# hiumans.com: proof that a person answered

> Create a link, send it to someone, and get signed proof that a person physically unlocked their own device (fingerprint, face or PIN) to answer it. No accounts and no registration.

## Use it from an agent

1. Create a check:
   POST https://www.hiumans.com/api/checks
   Content-Type: application/json
   {"mode": "standard", "ttl_hours": 24, "note": "optional private note"}
   mode is "standard" (any device with fingerprint, face or PIN) or "strict" (certified hardware only, such as YubiKey or Windows Hello).
   ttl_hours is one of: 24, 1, 168.

2. The response contains send_url, api_url and key. Give send_url to the person. Keep key private.

3. Poll api_url (GET, about every 5 seconds) until status is "passed", "failed" or "expired".
   Statuses: waiting (not opened), opened (opened, no unlock yet), passed, failed (too many bad attempts), expired.

4. When status is "passed", the "receipt" field holds an EdDSA-signed JWT. Verify it with the key at https://www.hiumans.com/.well-known/jwks.json.
   Check that the receipt's "jti" equals your check id and "iss" equals this site.

## What a pass means

- A person unlocked a real device after the check was created, once, within the time limit.
- In strict mode, the device also proved it is certified hardware.
- It does not identify the person, and it does not prove that no AI agent was involved: an agent can forward the link to a person.

## Limits

- An ordinary AI agent cannot complete a check by itself: the device prompt needs a person. In standard mode a purpose-built device emulator could; strict mode refuses anything that is not certified hardware.
- Check creation is rate limited per network address.