---
title: "Read a count-only receipt-attestation authority snapshot."
method: GET
path: "/api/receipt-attestations/authority-snapshot"
tags: ["Run Cards"]
---

# Read a count-only receipt-attestation authority snapshot.

`GET /api/receipt-attestations/authority-snapshot`

## Request

- Base URL: `https://huggingbay.xyz`
- URL: `https://huggingbay.xyz/api/receipt-attestations/authority-snapshot`
- Auth: HTTP bearer

Reader-authenticated, same-origin, no-state-change inspection contract. Runs one bounded REPEATABLE READ, READ ONLY PostgreSQL snapshot and returns only row counts for receipt attestations and receipt state events. Its digest covers only those disclosed counts and the query version. It can show net row creation/deletion count differences, but cannot prove equal content, detect state transitions, or reveal verifier-key lifecycle/status or moderation/revocation values. It never refreshes sessions, records page events, starts migrations, or mutates authority state.

**Inputs.** No path or query fields are required. No request body is required.

**Outputs.** See each status below for its media type, schema and headers. A missing record or unavailable capability is not a successful empty result.

**Errors.** API JSON failures use the documented response schema. Read code, message and next; retry only when the response allows it. Auth, invalid input and missing records need a caller change.

**Rate limits.** Public read budgets apply by client IP and route group. This operation can have a smaller route-specific budget. Read Retry-After on 429 or retryable 503 responses.

**Example setup.** Set HUGGING_BAY_TOKEN to a credential with the role or scope stated by this operation. Reader tokens do not grant publisher or operator rights.

## Response `200`

Count-only authority snapshot with no state change.

- ReceiptAttestationAuthoritySnapshot: Read-only count projection. It can show only net row creation/deletion count differences; it does not expose or detect receipt content, state transitions, moderation/revocation values, or verifier-key lifecycle/status.
  - `schemaVersion` 'hugging-bay.receipt-attestation-authority-snapshot.v1', required
  - `queryVersion` 'receipt-authority-row-counts-v2', required
  - `authority` 'postgres-repeatable-read-aggregate', required
  - `readOnly` unknown, required
  - `noStateChange` unknown, required
  - `relations` object, required: Bounded row counts only. Equal counts do not prove equal content or absence of state transitions.
    - `receiptAttestations` object, required
      - `count` integer, required
    - `receiptStateEvents` object, required
      - `count` integer, required
  - `snapshotDigest` string, required: Digest of queryVersion and the two disclosed relation counts only.

## Other responses

- `400`: Request bodies are forbidden.
- `401`: A valid reader, publisher, or admin bearer credential is required.
- `403`: Same-origin or reader-role boundary rejected the request.
- `405`: Method not allowed; this contract supports GET and HEAD only.
- `422`: Query parameters are forbidden.
- `429`: Public read rate limit exceeded before authority checkout.
- `503`: Compose-heavy admission, PostgreSQL, authentication authority, or the bounded read-only snapshot is unavailable.

---

[API](https://skmtc.dev/huggingbay/apis/hugging-bay-public-api.md) · [All operations](https://skmtc.dev/huggingbay/apis/hugging-bay-public-api/llms.txt) · [OpenAPI document](https://skmtc.dev/huggingbay/apis/hugging-bay-public-api/revisions/ea7ba26b1e27?raw)