---
title: "Verify an audit receipt"
method: POST
path: "/api/v1/audit/verify-receipt"
---

# Verify an audit receipt

`POST /api/v1/audit/verify-receipt`

## Request

- Base URL: `https://app.axiorank.com`
- URL: `https://app.axiorank.com/api/v1/audit/verify-receipt`
- Auth: none required

Convenience verifier: POST a receipt and get the per-check result. This is NOT the trust anchor - the authoritative path is the open-source verifier run against a key you pinned out-of-band, which needs no trust in this endpoint. Public and rate-limited.

## Request body

- AuditReceipt: A self-contained, offline-verifiable proof for one audit row.
  - `version` 1, required
  - `auditLogId` string, uuid, required
  - `workspaceId` string, uuid, required
  - `rowHash` string, required: Hex SHA-256 over the row's immutable fields.
  - `leafHash` string, required
  - `leafIndex` integer, required
  - `treeSize` integer, required
  - `inclusionPath` object[], required
    - `dir` 'L' | 'R', required
    - `hash` string, required
  - `signedTreeHead` SignedTreeHead, required: An Ed25519-signed Merkle tree head over a sealed checkpoint window.
    - `seq` integer, required
    - `merkleRoot` string, required: Hex RFC 6962 root over the window's row hashes.
    - `treeSize` integer, required
    - `prevCheckpointHash` string, required: Binds the STH into the append-only chain.
    - `checkpointHash` string: This checkpoint's own hash, signed on self-anchored (v2) heads. Absent on v1.
    - `fromTs` string, date-time, required
    - `toTs` string, date-time, required
    - `workspaceId` string, uuid, required
    - `algorithm` 'EdDSA', required
    - `merkleVersion` integer, required
    - `treeAlgo` string, required
    - `keyId` string, required: RFC 7638 thumbprint of the signing key (JWKS lookup id).
    - `signedAt` string, date-time, required
    - `signature` string, required: base64url Ed25519 over the canonical STH.
  - `provenance` object: The Ed25519-signed delegation-provenance token (who authorized the action).

## Response `200`

The verification result (per-check + overall).

- VerifyReceiptResponse
  - `ok` boolean, required
  - `checks` object, nullable, required
    - `leaf` boolean: leafHash matches SHA-256(0x00 ‖ rowHash).
    - `rowBinding` boolean, nullable: Null unless the row is supplied.
    - `inclusion` boolean: Proof folds to the signed Merkle root.
    - `sthSignature` boolean: Tree-head signature verifies.
    - `provenance` boolean, nullable: Provenance token verifies (null if none).
    - `approver` boolean, nullable: Every human-approval signature verifies (null if none present).
  - `reason` string: Present only when ok is false.

## Other responses

- `400`: Malformed or oversized receipt.
- `429`: Rate limited.

---

[API](https://skmtc.dev/axiorank/apis/axiorank-gateway-api.md) · [All operations](https://skmtc.dev/axiorank/apis/axiorank-gateway-api/llms.txt) · [OpenAPI document](https://skmtc.dev/axiorank/apis/axiorank-gateway-api/revisions/d8a7a33656e4?raw)