---
title: "Verify Downloaded Report"
method: POST
path: "/api/v1/verify/report"
tags: ["verify"]
---

# Verify Downloaded Report

`POST /api/v1/verify/report`

## Request

- Base URL: `https://api.badgeia.com`
- URL: `https://api.badgeia.com/api/v1/verify/report`
- Auth: none declared

#1296 — check the report FILE you were handed (the JSON download).

Body: the document from ``GET /savings-reports/{id}?format=json``. The
signature is checked over ``badge-savings-report-v1 NUL`` + canonical JSON
of its ``payload``, so an edited figure, name or agent id fails. An integral
number respelt by a JSON tool (``0.0`` -> ``0``) is not an edit (#1424);
``canonical_form`` says whether the current or the pre-#1424 form matched. A bad
signature answers 200 with ``valid=false`` and no identity fields: an
unauthenticated document is never echoed back as if it were trusted.
Hostile bodies (oversize, bad UTF-8, too deep, duplicate keys) are 413/422,
never 500. Public; flag off -> 404.

## Response `200`

Successful Response

- ReportBodyVerifyResponse: Result of checking a downloaded report file (POST /verify/report).
  - `valid` boolean, nullable, required
  - `status` 'valid' | 'invalid' | 'unverifiable', required
  - `agent_id` string, uuid, nullable
  - `generated_at` string, date-time, nullable
  - `payload_sha256` string, nullable
  - `key_id` string, nullable
  - `reason` string, nullable
  - `canonical_form` 'current' | 'legacy', nullable

---

[API](https://skmtc.dev/badgeia/apis/badge.md) · [All operations](https://skmtc.dev/badgeia/apis/badge/llms.txt) · [OpenAPI document](https://skmtc.dev/badgeia/apis/badge/revisions/7e7f7fee8b77?raw)