> ## Documentation Index > Fetch the complete documentation index at: https://docs.parmanasystems.com/llms.txt > Use this file to discover all available pages before exploring further. # Verify an Execution Trust Record > Deterministically re-validates the complete Execution Trust Record for businessTransactionId: recomputed hash vs. stored hash, signature verification, and authorization binding on every APPROVED Execution. All checks always run; failures are joined into one message. Appends a new immutable Verification to the record. ## OpenAPI ````yaml /openapi.bundled.yaml post /verify openapi: 3.1.0 info: title: Parmana API version: 1.0.0 description: > Parmana is an Execution Trust Infrastructure that ensures there is no gap between what humans decide and what AI systems do. The API enables creation, execution, verification, replay, and auditing of Business Transactions through cryptographically verifiable Execution Trust Records. **Every route requires a caller bearer key, except GET /health.** Send `Authorization: Bearer ` on every other request. Keys are issued by `scripts/generate-api-key.ts` and configured server-side via `PARMANA_API_KEYS`; only a hash of each key is ever held by the server, verified in constant time. A missing or invalid credential returns 401 before a Business Transaction is even constructed, independent of Policy evaluation and gateway attestation, see `packages/api/src/middleware/caller-auth.ts` and [Authentication](/api-reference/authentication). Local development may set `PARMANA_AUTH_DISABLED=true` to skip this middleware entirely; that flag must never be set in a real deployment. contact: name: Parmana email: support@parmana.ai license: name: Apache-2.0 identifier: Apache-2.0 servers: - url: http://localhost:3000 description: Local (packages/api, PORT env var, default 3000) security: - bearerAuth: [] tags: - name: Execution description: >- Executes a Business Transaction through the complete Execution Trust pipeline - name: Transactions description: Business Transaction creation and retrieval - name: Verification description: Deterministic verification of an Execution Trust Record - name: Receipts description: Cryptographically signed Execution Trust Receipts - name: Trust Records description: Execution Trust Record retrieval - name: Replay description: Deterministic replay of a recorded Execution Trust Record - name: Policies description: Policy existence/readability check - name: System description: Operational endpoints paths: /verify: post: tags: - Verification summary: Verify an Execution Trust Record description: > Deterministically re-validates the complete Execution Trust Record for businessTransactionId: recomputed hash vs. stored hash, signature verification, and authorization binding on every APPROVED Execution. All checks always run; failures are joined into one message. Appends a new immutable Verification to the record. operationId: verifyTransaction requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/verification-request.schema' examples: vendor-payment-flow: summary: Real captured request value: businessTransactionId: 44b34a79-e0f2-49d7-a48e-e52fff88182e responses: '200': description: >- Verification completed (status VERIFIED or FAILED, see the response schema; a 200 does not by itself mean verification succeeded). content: application/json: schema: $ref: '#/components/schemas/verification.schema' examples: vendor-payment-flow: summary: Real captured response value: verificationId: 63aac300-e0a8-47e9-9bb1-fd4b7d6cfdce businessTransactionId: 44b34a79-e0f2-49d7-a48e-e52fff88182e status: VERIFIED message: Execution Trust Record verified successfully. verifiedAt: '2026-07-13T17:42:11.002Z' trustRecordHash: >- e20a8861864f1a0a6c5fe00e64abca04de18a7d165a82ef9d7beb458c2096b3f '400': description: businessTransactionId missing or not a valid UUID. content: application/json: schema: $ref: '#/components/schemas/error.schema' examples: badUuid: summary: Real captured response value: error: businessTransactionId must be a valid UUID. '401': $ref: '#/components/responses/Unauthorized' '404': description: >- Execution Trust Record not found (VerificationFailedError, mapped through the generic RuntimeError branch, carries a code field, unlike most other 404s in this API). content: application/json: schema: $ref: '#/components/schemas/error.schema' examples: notFound: summary: Real captured response value: error: Execution Trust Record not found. code: VERIFICATION_FAILED components: schemas: verification-request.schema: $schema: https://json-schema.org/draft/2020-12/schema $id: https://schemas.parmana.ai/requests/verification-request.schema.json title: Verification Request description: >- Request payload for POST /verify. businessTransactionId is required and must be a valid UUID; both are rejected with a 400, with distinct messages depending on which check fails. type: object additionalProperties: true required: - businessTransactionId properties: businessTransactionId: type: string format: uuid description: Business Transaction to verify. examples: - businessTransactionId: eed2a972-1bf5-4166-8472-761f76fbf1b2 verification.schema: $schema: https://json-schema.org/draft/2020-12/schema $id: https://schemas.parmana.ai/common/verification.schema.json title: Verification description: >- Immutable result of verifying an entire Execution Trust Record: recomputed hash matches the stored hash, signature verifies, and every APPROVED Execution carries a non-empty authorizationId. All checks always run and are reported together in message; a failure in one does not skip the others. type: object additionalProperties: true required: - verificationId - businessTransactionId - status - verifiedAt - trustRecordHash properties: verificationId: type: string description: Unique Verification identifier. businessTransactionId: type: string description: Business Transaction being verified. status: type: string description: Verification result. enum: - VERIFIED - FAILED message: type: string description: >- Human-readable verification summary: either the success message, or every failed check's message joined with "; ". verifiedAt: type: string format: date-time description: UTC timestamp when verification completed. trustRecordHash: type: string description: >- Hash of the verified Execution Trust Record, proving exactly which record was verified. examples: - verificationId: 0ad69d3f-7fd0-4507-ab38-e386146757ae businessTransactionId: eed2a972-1bf5-4166-8472-761f76fbf1b2 status: VERIFIED message: Execution Trust Record verified successfully. verifiedAt: '2026-07-07T16:38:59.344Z' trustRecordHash: 989aef83d595202ec02bb338ac00461abec0541098ea065f965b5cde342d3b25 error.schema: $schema: https://json-schema.org/draft/2020-12/schema $id: https://schemas.parmana.ai/common/error.schema.json title: Error Response description: >- Shared error envelope produced by packages/api/src/middleware/error-handler.ts and by every route's inline validation checks. error is always a plain human-readable string (never a nested object). code is present only when the failure was a RuntimeError subclass reaching the centralized error handler (VerificationFailedError, ReceiptGenerationError, or an uncategorized RuntimeError); it is absent from every inline route-level check (businessTransactionId format/required checks) and from BusinessTransactionValidationError, PolicyValidationError, SignalValidationError, PolicyNotFoundError, DuplicateBusinessTransactionError, and the generic 500 fallback. POST /policies/validate does NOT use this envelope at all. See its own response schema. For the triggering condition and recommended caller action behind any specific error/code/status combination, see the Error catalog at /api-reference/error-catalog. type: object additionalProperties: false required: - error properties: error: type: string description: Human-readable error message. code: type: string description: >- Stable machine-readable error code. Only present for errors that reach the handler as a RuntimeError. examples: - RUNTIME_ERROR - VERIFICATION_FAILED - RECEIPT_GENERATION_FAILED examples: - error: businessTransactionId must be a valid UUID. - error: >- Business Transaction 'eed2a972-1bf5-4166-8472-761f76fbf1b2' already exists. - error: >- Execution rejected: Vendor payment rejected because the assessed payment risk exceeds the maximum permitted threshold. code: RUNTIME_ERROR responses: Unauthorized: description: >- Missing or invalid caller credential (StaticKeyAuthenticator returned no identity). Real captured response, packages/api/src/middleware/caller-auth.ts. content: application/json: schema: $ref: '#/components/schemas/error.schema' examples: authRequired: summary: Real captured response, missing or invalid Authorization header value: error: authentication required securitySchemes: bearerAuth: type: http scheme: bearer description: > Caller API key issued by scripts/generate-api-key.ts. Sent as Authorization: Bearer . Verified against a stored SHA-256 hash in constant time by packages/api/src/auth/StaticKeyAuthenticator.ts. Required on every route except GET /health. See /api-reference/authentication. ````