Productions

Verify a compliance certificate

Validates a stored JWT compliance certificate against Easy2257's records: RS256 signature, expiry, revocation, and that the certificate belongs to the production in the URL. Use it for a nightly sweep or a dashboard check. For real-time signals prefer the production.takedown_requested webhook and the daily revocation list. For an offline check with no API call at all, verify the JWT against the public JWKS at https://easy2257.com/.well-known/jwks.json.

post/api/v1/productions/{productionId}/verify-certificate

Request

  • Base URL: https://easy2257.com
  • URL: https://easy2257.com/api/v1/productions/{productionId}/verify-certificate
  • Auth: HTTP bearer

Path parameters

productionIdstring required
Example:cmd3p8w1k0002qz8h9j4r7v5s

Request body

certificatestring required

The RS256 JWT compliance certificate Easy2257 issued, as delivered in the production.documented webhook.

Example request

{
  "certificate": "eyJhbGciOiJSUzI1NiIsImtpZCI6ImV6MjI1Ny1hZDg4ODUyYyJ9..."
}

Response

The check ran. Read valid: this status is returned for good and bad certificates alike.

validboolean required

The only field you should branch on. A 200 response says the check ran, not that the certificate is good.

productionIdstring
issuedAtstring date-time

Present when valid is true.

expiresAtstring date-time

Present when valid is true.

currentStatusstring

Current production documentation status. Present when valid is true. unknown if the production row has since been removed.

reason'certificate_revoked' | 'certificate_superseded' | 'certificate_expired' | 'certificate_not_found' | 'signature_mismatch' | 'invalid_certificate' | 'no_public_key' | 'public_key_not_configured' | 'production_id_mismatch'

Machine-readable failure reason, present when valid is false. certificate_superseded means a newer certificate replaced this one, either at annual renewal or when the producer reissued the sealed package after a correction: swap in the replacement (from the production.certificate_renewed webhook, the newer production.documented delivery, or GET /api/v1/productions/{productionId}/certificates); the content stays up. certificate_revoked means the certified record was pulled: take the content down. production_id_mismatch arrives with HTTP 400: the certificate verified, but it belongs to a different production than the one in the URL. no_public_key and public_key_not_configured are Easy2257-side signing key problems, so retry rather than treating the certificate as bad.

Example response

{
  "productionId": "cmd3p8w1k0002qz8h9j4r7v5s",
  "currentStatus": "documented"
}

Changes

No recorded changes to this operation across all 1 revision of this API.