v1.7.0 to v2.0.0

---

name: sanctifai-trust-proof-of-human

description: Integrate SanctifAI Trust Proof-of-Human attestations. Use when an app needs cryptographic proof a human performed a task or human-in-the-loop verification.

homepage: https://trust.sanctifai.com

updated: 2026-09-07

---

# SanctifAI Trust — Proof of Human

```

```txt

task_type: "PHARMABOT_TREATMENT_REVIEW"

task_type: "EVA"

domain: "MED"

task_subtype: "Treatment plan review"

```

### After-the-fact proof

```js

```

```js

// POST /api/trust/presence/start — your server

export async function POST(req) {

const r = await fetch('https://trust.sanctifai.com/api/presence/start', {

method: 'POST',

headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${process.env.TRUST_API_KEY}` },

body: JSON.stringify({

...body,

tenant_id: process.env.TRUST_TENANT_ID,

user_id: userId,

idempotency_key: crypto.randomUUID(),

}),

});

const { session_id } = await r.json();

return Response.json({ session_id });

}

```

```js

const b64uToBuf = (s) => { const p = s.replace(/-/g,'+').replace(/_/g,'/').padEnd(s.length+(4-s.length%4)%4,'='); const b = atob(p); const u = new Uint8Array(b.length); for (let i=0;i<b.length;i++) u[i]=b.charCodeAt(i); return u.buffer; };

const bufToB64u = (buf) => { const u = new Uint8Array(buf); let s=''; for (let i=0;i<u.length;i++) s+=String.fromCharCode(u[i]); return btoa(s).replace(/\+/g,'-').replace(/\//g,'_').replace(/=+$/,''); };

const sha256Hex = async (d) => { const j = typeof d==='string'?d:JSON.stringify(d,Object.keys(d).sort()); const h = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(j)); return '0x'+Array.from(new Uint8Array(h)).map(b=>b.toString(16).padStart(2,'0')).join(''); };

const API = 'https://trust.sanctifai.com';

async function createAttestation(taskData, resultData, { taskId, taskType='GEN', domain='GEN', taskSubtype } = {}) {

const task_commitment = await sha256Hex(taskData);

const result_commitment = await sha256Hex(resultData);

const { session_id } = await fetch('/api/trust/presence/start', {

method: 'POST', headers: { 'Content-Type': 'application/json' },

body: JSON.stringify({

task_id: taskId ?? `task-${Date.now()}`,

task_commitment, result_commitment, bond_eligible: true,

rp_id: location.hostname, origin: location.origin,

}),

}).then(r => r.json());

const { options } = await fetch(`${API}/api/presence/options`, {

method: 'POST', headers: { 'Content-Type': 'application/json' },

body: JSON.stringify({ session_id }),

}).then(r => r.json());

const cred = await navigator.credentials.get({ publicKey: {

...options,

challenge: b64uToBuf(options.challenge),

allowCredentials: (options.allowCredentials || []).map(c => ({ ...c, id: b64uToBuf(c.id) })),

}});

return fetch(`${API}/api/presence/verify`, {

method: 'POST', headers: { 'Content-Type': 'application/json' },

body: JSON.stringify({ session_id, expedite: true, credential: {

id: cred.id, rawId: bufToB64u(cred.rawId), type: cred.type,

clientExtensionResults: cred.getClientExtensionResults?.() ?? {},

response: {

clientDataJSON: bufToB64u(cred.response.clientDataJSON),

authenticatorData: bufToB64u(cred.response.authenticatorData),

signature: bufToB64u(cred.response.signature),

userHandle: cred.response.userHandle ? bufToB64u(cred.response.userHandle) : null,

},

}}),

}).then(r => r.json()); // -> { participation_id, certificate_url, qr_url, ... }

}

```

```html

<script src="https://trust.sanctifai.com/sanctifai-presence.js"></script>

<script>

await SanctifAIPresence.waitForReady(5000);

const result = await SanctifAIPresence.createAttestation({

});

// result.participation_id, result.certificate_url, result.qr_url

</script>

```

```

or GET {APP_BASE_URL}/api/v1/attestations/{id}/wait

```

**`POST {APP_BASE_URL}/api/v1/attestations`**

```json

{

"task_type": "GEN",

"domain": "GEN",

"task_subtype": "Chat approval",

"taskData": { "summary": "opaque task payload" },

"resultData": { "decision": "approved" }

}

```

## Deeper material