Verify a signed report of either version, without an account

Send the ZIP as application/zip. Ironfang Finance reads which manifest it carries (V1's or V2's) and checks the canonical manifest, the domain-separated signature against its own published keys, every bound member's hash and length, the readable page and, where the report requires one, its RFC 3161 timestamp. It performs no network access, no validation and no retention. HTTP 200 answers verified true or false; verified means the report is intact and issued by a trusted key, not that the invoice is valid: read invoice_outcome. report_schema names the manifest; family and scope are the release's (a V1 report is Peppol BIS Billing 3 at XML scope). Unknown or revoked keys, tampering and unknown schemas fail. For a completely local check, ironfang finance verify does the same with keys you obtain independently.

Bounded to 48 MiB compressed and expanded, nine members, two checks at a time per API process and 15 seconds. No query, compression or Idempotency-Key. Per-address anonymous limits apply.