Architecture

The API sits between customer systems and the execution layer that handles local desktop clients, devices, providers, diagnostics, and asynchronous notifications.

High-level flow

1. 1Customer backend
2. 2Developer API
3. 3Tenant and API key validation
4. 4Request orchestration
5. 5Desktop client or service-side execution
6. 6API response and webhook events

Responsibilities

The customer backend owns business workflow decisions, request creation, and webhook handling.

The API owns authentication, tenant scoping, request validation, device routing, normalized responses, and operational event delivery.

The desktop client owns local device access, certificate discovery, signing execution, and local diagnostics.

Why this shape

Qualified-signature workflows often depend on local devices, provider-specific behavior, and regulated operational constraints. The API hides those differences behind consistent resources and response models.