---
title: "Verify Compliance Report Canonical"
method: GET
path: "/v1/verify/{content_hash}/canonical"
tags: ["verify-public"]
---

# Verify Compliance Report Canonical

`GET /v1/verify/{content_hash}/canonical`

## Request

- Base URL: `https://api.bitpoort.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.bitpoort.com/v1/verify/{content_hash}/canonical`
- Auth: none required

The byte-exact signed artifact — the true court-grade download.

Resolves every family ``GET /v1/verify/{hash}`` resolves: compliance reports,
case bundles, signed artifacts, AND the Bitpoort Registry's public rows — for
a registry row it serves the exact canonical bytes the row's content_hash is
taken over.

``GET /v1/verify/{hash}`` returns a WRAPPER whose ``canonical_body`` is
re-serialized by the JSON layer, so ``sha256(that response) != content_hash``
— it is a human-readable convenience view, not the signed artifact. THIS
endpoint returns the exact bytes the signature was computed over, so a
recipient verifies with no re-encoding and no trust in any JSON serializer::

    curl -s https://api.bitpoort.com/v1/verify/<hash>/canonical | sha256sum
    # -> <hash>

Public (the hash is the bearer token) and cached like /pdf. Refuses to serve
bytes that fail their own hash — a signed artifact that doesn't verify is the
exact false-trust failure this product exists to prevent.

## Path parameters

- `content_hash` string, required: SHA-256 content hash from a generate_compliance_report attestation. Returns the EXACT signed bytes; sha256(response) == content_hash.

## Response `200`

Successful Response

- unknown

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/bitpoort/apis/bitpoort-api.md) · [All operations](https://skmtc.dev/bitpoort/apis/bitpoort-api/llms.txt) · [OpenAPI document](https://skmtc.dev/bitpoort/apis/bitpoort-api/revisions/1a51d8566777?raw)