> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sumvin.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Quickstart

> Set up your SIS organisation and run your first working verifier end-to-end.

At the end of this page, you will have a configured SIS organisation, an environment with a live auth provider, a minted API key, and a real call to:

[`GET /v0/sis/pint/{pint_id}/status`](/api-reference/pint/get-pint-status) — Returns `200 OK`, proof that your verifier is wired up and ready to receive production traffic.

## Prerequisites

* A dashboard account at [dash.sis.sumvin.com](https://dash.sis.sumvin.com).
* Credentials for an auth provider — either Dynamic or Privy. See the [auth providers guide](/dashboard/auth-providers) for where to find these in each console.
* A test environment you can use for local development.

<Steps>
  <Step title="Create your organisation">
    Sign in at [dash.sis.sumvin.com](https://dash.sis.sumvin.com) and complete the onboarding wizard. Enter your organisation name and contact email. Your `organisation_id` is auto-assigned and visible under **Organisation → Settings** — you will use it as a path parameter in SIS API calls.
  </Step>

  <Step title="Create an environment">
    Go to the **Environments** page and click **New environment**. Give it a machine-readable name (for example `development`) and a display label (for example `Dev`). Each environment gets its own `environment_id` and a separate set of SDK credentials — keep these scoped to the matching entry in your auth provider's console.
  </Step>

  <Step title="Configure an auth provider">
    Select your new environment, then open the **Authentication** tab. Choose Dynamic or Privy and paste the provider credentials for this environment. See the [auth provider setup guide](/dashboard/auth-providers) for where to find the right values.

    Once saved and activated, SIS validates JWTs issued by this provider for all requests scoped to this environment.
  </Step>

  <Step title="Add allowed origins">
    Open the **CORS** tab on any environment. Add the origins your app runs on — for example `http://localhost:3000` for local development or `https://app.yourco.com` for production.

    <Warning>
      CORS origins apply across all environments in your organisation. An origin added for local development is also permitted in production. See the [CORS guide](/dashboard/cors-origins) for configuration advice.
    </Warning>
  </Step>

  <Step title="Mint an API key">
    Go to the **API Keys** page and click **New API key**. Give it a recognisable name and copy it when the dashboard shows it — the full key is displayed once, then only a prefix. Store it somewhere safe (a secret manager, not source control). See the [API keys guide](/dashboard/api-keys).

    <Warning>
      Treat the API key like a password. Anyone with it can call SIS on your organisation's behalf.
    </Warning>
  </Step>

  <Step title="Run your first verifier call">
    Use the API key to hit the SIS revocation-status endpoint. This is the working artefact — a live, authenticated call against the SIS production API.

    <Note>
      The placeholder URI `sr:us:pint:test` below will return `404 Not Found` — that is the expected, successful outcome for wiring verification. A `404` here means SIS accepted your key and processed the request; it does not mean anything is misconfigured.
    </Note>

    <CodeGroup>
      ```bash curl theme={null}
      curl "https://sis.sumvin.com/v0/sis/pint/sr%3Aus%3Apint%3Atest/status" \
        -H "Authorization: Bearer <your-sis-api-key>"
      ```

      ```typescript TypeScript theme={null}
      const pintUri = "sr:us:pint:test";
      const res = await fetch(
        `https://sis.sumvin.com/v0/sis/pint/${encodeURIComponent(pintUri)}/status`,
        {
          headers: { Authorization: `Bearer ${process.env.SIS_API_KEY}` },
        },
      );
      console.log(res.status, await res.json());
      ```

      ```python Python theme={null}
      import httpx
      import os
      from urllib.parse import quote

      pint_uri = "sr:us:pint:test"
      res = httpx.get(
          f"https://sis.sumvin.com/v0/sis/pint/{quote(pint_uri, safe='')}/status",
          headers={"Authorization": f"Bearer {os.environ['SIS_API_KEY']}"},
      )
      print(res.status_code, res.json())
      ```
    </CodeGroup>

    You will see one of these responses, all of which confirm your key authenticated successfully:

    <Snippet file="product-term-disambiguation.mdx" />

    **If the <Tooltip headline="Stamped Mandate" tip="A signed authorisation a user grants for specific scoped actions — delivered on the wire as a PINT." cta="Learn more →" href="/identity/pint">Stamped Mandate</Tooltip> is active:** `200 OK`

    ```json theme={null}
    {
      "_links": { "self": { "href": "..." } },
      "id": "sr:us:pint:test",
      "valid": true,
      "reason": null,
      "revoked_at": null
    }
    ```

    **If it is revoked or expired:** `200 OK` with `valid: false` and a populated `reason` (`"revoked"` or `"expired"`). A revoked credential also includes `revoked_at`. The credential was found — it is simply no longer usable.

    **If it does not exist for your organisation:** `404 Not Found` with an RFC 7807 error body. Status lookups are audience-scoped, so a `404` means no Stamped Mandate matching that URI has been issued under your organisation. This is expected for the placeholder URI above — what matters is that SIS accepted your key and processed the request.

    <Check>Your verifier is wired up. Replace the placeholder URI with a real incoming Stamped Mandate (PINT URI) in production and you are ready to check revocations.</Check>
  </Step>
</Steps>

## What's next

| Next                  | Where                                                                           | When                                                              |
| --------------------- | ------------------------------------------------------------------------------- | ----------------------------------------------------------------- |
| All quickstarts       | [All quickstarts](/overview/quickstart-index)                                   | The full index of quickstarts and how this one fits in            |
| Standard verification | [Verify a standard Stamped Mandate](/merchant/quickstarts/verify-standard-pint) | Five-minute end-to-end verifier quickstart                        |
| Verifier orientation  | [Verifier overview](/merchant/overview)                                         | What credentials you receive and what you need to verify          |
| Core concepts         | [Organisations](/dashboard/organisations)                                       | The auth model — organisations, environments, and how they relate |
| Configuration depth   | [Auth providers](/dashboard/auth-providers)                                     | Providers, CORS origins, and API key management                   |