API reference

Base URL https://api.kronoseal.com · JSON in, JSON out · all numbers of arbitrary size travel as strings. Every call needs an X-API-Key header (free Sandbox keys at kronoseal.com/#precios). Every response returns X-RateLimit-Plan, X-RateLimit-Remaining, X-Quota-Used, X-Quota-Limit and X-Quota-Reset.

POST /api/v1/kronoseal/generate

Resolves an index, or an exact size, to a certified prime. Same input, same prime.

Request

n_target	string	Decimal index, 1 to 1,000 digits. Exclusive with bits/digits.
bits	integer	Exact bit length of the prime, 16 to 3300. Exclusive with n_target and digits.
digits	integer	Exact decimal length of the prime, 5 to 994. Exclusive with n_target and bits.
seed	string	Optional with bits/digits, up to 128 characters. Same (seed, size) → same prime. Omitted: the server picks one and returns it.

Response

prime	string	The certified prime.
prime_digits · bits	integer	Decimal and binary length of the prime.
k	string	Composite mass associated with the index.
found	boolean	false means the bounded search did not converge; prime is then NOT certified. Does not occur in practice with the current engine.
n_target · n_digits · seed	string	The index actually used (derived in size mode) and the seed, when applicable.
request_id · processed_at	string	Receipt identifier and RFC 3339 UTC time.
engine_ns · server_ns	integer	Engine and total server time in nanoseconds.
signature	object	Ed25519 receipt, see Signatures.

POST /api/v1/kronoseal/validate

Certifies whether a candidate is prime.

Request

x_candidate

string

Decimal candidate, 1 to 1,010 digits.

Response

verdict	string	VERIFIED: the number is a certified prime. FAIL: it is not prime.
valid	boolean	verdict === VERIFIED.
digits · engine_ns · server_ns · request_id · processed_at · signature		As in generate.

GET /api/v1/kronoseal/stream (WebSocket)

Persistent session. Send {id, op: "generate" | "validate", n_target | bits | digits | seed | x_candidate}; receive {id, event: "accepted"} immediately and {id, event: "result", data} or {id, event: "error", error} when done. Up to 10 minutes per session.

GET /.well-known/kronoseal-keys.json

Public keys for signature verification: keys[] with key_id, alg (Ed25519), public_key (base64url) and public_key_hex. Cache for 5 minutes. Keys may rotate; always match on key_id.

Signatures (receipts)

Every generate/validate response includes signature = { alg: "Ed25519", key_id, signed, sig }. signed is the exact canonical string that was signed, so verification never depends on JSON serialization: verify sig over signed with the public key, then rebuild the canonical string from the response and your input and compare. The canonical string binds input, output, verdict, time and request id.

kronoseal/v1/generate
<request_id>
<processed_at>
input_sha256=<sha256 hex of n_target>
prime_sha256=<sha256 hex of prime>
prime_digits=<n>
found=<true|false>
engine_ns=<n>

kronoseal/v1/validate
<request_id>
<processed_at>
input_sha256=<sha256 hex of x_candidate>
digits=<n>
verdict=<VERIFIED|FAIL>
engine_ns=<n>

Errors and limits

400	Malformed JSON or unknown fields.
415	Content-Type must be application/json.
422	Input rejected: empty, non-decimal, longer than your plan allows (Sandbox 300 digits / 1024 bits, Growth 500 / 1700, Enterprise 1,000 / 3300), or both n_target and bits/digits.
401	Missing, unknown, revoked or expired X-API-Key.
403	Feature not in your plan (e.g. WebSocket stream on Sandbox).
429	Rate limit (per second) or quota (per window) exceeded; the body says which. Retry-After in seconds. Sandbox: 5/s, 10,000/month. Growth: 500/s, 1M/month. Enterprise: 20,000/s, 50M/month.
503	Engine saturated. Retry-After header. Bounded concurrency per instance.
Body	Maximum 64 KiB. Server write timeout 100 s: 1,000-digit indices can exceed it on the demo instance.

What to expect by size

Up to 100 digits: milliseconds anywhere. 300 digits: ≈ 20 ms on a dedicated instance, ≈ 0.5 s on the demo. 500 digits: ≈ 0.2 s dedicated, ≈ 6 s demo. 1,000 digits: 1-1.5 s dedicated, tens of seconds and possible timeouts on the demo. Measured 2026-09-11; the Performance section on the home page keeps the full table.