---
title: "A signed remediation receipt by its id (rc1:<sha256>): the record before a fix, the declared fix, when it went live, the record after and the verification verdict with the files that changed, signed Ed25519 over sha256(canonical JSON). Returned with the server's own check; &download=1 gives the file for the offline verifier (node crawlcheck-verify.mjs receipt.json). The id is unguessable: whoever holds it can open it"
method: GET
path: "/api/receipt"
---

# A signed remediation receipt by its id (rc1:<sha256>): the record before a fix, the declared fix, when it went live, the record after and the verification verdict with the files that changed, signed Ed25519 over sha256(canonical JSON). Returned with the server's own check; &download=1 gives the file for the offline verifier (node crawlcheck-verify.mjs receipt.json). The id is unguessable: whoever holds it can open it

`GET /api/receipt`

## Request

- Base URL: `https://crawlcheck.io`
- URL: `https://crawlcheck.io/api/receipt`
- Auth: none required

## Query parameters

- `id` string, required
- `download` string

## Response `200`

receipt + verification

- object
  - `ok` boolean, required
  - `receipt` RemediationReceiptV1, required: A signed remediation receipt (GET /api/receipt?id=). receipt_id = rc1: + sha256 of the canonical JSON of every field except receipt_id and signature; signature = Ed25519 over 'crawlcheck-receipt-v1\n' + that sha256
    - `receipt_id` string, required
    - `kind` 'crawlcheck-remediation-receipt', required
    - `v` unknown, required
    - `issued_at` string, required
    - `issuer` object, required
      - `observer` string, nullable
      - `version_id` string, nullable
      - `version_tag` string, nullable
      - `key` object, required
        - `kid` string, required
        - `jwk` object, required
        - `published_in` string, nullable
    - `subject` object, required
      - `domain` string, required
    - `before` ReceiptSideV1, required
      - `report_id` string, nullable, required
      - `scanned_at` string, nullable, required
      - `grade` string, nullable
      - `score` number, nullable
      - `score_version` number, nullable
      - `refused` boolean
      - `findings` number, nullable
      - `manifest_sha256` string, nullable
      - `decision_root` string, nullable
      - `trace_id` string, nullable
    - `after` ReceiptSideV1, required
      - `report_id` string, nullable, required
      - `scanned_at` string, nullable, required
      - `grade` string, nullable
      - `score` number, nullable
      - `score_version` number, nullable
      - `refused` boolean
      - `findings` number, nullable
      - `manifest_sha256` string, nullable
      - `decision_root` string, nullable
      - `trace_id` string, nullable
    - `declared_fix` object, required
      - `kind` string
      - `declared_by` string, nullable
      - `declared_at` string, nullable
      - `plugin_version` string, nullable
      - `fixes` string[], nullable
      - `note` string, nullable
    - `deployed` object, required
      - `at` string, nullable
      - `basis` string, nullable
    - `verification` object, required
      - `verdict` 'improved' | 'unchanged' | 'mixed' | 'regressed', required
      - `summary` string, nullable
      - `comparable` boolean
      - `findings` object
      - `rows` object
      - `files` object[]
        - `path` string
        - `state` string
        - `before_sha256` string, nullable
        - `after_sha256` string, nullable
        - `before_status` number, nullable
        - `after_status` number, nullable
      - `rollback_needed` boolean
      - `rollback_steps` object[]
      - `method` string, nullable
    - `links` object
    - `signature` object, required
      - `v` number, nullable
      - `alg` 'Ed25519', required
      - `kid` string, required
      - `over` string, nullable
      - `receipt_sha256` string, required
      - `message` string, required
      - `sig` string, required
      - `signed_at` string, nullable
      - `canonical` string, nullable
  - `verification` object, required
  - `outcomes` object: out1: for the domain's owner, FixOutcomesV1 with available:true; for anyone else {available:false, why, url}. Outside the signed receipt, so it never affects verification
  - `offline` object

## Other responses

- `404`: unknown id

---

[API](https://skmtc.dev/crawlcheck/apis/crawlcheck-api.md) · [All operations](https://skmtc.dev/crawlcheck/apis/crawlcheck-api/llms.txt) · [OpenAPI document](https://skmtc.dev/crawlcheck/apis/crawlcheck-api/revisions/57acbd6d4489?raw)