GRgraypass
canonical

Verify and optionally consume a proof

Verify signature/binding/current proof state and optionally consume the proof once for the pending operation.

post/api/v1/verify

Request

  • Base URL
    https://app.graypass.org (the document declares no server; this is the origin it was published from)
  • URL
    https://app.graypass.org/api/v1/verify
  • Auth
    HTTP bearer

Request body

audiencestring required

Expected relying-party audience. It must be permitted by the action and independently known to the verifier.

consumeboolean

Default false performs a state check. Set true immediately before the protected operation to attempt one-time consumption; it is a separate transaction from your business database.

expected_actionstring required

Action key independently retained with the pending business request.

expected_action_hashstring required

64-character SHA-256 hex action hash computed from the original server-held material, never learned from an unverified proof.

proofstring required

Compact JWS obtained through your trusted authorization workflow. First perform the documented offline and subject/tenant/environment binding checks.

Response

valid flag with verified claims on success, or refusal reason on failure; both can use HTTP 200.

claimsobject nullable

Verified proof claims when valid, otherwise null. Compare them with the application’s independent expectations.

reasonstring nullable

Stable verification refusal reason when invalid, otherwise null.

validboolean required

True only when all online checks succeed and, if requested, one-time consumption succeeds.

Changes

No recorded changes to this operation across all 1 revision of this API.