Integrating with trustmint

This is the developer / integrator documentation for trustmint — the device-trust, registry, telemetry, and factory tier of the FlexGalaxy.AI APaaS platform. It is the front door for engineers who integrate against trustmint: firmware and backend engineers at a factory (Syrius Robotics and future partners), platform integrators wiring device fleets onto FlexGalaxy.AI, and anyone building against trustmint’s REST/gRPC surfaces.

What trustmint is. trustmint onboards physical devices (things), mints their trust anchors and identity certificates, carries telemetry and twin state, and connects normalized streams to rules and destinations. Owner services publish external integration routes through api.flexgalaxy.ai; console remotes use a separate same-origin private API surface. Device firmware speaks the DDI-1 wire contract (HTTPS 443 mTLS + MQTT 8883) directly.

Where you call it.

Host

What it serves

api.flexgalaxy.ai

the trustmint capability API

api.staging.flexgalaxy.ai

the same API, one release ahead — integration testing

console.flexgalaxy.ai

the browser consoles

Paths are capability paths, not service names — /provisioning/v1/…, /access/v1/…, /telemetry/v1, /twins/v1/…, /rules/v1/…, /pki/v1/…. The CLI reference lists every group. Releases are promoted behind those hostnames without changing them, so an integrator addresses exactly the two API hosts above and nothing else, ever.

Auth in one paragraph. Authentication proves who you are; authorization is decided centrally by the platform, not by claims you carry. Users reach the consoles by SSO. Factory services authenticate machine-to-machine with an access-key / secret-key pair using the canonical FGAI-HMAC signing scheme (FGAI4 derived key — not AWS SigV4). A 403 therefore means the platform decided your principal may not perform that action on that resource; adding a role to a token cannot change it. See Registration and Roles and access.

Where to start

  • Never touched trustmint? → Getting started walks you zero-to-registered in one hour.

  • Need credentials? → Registration mints an AK/SK pair and explains FGAI-HMAC signing.

  • Wiring the HTTP surface? → API reference renders the generated thingmake OpenAPI (four endpoint groups).

  • Building or diagnosing a console integration? → Console applications and private APIs defines the nine remotes and the browser/external API boundary.

  • Firmware engineer? → DDI-1 contract is the canonical device wire contract.

Contents

Integrating with trustmint

Protocol & trust

Concepts & design

Meta