<agent> from IT is working on your account now." While it is open, the person's "someone says they're from IT" button shows this agent; with none open it tells them to hang up, and you get `ASSIST_CLAIM_UNVERIFIED`.

Kimlik: HMAC imzalı (x-api-key, x-timestamp, x-nonce, x-signature)

Poll it while a check is `pending`.

Kimlik: HMAC imzalı (x-api-key, x-timestamp, x-nonce, x-signature)

Ends the session; checks still waiting on the phone expire.

Kimlik: HMAC imzalı (x-api-key, x-timestamp, x-nonce, x-signature)

Call it right before you take the action: a `verified` check for the same `action`, at most ten minutes old, used once. Anything else is `428 check_required`.

Kimlik: HMAC imzalı (x-api-key, x-timestamp, x-nonce, x-signature)

Lifts a freeze (after "this isn't me" or repeated rejections), using a passed check for `unlock`.

Kimlik: HMAC imzalı (x-api-key, x-timestamp, x-nonce, x-signature)

Sends the person's phone a critical, number-matched request (type `HELPDESK_VERIFY`): "IT (<agent>) is about to <action> because someone on a call asked. Is that you on the call?" Show `challengeCode` to the agent; they read it to the person, who types it and approves with Face ID. Default deny. Wrong digits, "this isn't me" or "someone told me to" block it and raise an alert (`ASSIST_CHECK_FAILED`); "this isn't me" also freezes the account. The Vishing Shield does not block it: a call with IT is expected here.

Kimlik: HMAC imzalı (x-api-key, x-timestamp, x-nonce, x-signature)

The browsers that may sign this user in silently (forgotten ones are not listed), most recently seen first, at most 100.

Kimlik: HMAC imzalı (x-api-key, x-timestamp, x-nonce, x-signature)

A forgotten browser asks the phone again at its next sign-in; a new real approval makes it known again. Without `thumbprint` every browser of the user is forgotten (e.g. after a password reset or a reported takeover).

Kimlik: HMAC imzalı (x-api-key, x-timestamp, x-nonce, x-signature)

Silent sign-ins (re-prompt fatigue): call it before `POST /login/request` with the end user's `browserProof`. `prompt: false` means the sign-in may go on without asking the phone: the browser proved its device-bound key, passed a real second factor (a push that was not provisional, a passkey or an offline QR) within the allowed window, on the phone linked now, from a country and network the user approved from before, and the risk engine sees nothing new or risky. Otherwise call `POST /login/request` as usual, with the same `browserProof`, so the approval makes the browser known.

Kimlik: HMAC imzalı (x-api-key, x-timestamp, x-nonce, x-signature)

Kimlik: HMAC imzalı (x-api-key, x-timestamp, x-nonce, x-signature)

Kimlik: HMAC imzalı (x-api-key, x-timestamp, x-nonce, x-signature)

For pages login.request and risk.check do not cover (sign-up, password reset), or to know before the push: binds the identification to the account (one account per identification, 15 minutes) and asks the risk engine, which counts per visitor and decides. Every signal only asks for more and never blocks. `requestId` (the `touchque_request_id` form field the script tag fills, or deviceRisk.identify) or `deviceRisk` (deviceRisk.collect, relayed by your server). Send the field as it came: a missing, empty, unknown or expired one is still a verdict (`report`), never an error. Same budget as `/login/request`.

Kimlik: HMAC imzalı (x-api-key, x-timestamp, x-nonce, x-signature)

Kimlik: HMAC imzalı (x-api-key, x-timestamp, x-nonce, x-signature)

The workspace's identifications, newest first, one page at a time: a date range (7 days by default, at most 90, within the retention) and any of the filters, each on an index. Pass `nextCursor` back as `cursor` until it is null; do not page by changing `from`/`to`. A search that would read too much answers 422 `search_too_broad`: narrow the range or add a filter. A workspace runs two searches at a time and 120 a minute. For everything at once use the export, the `device_risk.*` webhooks or the organization's log stream.

Kimlik: HMAC imzalı (x-api-key, x-timestamp, x-nonce, x-signature)

What Touchque saw for a `requestId` the page sent you: the visitor, how sure, what the page showed and the risk engine's verdict. Never trust the page's own copy.

Kimlik: HMAC imzalı (x-api-key, x-timestamp, x-nonce, x-signature)

Streamed, one export of a workspace at a time (either format). JSON: one document written visitor by visitor; its `truncated` comes last. At most 50 000 visitors, 500 identifications per visitor, 200 000 identifications and 48 MB in all: past any of them `truncated: true`, export a shorter range. `X-Touchque-Truncated: true` is sent when the cut is known before the first byte (more than 50 000 visitors). A failure after the first byte still ends the document, with `truncated: true` and `stopped: true`: it is incomplete.

Kimlik: HMAC imzalı (x-api-key, x-timestamp, x-nonce, x-signature)

Sent by `@touchque/web` `deviceRisk.identify({ siteKey, purpose })` from your sign-in, sign-up, password-reset or approval page, as `text/plain` JSON so no CORS preflight is needed. Only from pages on your organization's verified domains (Organization → Domains) or your listed origins (Device risk settings). The page gets `{ visitorId, requestId, confidence }` only: your server reads the signals and the verdict by `requestId`. Rate limited per address and per site key. Through your own first-party proxy, send `X-Touchque-Proxy-Secret` (the settings' `proxySecret`) and `X-Touchque-Client-IP` (the visitor's address) so the visitor's address is counted, not the proxy's.

Kimlik: Herkese açık

Kimlik: HMAC imzalı (x-api-key, x-timestamp, x-nonce, x-signature)

Newest first: each identification with its visitorId, page, account, confidence and the risk engine's verdict (signals, enforced or not, case code). Coarse labels only, never a raw trait.

Kimlik: HMAC imzalı (x-api-key, x-timestamp, x-nonce, x-signature)

Kimlik: HMAC imzalı (x-api-key, x-timestamp, x-nonce, x-signature)

In production a new origin must use https (http only for localhost).

Kimlik: HMAC imzalı (x-api-key, x-timestamp, x-nonce, x-signature)

Pages with the old key stop identifying.

Kimlik: HMAC imzalı (x-api-key, x-timestamp, x-nonce, x-signature)

One point per UTC day, today last, from the daily rows the nightly job writes (kept 400 days, past the identifications' retention) and live where a day has none yet.

Kimlik: HMAC imzalı (x-api-key, x-timestamp, x-nonce, x-signature)

One page of an indexed query within the retention, newest first: a workspace with millions of visitors is searched and filtered, never listed whole. All the data goes out through the export, the `device_risk.*` webhooks and the organization's log stream.

Kimlik: HMAC imzalı (x-api-key, x-timestamp, x-nonce, x-signature)

Kimlik: HMAC imzalı (x-api-key, x-timestamp, x-nonce, x-signature)

Kimlik: HMAC imzalı (x-api-key, x-timestamp, x-nonce, x-signature)

The risk engine reads the mark with every identification of the visitor. `trusted` keeps only the signals about the page and the report (another site, a reused identification); it never skips any other check. `step_up` asks on every sign-in from the visitor, enforced at once.

Kimlik: HMAC imzalı (x-api-key, x-timestamp, x-nonce, x-signature)

Goes through the same pipeline as POST /login/request (freeze, push limit, risk engine, Actions, Vishing Shield, case code), always with biometrics. For a Safe registered in Safe Guard, its Touchque limits are checked first; its approvals keep working while Safe Guard is being turned off.

Kimlik: HMAC imzalı (x-api-key, x-timestamp, x-nonce, x-signature)

Kimlik: HMAC imzalı (x-api-key, x-timestamp, x-nonce, x-signature)

Kimlik: HMAC imzalı (x-api-key, x-timestamp, x-nonce, x-signature)

The canonical Safe v1.4.1 factory call with these owners and threshold, the rows it decodes to, the keccak256 of its data and the new Safe's address before it exists. The owner's own wallet sends it; then add the Safe with POST /safe-guard/safes. Touchque sends nothing.

Kimlik: HMAC imzalı (x-api-key, x-timestamp, x-nonce, x-signature)

Kimlik: HMAC imzalı (x-api-key, x-timestamp, x-nonce, x-signature)

Kimlik: HMAC imzalı (x-api-key, x-timestamp, x-nonce, x-signature)

Nothing changes on chain. The Safe must be readable on its network. The guard is always Touchque's own contract on that network (GET /safe-guard/overview `networks`); until the contract is audited, only test networks are available in production.

Kimlik: HMAC imzalı (x-api-key, x-timestamp, x-nonce, x-signature)

Kimlik: HMAC imzalı (x-api-key, x-timestamp, x-nonce, x-signature)

Kimlik: HMAC imzalı (x-api-key, x-timestamp, x-nonce, x-signature)

Only once its guard is off the Safe: while it is on, its approvals need this Safe here.

Kimlik: HMAC imzalı (x-api-key, x-timestamp, x-nonce, x-signature)

The phone reads the requested exit from the chain and signs its cancel (purpose 4, subject the exit time). Once it has, GET /safe-guard/safes/{id} gives the `exit.cancelTx` (guard.cancelExit) that anyone may send with any wallet.

Kimlik: HMAC imzalı (x-api-key, x-timestamp, x-nonce, x-signature)

Kimlik: HMAC imzalı (x-api-key, x-timestamp, x-nonce, x-signature)

Kimlik: HMAC imzalı (x-api-key, x-timestamp, x-nonce, x-signature)

The guard's setup (its batch target the canonical MultiSendCallOnly), the address book, the lock and setGuard in one delegatecall to MultiSendCallOnly, at the Safe's current nonce. The answer has the Safe's EIP-712 typed data for the owners' wallets (eth_signTypedData_v4) and the hashes a hardware wallet shows.

Kimlik: HMAC imzalı (x-api-key, x-timestamp, x-nonce, x-signature)

Kimlik: HMAC imzalı (x-api-key, x-timestamp, x-nonce, x-signature)

The phone decodes the same Safe transaction on its own and shows it with the hashes a hardware wallet shows, for an owner to compare before signing. It approves nothing: the phone signs purpose 16 (preview), which the guard never accepts. The proposal's `shown` says what each phone answered (same, different, waiting, expired).

Kimlik: HMAC imzalı (x-api-key, x-timestamp, x-nonce, x-signature)

The owner's eth_signTypedData_v4 signature of `typedData`. Kept only when it recovers to a current owner and the Safe's nonce has not moved; the same owner signing again replaces theirs.

Kimlik: HMAC imzalı (x-api-key, x-timestamp, x-nonce, x-signature)

Kimlik: HMAC imzalı (x-api-key, x-timestamp, x-nonce, x-signature)

The phone decodes the waiting change again and signs a veto (purpose 3). Once it has, GET /safe-guard/safes/{id} gives the `vetoTx` (guard.veto) that anyone may send with any wallet.

Kimlik: HMAC imzalı (x-api-key, x-timestamp, x-nonce, x-signature)

Whether passwordless passkey sign-in is on for the workspace, so a sign-in page shows its passkey button and passkey autofill only when it works (otherwise `POST /webauthn/authenticate/primary/options` answers 403 `passwordless_login_disabled`). Read-only.

Kimlik: HMAC imzalı (x-api-key, x-timestamp, x-nonce, x-signature)

Passwordless sign-in (no password, no phone). Requires `TenantPolicy.passwordlessLoginEnabled`. User verification is required only when `passwordlessRequireUserVerification` is on. With `externalUsername` the options list that user's passkeys (404 when there are none). Without it they accept any discoverable passkey of the site (empty `allowCredentials`), for passkey autofill (WebAuthn conditional mediation): the passkey the user picks names the account, and its `userHandle` must match the one it was registered with.

Kimlik: HMAC imzalı (x-api-key, x-timestamp, x-nonce, x-signature)

Verifies the assertion, then runs the risk engine and the workspace's country and access rules on the end user's `clientIp`. Success records a CONFIRMED login request (`confirmedVia: WEBAUTHN_PRIMARY`) and fires the SUCCESS webhook. If the engine answers CHALLENGE or asks for number matching (also when it is unreachable), an access rule requires step-up, the access policy cannot be read, or the country cannot be verified under a country rule, answers 200 with `requiresStepUp: true` — continue with `POST /login/request`. `alwaysRequireChallenge` does not step up a passkey. The attempt id is single-use even when verification fails.

Kimlik: HMAC imzalı (x-api-key, x-timestamp, x-nonce, x-signature)

Labels and metadata only, no key material. Lists credentials of every relying party of the workspace.

Kimlik: HMAC imzalı (x-api-key, x-timestamp, x-nonce, x-signature)

A removed passkey sends the `PASSKEY_DELETED` event webhook.

Kimlik: HMAC imzalı (x-api-key, x-timestamp, x-nonce, x-signature)

Authentication options scoped to one PENDING login request (e.g. one created with `requiresPasskey: true`). Valid for 5 minutes.

Kimlik: HMAC imzalı (x-api-key, x-timestamp, x-nonce, x-signature)

Verifies the assertion and confirms the request (`confirmedVia: WEBAUTHN`, phishing-resistant), then fires the SUCCESS webhook. The request's `expiresAt` is not checked — a request still in status PENDING can be approved.

Kimlik: HMAC imzalı (x-api-key, x-timestamp, x-nonce, x-signature)

Returns registration options for the browser. Your backend relays the ceremony: browser → your backend → Touchque (signed). The challenge is valid for 5 minutes. Uses the workspace's own relying party (domain) when configured. A user with a linked phone first approves a `PASSKEY_ENROLL` request: a passkey approves requests on its own, so a stolen session must not be able to add one.

Kimlik: HMAC imzalı (x-api-key, x-timestamp, x-nonce, x-signature)

Verifies the browser's attestation and stores the credential. When `TenantPolicy.requireVerifiedAuthenticator` is on, the authenticator must be listed in the FIDO Metadata Service. A stored passkey sends the `PASSKEY_REGISTERED` event webhook.

Kimlik: HMAC imzalı (x-api-key, x-timestamp, x-nonce, x-signature)

All action types of the workspace, including disabled ones.

Kimlik: HMAC imzalı (x-api-key, x-timestamp, x-nonce, x-signature)

Idempotent upsert by `type` — safe to call on every start-up. Never re-enables a type an admin disabled in the Dashboard; `description` and `critical` change only when sent.

Kimlik: HMAC imzalı (x-api-key, x-timestamp, x-nonce, x-signature)

Kimlik: HMAC imzalı (x-api-key, x-timestamp, x-nonce, x-signature)

How many recent decisions the draft would have changed and in which direction, how many notifications it would have sent, how often it fails and how long it takes. Nothing is sent; `api.fetch` is off; asked-for capabilities are assumed approved.

Kimlik: HMAC imzalı (x-api-key, x-timestamp, x-nonce, x-signature)