How AI is applied across API Evangelist and APIs.io. Read my AI disclosure →
API Evangelist API Evangelist
Discovery
Learnings
Guidance
Toolbox
Alignment
API Evangelist LLC

Tvarka ATK API Auth API

The eID authentication ceremony (`/v1/auth/*`).

Tvarka ATK API Auth API is one of 10 APIs that Tvarka ATK API publishes on the APIs.io network, described by a machine-readable OpenAPI specification.

Tagged areas include Authentication. The published artifact set on APIs.io includes an OpenAPI specification and API documentation.

This API exposes 5 operations across 5 paths, and defines 18 schemas. It is described by OpenAPI 3.2.0, at version 1.3.0.

Requests are made against a single base URL, https://atk.tvarka.pro/v1.

5 operations 5 paths 18 schemas 1 GET4 POST

Metadata

The identity and technical contract details declared by the specification.

Specification
OpenAPI 3.2.0
API Version
1.3.0
Base URL
https://atk.tvarka.pro/v1
Authentication
HTTP Basic, HTTP Bearer, API Key
Resource Areas
1

Authentication & Security 3

Tvarka ATK API Auth API declares 3 security schemes for authenticating requests. It accepts HTTP basic authentication (basicAuth). It accepts HTTP bearer tokens (JWT) (clientToken). An API key is passed in the query as downloadToken (downloadToken). By default, every request must be authenticated.

  • basicAuth — Provider server-to-server credentials keyId:keySecret. Server-to-server only, also gated by the provider's server IP allow-list. Never placed in a browser/mobi…
  • clientToken — Short-lived, per-request JWT (ES256) minted at request creation, scoped {tenant, requestId, purpose, method, allowedOrigins}. Safe to hand to a browser/mobile…
  • downloadToken — One-off token returned with a completed sign result, for fetching the signed document.

Paths & Operations 5

Across 5 paths, the API surfaces 5 operations — 1 GET, 4 POST. Each is listed below with its method, path, parameters, and response codes.

Auth 5

The eID authentication ceremony (/v1/auth/).

POST
/auth/requests
Create an authentication request (server-to-server)
createAuthRequest body → 202400401403429503
POST
/auth/{requestId}/certificate
Submit the card's authentication certificate; receive the DTBS + challenge
submitAuthCertificate 1 param body → 200401403404409422
POST
/auth/{requestId}/complete
Submit the raw card signature; receive the verified identity
completeAuth 1 param body → 200401403404409422
GET
/auth/{requestId}
Poll request status / fetch the result
getAuthRequest 1 param → 200401404
POST
/auth/{requestId}/cancel
Cancel a non-terminal request
cancelAuthRequest 1 param → 200404409

Schemas 18

The contract defines 18 schemas that model the data the API accepts and returns. The most detailed are AuthRequestState (9 properties), AuthRequestCreated (9 properties), AuthRequestCreate (7 properties), CertificateChallenge (7 properties). Each schema is shown below with its type and property counts.

CertificateSubmit
object
1 property 1 required
ErrorBody
object
4 properties 2 required
Method
string
physical = desktop reader; nfc = phone tap; smartid/mobileid = server-side remote eID.
AuthResult
object
5 properties 4 required
Error
object
1 property 1 required
SignatureAlgorithm
string
Card-reported JWS-style algorithm.
AuthRequestCreated
object
Physical requests return clientToken; NFC requests return pairing; remote methods return neither.
9 properties 5 required
AuthRequestState
object
9 properties 3 required
ErrorCode
string
The full stable error-code catalog of the ATK API family (auth + sign + services); each endpoint returns the subset that applies to it. By HTTP status: 400 inv…
PairingHint
object
3 properties
HashAlgOid
string
Digest algorithm OID, curve-matched. SHA-256 = 2.16.840.1.101.3.4.2.1; SHA-384 = 2.16.840.1.101.3.4.2.2.
AuthRequestCreate
object
7 properties 2 required
CompleteSubmit
object
4 properties 3 required
CertSubject
object
Selected subject fields from the certificate. serialNumber holds PNOLT- .
5 properties
CertificateChallenge
object
7 properties 6 required
Status
string
Flat request status. Non-terminal - pending, awaitingCard, awaitingCredentials, finalizing. Terminal success - done. Terminal failure - cancelled/timeout/devic…
SignatureEncoding
string
Raw ECDSA signature encoding. P1363 = fixed-width r||s; DER = SEQUENCE(r, s). Informational - the server auto-detects and accepts either encoding regardless of…
Challenge
object
Canonical atk-auth-v1 anti-relay challenge. The server issues nonce; dtbs returned above = HASH( HASH(utf8(audienceorigin)) || HASH(utf8(nonce)) ) with HASH ma…
3 properties 3 required

Specification

The full machine-readable OpenAPI contract behind this narrative.

Source

tvarka-atk-api-auth-api-openapi.yml Raw ↑

Other APIs Tvarka ATK API publishes across the network.

Tvarka ATK API Erasure API
Tvarka ATK API LTV API
Tvarka ATK API Pairing API
Tvarka ATK API Sign API
Tvarka ATK API Tvarka ATK API API
Tvarka ATK API Tvarka ATK QES Signing API (paid Tier Addendum) API
Tvarka ATK API Validation API
Tvarka ATK API Well Known API
Tvarka Sign API
Where this information came from

This is an independent, third-party profile of Tvarka ATK API Auth API, published by API Evangelist. We do not operate, host, resell, or support these APIs, and we are not affiliated with or endorsed by the company unless stated above. Everything here is built from publicly available information — the company's own site, developer portal, documentation, public repositories, and the specifications it publishes for public use. Nothing is obtained by breaching a system, defeating an access control, or using credentials.

The Kin Score and Agent Readiness rating are independently calculated assessments of a company's public API artifacts, scored against a published rubric. They are not certifications, endorsements, security assessments, or audits.

Corrections, re-scores, and removal are free — no partnership or purchase required, and you do not need to justify the request. A removed company is recorded as unrated, never scored zero for having asked. Acknowledgement within one business day; removal within two.

info@apievangelist.com · Read the full data-sourcing policy →
On a security or compliance team? Put security in the subject line and you will get a person, not a form — we will tell you exactly which public URLs this profile was built from.