Skip to main content
POST
cURL

Authorizations

Authorization
string
header
required

Caller API key issued by scripts/generate-api-key.ts. Sent as Authorization: Bearer . Verified against a stored SHA-256 hash in constant time by packages/api/src/auth/StaticKeyAuthenticator.ts. Required on every route not listed as exempt in this document's top-level description. See /api-reference/authentication.

Body

application/json

Request payload for POST /verify. businessTransactionId is required and must be a valid UUID; both are rejected with a 400, with distinct messages depending on which check fails.

businessTransactionId
string<uuid>
required

Business Transaction to verify.

Response

The check ran. Read status: VERIFIED or FAILED. A 200 alone does not mean the record verified.

Response returned by POST /verify and GET /verification/{businessTransactionId}: a Verification.

verificationId
string
required

Unique Verification identifier.

businessTransactionId
string
required

Business Transaction being verified.

status
enum<string>
required

Verification result.

Available options:
VERIFIED,
FAILED
verifiedAt
string<date-time>
required

UTC timestamp when verification completed.

trustRecordHash
string
required

Hash of the verified Execution Trust Record, proving exactly which record was verified.

message
string

Human-readable verification summary: either the success message, or every failed check's message joined with "; ".