H33 Primitives API - Post-Quantum, Portable Attestation Infrastructure

H33 Primitives API is post-quantum, portable attestation infrastructure.

You submit decision substrate and receive a post-quantum-signed attestation that survives outside H33 and re-verifies anywhere.

Every endpoint call leaves behind an independently verifiable receipt. The receipt is hash-linked, signed with three post-quantum signatures (ML-DSA-65 + FALCON-512 + SLH-DSA-128f), and fetchable at GET /v1/receipts/{id}. A regulator, auditor, or counterparty can prove what the API did at time T - without contacting H33.

The v0.1 API is deliberately small. Six primitives. No workflows. No AI inference in the request path. The primitive discipline is the feature.

SIX PRIMITIVES:

• Bundles: POST /v1/bundles returns a SHA3-256-addressed bundle ID.
• Attestations: POST /v1/attestations returns a 3-PQ-signed attestation pinning per-decision state_ids.
• Submissions: POST /v1/submissions returns a firm-signed regulatory submission event.
• Verifiers: GET /v1/verifiers returns discovery of vendor-independent verifier releases.
• Replay: POST /v1/replay returns a deterministic state_id reproducing the decision.
• Portability: POST /v1/portability/verify returns a reconstructability verdict.

Each primitive supports POST (issue), GET /{id} (fetch), POST /{id}/verify (independent verification). Verification produces a structural verdict; it never produces an opinion.

WHAT IS ONE ATTESTATION:

One attestation = one Merkle root, regardless of items beneath it. Attest one document, one million transactions, or an entire computation batch. Same primitive. Same price. Every attestation includes FHE computation, SHA3-256 commitment, ML-DSA-65 + FALCON-512 + SLH-DSA-128f signatures, and the permanent 74-byte H33-74 primitive. Post-quantum is the floor, not a premium feature. No classical-only option exists.

EVERY CALL RETURNS JSON PLUS EVIDENCE:

Every endpoint call adds an X-H33-Receipt-Id header. The receipt JSON contains the endpoint, timestamps, SHA3-256 hashes of request and response bodies, a prev_receipt_hash chain link, three post-quantum signatures, and the signer's public-key fingerprint. Chain head and signer pubkey are public. A consumer can re-verify a receipt using only the public key, with no H33 contact required.

USE CASES:

• A firm transmits decision substrate to a regulator. POST bundle, attestation, submission. The regulator runs the open-source verifier - the loop closes without contacting H33.
• An auditor reconstructs API activity. Pull receipts, verify signatures with the public pubkey, prove what the API did at time T without trusting H33.
• A counterparty verifies an inherited substrate during diligence. POST /v1/portability/verify returns a Twin-reconstructability verdict.

TECHNICAL SPECIFICATIONS:

• Encryption: H33-PQ-1 envelope (ML-KEM-768 + AES-256-GCM, inside TLS)
• Signatures: ML-DSA-65 + FALCON-512 + SLH-DSA-128f (NIST FIPS 203/204/205-aligned)
• Hashing: SHA3-256 throughout; artifact IDs are content hashes
• Storage: Content-addressed; tamper-evident by construction
• Verification CLI: Vendor-independent open-source binaries at h33.ai/verifier/

PRICING:

$0.001 per attestation issued. Pay-as-you-go on AWS Marketplace; volume tiers and committed-use discounts available for enterprise contracts.

H33 is an H33.ai, Inc. company. Documentation: h33.ai/docs. Public verifier: github.com/H33ai/h33-verifier. Support: support@h33.ai .