Polyguard for developers

Polyguard Developer Resources

Everything needed to integrate Polyguard identity verification: the Polyguard REST API and its OpenAPI specification, authentication and rate-limit conventions, SDKs for web, iOS, and Android, and machine-readable files for AI agents.

API reference SDK guides Request API access

The Polyguard API

The Polyguard Identity Verification API is a public REST API. Authenticate with an API key sent in the x-pg-api-key request header; the key acts as the issuing user and carries that user's role. Keys are issued per account; there is no self-serve issuance and no public sandbox key.

Base URL
https://api.polyguard.ai
Auth header
x-pg-api-key
Description format
OpenAPI 3.1 (JSON)
Token verification
JWKS
# Every request carries an API key issued for your account.
curl -sS https://api.polyguard.ai/applications \
  -H 'x-pg-api-key: $POLYGUARD_API_KEY'

# Unauthenticated liveness probe.
curl -sS https://api.polyguard.ai/health
# {"status":"ok"}

Resource index

Every Polyguard developer resource, at a stable URL.

Polyguard API

  • OpenAPI 3.1 specification

    Machine-readable description of every endpoint, schema, and response in the Polyguard Identity Verification API. Also reachable at polyguard.ai/openapi.json.

  • Interactive API reference

    Browse and try the Polyguard API from the browser. Also reachable at polyguard.ai/api-docs.

  • Health endpoint

    Unauthenticated liveness probe. Returns {"status":"ok"}.

  • JWKS

    Public keys for verifying the signed verification tokens Polyguard returns.

Polyguard SDKs

For AI agents

  • llms.txt

    Index of this site for language models, including when to use Polyguard and how to call it.

  • agents.md

    Long-form agent instructions: best-fit jobs, call patterns, rate limits, and terminology.

  • .well-known/api-catalog

    RFC 9727 API catalog naming every public Polyguard API and its OpenAPI description.

  • sitemap-index.xml

    Every indexable page on polyguard.ai, in all three locales.

Rate limits

Endpoints under https://polyguard.ai/api/ return rate-limit headers on every response, in both the current IETF form and the earlier RateLimit-* triple, so a client can self-throttle without guessing. Read the headers rather than hard-coding an interval, because the published limits can change.

Header Meaning
RateLimit IETF form, e.g. "default";r=58;t=42, giving remaining requests and seconds until the window resets.
RateLimit-Policy The quota in force, e.g. "default";q=60;w=60, meaning 60 requests per 60 seconds.
RateLimit-Limit Requests allowed in the current window.
RateLimit-Remaining Requests left in the current window.
RateLimit-Reset Seconds until the current window resets.
Retry-After Sent only with a 429 response. Seconds to wait before retrying.

A 429 Too Many Requests response always carries Retry-After. Rate limits on https://api.polyguard.ai are set per account; your limits are confirmed when your API key is issued.

When to reach for Polyguard

Polyguard fits when a decision depends on which human is on the other end of a remote interaction, and being wrong is expensive.

  • Confirm a remote job applicant is a real, unique person

    Add a Polyguard trust check to the application flow so bot-submitted, synthetic, and duplicate candidates are rejected before they reach the applicant tracking system. Integrates with Greenhouse, Rippling, and Workday.

  • Confirm the person who joins a video interview is the candidate who applied

    Polyguard runs real-time facial recognition before any attendee joins the call, so a deepfake or a stand-in cannot sit the interview in the applicant's place. PG-Presence additionally confirms the candidate is physically at their own device rather than relaying through remote desktop. Works with Zoom and Microsoft Teams; no bot joins the call and nothing is recorded.

  • Verify an employee before a help desk password reset or account change

    Before making any change, the help desk agent sends a verification request through Polyguard from ServiceNow, Jira Service Management, or their ticketing system. The employee completes a trust check on their enrolled device, and the agent proceeds only on a confirmed result.

  • Verify a counterparty before a wire, transfer, or contract signature

    A trust check at the moment of the transaction produces a signed result and, optionally, a transaction affidavit that can be retained as evidence.

  • Embed identity verification in your own product

    The Web, iOS, and Android SDKs plus the REST API let you trigger a trust check from your own flow and receive a signed verification token.

  • Produce evidence that a verification happened

    Transaction affidavits are litigation-ready records of a verification event, exportable for compliance reporting and audit.

The full list, including the jobs Polyguard is not the right tool for, is in /agents.md.

Get an API key

API keys are issued per account. Tell us what you are building and we will get you a key and a sandbox account.

Request access Build with Polyguard

Or email sales@polyguard.ai.