---
title: "Machine-checkable verification-oracle verdict: integrity via content-address, authenticity via >= 1 valid signature, fail-closed status."
method: POST
path: "/api/verify"
tags: ["Verification"]
---

# Machine-checkable verification-oracle verdict: integrity via content-address, authenticity via >= 1 valid signature, fail-closed status.

`POST /api/verify`

## Request

- Base URL: `https://huggingbay.xyz`
- URL: `https://huggingbay.xyz/api/verify`
- Auth: none declared

By id ({ artifactId }): the server resolves the artifact's current recorded representation, signs it, and checks it against its own published key -- no caller-supplied proof needed. Offline / cross-hub ({ signedManifest, subject?, expectedDigest?, receiptAttestation? }): verified exactly as received, no server-side lookup. A content-address match alone is never authenticity (see notClaimOf on every verdict). This proves integrity/provenance, not safety.

**Inputs.** No path or query fields are required. The request body schema lists accepted fields and required values.

**Outputs.** See each status below for its media type, schema and headers. A missing record or unavailable capability is not a successful empty result.

**Errors.** API JSON failures use the documented response schema. Read code, message and next; retry only when the response allows it. Auth, invalid input and missing records need a caller change.

**Rate limits.** Write and protocol operations can have separate route-specific limits. Read Retry-After and retry_after_s when present; do not infer a write allowance from the public read budget.

**Example setup.** This example is not executed by documentation checks. Review the operation and obtain any required user consent before sending it.

## Request body

- object
  - `artifactId` string
  - `subject` object
  - `expectedDigest` string
  - `signedManifest` object
  - `receiptAttestation` object

## Response `200`

The projected verification-oracle verdict (schema, status, authenticityEstablished, contentAddress, signatures, reason, notClaimOf, verdictDigest) plus signerKeyId and publicKeyUrl.

- object: The projected verification-oracle verdict (schema, status, authenticityEstablished, contentAddress, signatures, reason, notClaimOf, verdictDigest) plus signerKeyId and publicKeyUrl.. Fields can vary; no stronger field guarantee is specified for this operation.

## Other responses

- `400`: Malformed or unknown-field request; fails closed.
- `404`: By-id: artifact not found or not visible to the caller.
- `503`: By-id mode requires the postgres serving-eligibility authority.

---

[API](https://skmtc.dev/huggingbay/apis/hugging-bay-public-api.md) · [All operations](https://skmtc.dev/huggingbay/apis/hugging-bay-public-api/llms.txt) · [OpenAPI document](https://skmtc.dev/huggingbay/apis/hugging-bay-public-api/revisions/63c474bf0fe4?raw)