---
title: "Verify a signed report of either version, without an account"
method: POST
path: "/v2/einvoices/reports/verify"
tags: ["reports"]
---

# Verify a signed report of either version, without an account

`POST /v2/einvoices/reports/verify`

## Request

- Base URL: `https://api.ironfang.com/finance`
- URL: `https://api.ironfang.com/finance/v2/einvoices/reports/verify`
- Auth: none required

Send the ZIP as `application/zip`. Ironfang Finance reads which
manifest it carries (V1's or V2's) and checks the canonical
manifest, the domain-separated signature against its own published
keys, every bound member's hash and length, the readable page and,
where the report requires one, its RFC 3161 timestamp. It performs
no network access, no validation and no retention. HTTP 200 answers
`verified` true or false; verified means the report is intact and
issued by a trusted key, not that the invoice is valid: read
`invoice_outcome`. `report_schema` names the manifest; `family` and
`scope` are the release's (a V1 report is Peppol BIS Billing 3 at
XML scope). Unknown or revoked keys, tampering and unknown schemas
fail. For a completely local check, `ironfang finance verify` does
the same with keys you obtain independently.

Bounded to 48 MiB compressed and expanded, nine members, two checks
at a time per API process and 15 seconds. No query, compression or
Idempotency-Key. Per-address anonymous limits apply.

## Response `200`

The integrity check. Cache-Control is no-store.

- ReportVerification: The integrity check of a signed report of either version. A verified report passed every stage and says what it records; an unverified one gives at least one reason in `errors` and records nothing.
  - `artifact_hashes` 'not_verified' | 'verified' | 'invalid', required
  - `claim` string, required
  - `errors` string[], required
  - `family` 'peppol-bis-billing-3' | 'xrechnung' | 'zugferd-facturx': An invoice family. `zugferd-facturx` is one family: ZUGFeRD and Factur-X are corresponding release names of the same standard.
  - `invoice_outcome` 'valid' | 'invalid'
  - `key_id` string
  - `manifest_sha256` string
  - `operation_id` string
  - `report_schema` 'financewolf/einvoice/report-manifest/v1' | 'ironfang/finance/einvoice/report-manifest/v2'
  - `ruleset_id` string
  - `schema` 'ironfang/finance/einvoice/report-verification/v2', required
  - `scope` 'xml' | 'hybrid_pdf'
  - `signature` 'not_verified' | 'verified' | 'invalid' | 'untrusted', required
  - `timestamp` 'not_present' | 'not_verified' | 'verified' | 'invalid', required
  - `verified` boolean, required

## Other responses

- `400`: The request is malformed.
- `413`: The body is over the limit for its media type.
- `415`: The media type, encoding or content is not accepted.
- `429`: Too many requests.
- `500`: Ironfang Finance failed. Not a verdict on anything.

---

[API](https://skmtc.dev/ironfang/apis/ironfang-finance-e-invoicing-api-2.md) · [All operations](https://skmtc.dev/ironfang/apis/ironfang-finance-e-invoicing-api-2/llms.txt) · [OpenAPI document](https://skmtc.dev/ironfang/apis/ironfang-finance-e-invoicing-api-2/revisions/8140667e556b?raw)