POST a target_url. Get back a QURL. Your resource disappears from the public internet. No agents, no sidecars, no DNS changes.
One required field. One endpoint. Any web resource.
curl -X POST https://api.layerv.ai/v1/qurls \
-H "Authorization: Bearer $LAYERV_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"target_url": "https://internal.example.com/dashboard"
}'{
"data": {
"resource_id": "r_k8xqp9h2sj9",
"qurl_link": "https://qurl.link/at_abc123def456",
"qurl_site": "https://r_k8xqp9h2sj9.qurl.site",
"expires_at": "2026-03-06T10:30:00Z"
},
"meta": {
"request_id": "req_abc123"
}
}target_url is the only required field. Everything else has sensible defaults. Full reference in the API docs.
Resource has no public DNS. No open ports. Port scans return nothing. The service does not exist on the internet.
A cryptographic pinhole opens for exactly one user, one device, one session. Traffic flows through the QURL.
QURL expires. Pinhole closes. Full audit trail preserved. Resource returns to invisible.
QURLs don't log users in. They temporarily bring services into existence.
All fields available on the POST /qurl endpoint.
POST /v1/qurl
{
"target_url": "https://internal.example.com/dashboard", // required
"expires_in": "1h", // duration: "1h", "7d", "1w" (default: 24h)
"one_time_use": true, // single-use access (default: false)
"max_sessions": 5, // concurrent session limit (default: 0 = unlimited)
"access_policy": {
"ip_allowlist": ["10.0.0.0/8"] // IP, geo, user-agent controls
},
"description": "Contractor access",
"metadata": { "ticket": "JIRA-456" }
}Fire QURL creation from your IdP post-auth webhook. Okta, Azure AD, Auth0 — any OIDC provider.
Drop a middleware into your Express/Next.js/FastAPI stack. Auto-mint QURLs on authenticated requests.
JavaScript and Python SDKs are in development. In the meantime, the REST API works from any language with one HTTP call.
One POST endpoint. One required field. Works from any language, any platform, any CI/CD pipeline.
Add QURL creation to your IdP post-auth flow. Existing access remains as fallback. No DNS changes. No firewall modifications. Test with one resource in production.
Update DNS to point through QURL. Close all public ports. Resource is now invisible to the internet. Only QURL-authenticated sessions can reach it.
Same key exchange as Signal and WireGuard. Forward secrecy, mutual auth.
Cloud Security Alliance standard. Open-source protocol, open-source reference implementation.
Deployed across US-East and US-West. Sub-50ms QURL creation. 99.99% uptime target.
Standard JWT-based authentication. OIDC compliant. Works with your existing IdP.
Stage 1 overlay mode. If QURL is unreachable, existing access continues. Zero downtime risk.
Business impact, compliance benefits, and risk reduction metrics.