VerifyProof API

v0.2.0 · checks PP-SPEC-077 v0.8.x Units of Proof · Author: Craig Ellrod, Nebulonium, Inc., originator of the Proof Economy

Send a proof, get a verdict. Every check names the Proof Protocol section it enforces, so anyone can repeat it. People use this API; agents use the same checks over MCP. Both get the same answer.

Quick start

curl -X POST https://verifyproof.org/api/v1/check \
  -H "Content-Type: application/json" \
  -d @proof.json

Where proof.json is {"record": { ...Unit of Proof... }}. The response is HTTP 200 whatever the verdict; read verdict. No key needed. Machine-readable spec: /openapi.json (OpenAPI 3.1).

Verdicts

valid	Every check passed, including signer trust, Merkle inclusion, registration and revocation.
invalid	At least one check failed. Not proof.
incomplete	Nothing failed, but a required check could not run. Not proof until the gaps listed in `gaps` are closed: send `commitments` or `merkle_proof`, `trusted_keys`, and `check_registry: true`.

Try it

Paste a request body for /api/v1/check. The sample is a correctly signed demo record; it comes back incomplete because nothing pins its keys or confirms its registration.

{
  "record": {
    "spec": "PP-SPEC-077",
    "run_id": "dcp-2026-11-07-0001",
    "technique": "T1190",
    "variant": "mutated",
    "color": "red",
    "path": {
      "ingress": "edge-gw-01",
      "effect_token": "7f3a9c21e0b4",
      "route": [
        "waf-a"
      ],
      "effect_point": "db-audit-01",
      "target": {
        "level": "cut",
        "id": "rule-942100"
      },
      "cadence": "full",
      "clutch": null
    },
    "claim": null,
    "attribution_level": "cut",
    "sut": "acme-prod-web",
    "dut": "ExampleWAF 9.2",
    "cut": "rule-942100",
    "dut_fingerprint": "eff51f128ffee7a1ab6bcde2e7976fe41dd6620fbaab390f409e48c473020083",
    "cut_fingerprint": "26347b197b5bdd3752d4924302749047da4525b24a23e70533b2e8b9bf09b297",
    "fingerprint_status": "current",
    "effect_point": "db-audit-01",
    "outcome": "stopped",
    "detected": true,
    "commitment": "1907c1a1c5da41a5269591743bf5e7ae17f0fd8c58a590f3ea69acde409244da",
    "merkle_root": "04bc0137ee2dbcc6a424ce21b0cae043ecbeb0a5b14f56f7d1e67118f9813d11",
    "time_anchor_commit": "drand:quicknet:12345678",
    "ingress_record": "7811cf6b0989edab7d8307fb525258576ed44f9ce2779c60c5bc7011f4187926",
    "witness_record": "f56e216bc2bd426a1d3d62e83aa1bd16e2f1316b5e863a5d61d7d73bbba6f451",
    "witness_operator": "Independent Witness LLC",
    "witness_coverage_map": "61ef3d97481ccbcfd6afd3004802a275a9b8cf0a283aafa6f25c618d5c445cc4",
    "holder": {
      "id": "acme-ciso",
      "public_key": "6846a9a1d00ba997bfd511b1706a47c1aedbe5f1882c8ced53de4bfbc336755e"
    },
    "disclosure": "public",
    "valid_through": null,
    "disclosed_interests": [],
    "proofregister_uri": "https://proofregister.com/record/PR-2026-00001",
    "registry_receipt": "15f327357bdd6965dc8458d5b7db5cda044e839f7bcc01cdb124a3d733cac241",
    "uop_id": "3b7140ba23aa11eab64fae158b4dfd7e62b7e754cc597604aa3d702354917416",
    "signatures": [
      {
        "role": "issuer",
        "key": "b7cbb79d6755f5add8947797f9c22d026cda727d86e430782cc255f97179f67e",
        "sig": "39ce0cf0765eed72aadb9de8f42a43423d2d5d8a1cb97bfa82da67e966cb660ed013c1796399f7071becf713accf33035f4366fdf8e38fe02b8167d1460a0c09"
      },
      {
        "role": "witness",
        "key": "5e475dc32d6e2f6bdb3948ba6c4c0989f19a302eb82ffa6a64e559d0ed1c8447",
        "sig": "cf4ab74be5837c9e85a77b6f09f204b7b1bdb2db9b86a2bdb731cb867ff36704dff156c93a918219eb429ed901c457b73df8618b165433d816f27100a07d150b"
      }
    ]
  }
}

Endpoints

POST `/api/v1/check`

Check a proof. Verify a Unit of Proof: schema, Record ID, issuer and witness signatures, signer trust, Merkle inclusion, commitment opening, consistency, registration and revocation.

Field	Meaning
`record` required	The Unit of Proof JSON record
`merkle_proof`	Inclusion path from the commitment to merkle_root, leaf-up. Omit promoted levels.
`commitments`	All c_i of the run in leaf order; R is recomputed (9.5). Use instead of merkle_proof.
`reveal`	Public reveal for this canary (9.4.1); opens the commitment.
`content_reveal`	Holder-only content reveal (9.4.2); checks d_i.
`trusted_keys`	Pinned Ed25519 public keys per role (hex, base64, multibase z..., or PEM).
`check_registry`	Fetch proofregister_uri and the revocation endpoint.

curl -X POST https://verifyproof.org/api/v1/check \
  -H "Content-Type: application/json" \
  -d '{"record":"<Unit of Proof JSON>"}'

POST `/api/v1/check-uri`

Fetch a proof from a Registry and check it. Fetch the record at `uri` (e.g. proofregister.com) and check it, including the registry lookup.

Field	Meaning
`uri` required	Registry URI of the record
`merkle_proof`	Inclusion path from the commitment to merkle_root, leaf-up. Omit promoted levels.
`commitments`	All c_i of the run in leaf order; R is recomputed (9.5). Use instead of merkle_proof.
`reveal`	Public reveal for this canary (9.4.1); opens the commitment.
`content_reveal`	Holder-only content reveal (9.4.2); checks d_i.
`trusted_keys`	Pinned Ed25519 public keys per role (hex, base64, multibase z..., or PEM).
`check_registry`	Fetch proofregister_uri and the revocation endpoint.

curl -X POST https://verifyproof.org/api/v1/check-uri \
  -H "Content-Type: application/json" \
  -d '{"uri":"https://proofregister.com/record/PR-2026-00001"}'

POST `/api/v1/record-id`

Compute a Record ID. SHA-256("DCP-1:record" || RFC 8785 canonical form), registration fields and uop_id removed (SPEC 21.1).

Field	Meaning
`record` required	The Unit of Proof JSON record

curl -X POST https://verifyproof.org/api/v1/record-id \
  -H "Content-Type: application/json" \
  -d '{...}'

POST `/api/v1/merkle/verify`

Verify Merkle inclusion. Check that commitment c_i is in root R (SPEC 9.2: leaf 0x43, node 0x45, odd node promoted). Give an inclusion path or the full commitment list.

Field	Meaning
`commitment` required	string
`merkle_root` required	string
`merkle_proof`	array
`commitments`	array

curl -X POST https://verifyproof.org/api/v1/merkle/verify \
  -H "Content-Type: application/json" \
  -d '{...}'

GET `/api/v1/schemas/uop`

PP-SPEC-077 Unit of Proof JSON Schema.

curl https://verifyproof.org/api/v1/schemas/uop

GET `/healthz`

Health.

curl https://verifyproof.org/healthz

Connect over MCP

Agents connect to https://verifyproof.org/mcp (Streamable HTTP). Tools: check_proof, check_proof_by_uri, compute_record_id, verify_merkle_inclusion.

claude mcp add --transport http verifyproof https://verifyproof.org/mcp

Proof Protocol License 1.0. Licensor: Nebulonium, Inc. Security reports: craig@hackerverse.ai.

VerifyProof API

Quick start

Verdicts

Try it

Endpoints

POST /api/v1/check

POST /api/v1/check-uri

POST /api/v1/record-id

POST /api/v1/merkle/verify

GET /api/v1/schemas/uop