​
Hybrid Attest

POST /v1/sign/hybrid Create a hybrid attestation that pairs an ECDSA signature with a post-quantum ML-DSA signature. The server verifies both signatures before persisting the attestation. Authentication: Secret key required (qs_sec_*)

​
Request

{
  "message": "0x48656c6c6f20576f726c64",
  "ecdsaSignature": "0x3045022100abc123...",
  "ecdsaPublicKey": "0x04a1b2c3d4e5f6...",
  "pqcSignature": "0x7a8b9c0d1e2f3a4b...",
  "pqcPublicKey": "0x1a2b3c4d5e6f7a8b...",
  "algorithm": "ml-dsa-65",
  "chain": "ethereum",
  "metadata": {
    "txHash": "0xabc123...",
    "label": "Treasury transfer approval"
  }
}

​
Parameters

FieldTypeRequiredDescription
messagestringYesThe signed message (hex-encoded)
ecdsaSignaturestringYesECDSA signature over the message (hex-encoded)
ecdsaPublicKeystringYesECDSA public key (hex-encoded)
pqcSignaturestringYesPQC signature over the message (hex-encoded)
pqcPublicKeystringYesPQC public key (hex-encoded)
algorithmstringYesPQC algorithm: ml-dsa-44, ml-dsa-65, ml-dsa-87
chainstringNoAssociated blockchain (default: ethereum)
metadataobjectNoArbitrary metadata to attach to the attestation
All cryptographic fields (message, signatures, public keys) must be hex-encoded.

​
Server-Side Verification

Before storing the attestation, the server performs:
  1. ECDSA verification: Recovers the signer from ecdsaSignature and verifies it matches ecdsaPublicKey
  2. PQC verification: Verifies pqcSignature against message using pqcPublicKey and the specified algorithm
  3. Public key registration check: Confirms the pqcPublicKey is registered in QuantumSafe
  4. Attestation creation: Links both signatures and stores the record
If either signature is invalid, the request is rejected with PQC_004.

​
Response 201 Created

{
  "data": {
    "id": "att_abc123def456",
    "status": "verified",
    "message": "0x48656c6c6f20576f726c64",
    "ecdsaPublicKey": "0x04a1b2c3d4e5f6...",
    "pqcPublicKey": "0x1a2b3c4d5e6f7a8b...",
    "algorithm": "ml-dsa-65",
    "chain": "ethereum",
    "metadata": {
      "txHash": "0xabc123...",
      "label": "Treasury transfer approval"
    },
    "createdAt": "2026-01-15T10:30:00Z"
  },
  "meta": {
    "requestId": "req_xyz789",
    "timestamp": "2026-01-15T10:30:00Z"
  }
}

​
Response Fields

FieldTypeDescription
idstringUnique attestation identifier
statusstringAlways verified on success
messagestringThe attested message
ecdsaPublicKeystringECDSA signer public key
pqcPublicKeystringPQC signer public key
algorithmstringPQC algorithm used
chainstringAssociated blockchain
metadataobjectUser-provided metadata
createdAtstringISO 8601 timestamp

​
Errors

CodeDescription
AUTH_001Missing API key
AUTH_003Publishable key used (Secret key required)
PQC_001Unsupported algorithm
PQC_002Invalid key format
PQC_004Signature verification failed (ECDSA or PQC)
RATE_001Rate limit exceeded
PQC_004 is returned when either the ECDSA or the PQC signature fails verification. Check both signatures carefully before submitting.

​
Example

curl -X POST https://api.qsafe.dev/v1/sign/hybrid \
  -H "Authorization: Bearer qs_sec_live_sk_abc123..." \
  -H "Content-Type: application/json" \
  -d '{
    "message": "0x48656c6c6f20576f726c64",
    "ecdsaSignature": "0x3045022100...",
    "ecdsaPublicKey": "0x04a1b2c3...",
    "pqcSignature": "0x7a8b9c0d...",
    "pqcPublicKey": "0x1a2b3c4d...",
    "algorithm": "ml-dsa-65",
    "chain": "ethereum"
  }'