---
title: "A signed receipt for the run"
method: POST
path: "/v1/runs/{runId}/receipt"
tags: ["Evidence"]
---

# A signed receipt for the run

`POST /v1/runs/{runId}/receipt`

## Request

- Base URL: `https://api.ironfang.com/rig`
- URL: `https://api.ironfang.com/rig/v1/runs/{runId}/receipt`
- Auth: one of:
  - HTTP bearer
  - HTTP bearer

A signed statement of what the run was and how it ended: project, suite and version, status and outcome, every verdict, the event count and the head of the event hash chain. Signed with the platform's Ed25519 key when it has one; the signature carries the key, and /v1/evidence/keys publishes it, so the receipt verifies anywhere. A run whose chain does not recompute gets no receipt (409). Needs rig.read.

## Path parameters

- `runId` string, uuid, required

## Response `200`

The receipt and its signature.

- SignedReceipt: The receipt and, on a platform with a signing key, its signature over the receipt's canonical JSON (objects with keys in byte order, no whitespace, numbers as written).
  - `receipt` Receipt, required
    - `chain_head` string
    - `events` integer, required
    - `generated_at` string, date-time, required
    - `hashed_from` integer
    - `receipt_version` integer, required
    - `run` object, required
      - `external_id` string
      - `finished_at` string, date-time
      - `id` string, uuid, required
      - `organisation_id` string, uuid, required
      - `outcome` string, required
      - `project` string, required
      - `started_at` string, date-time, required
      - `status` string, required
      - `suite` string, required
      - `suite_version` integer, required
    - `verdicts` object
  - `signature` Signature: A detached Ed25519 signature over named bytes, carrying the key it was made with.
    - `algorithm` 'ed25519', required
    - `key_id` string, required
    - `public_key` string, required: Base64.
    - `sha256` string, required: SHA-256 of the signed bytes.
    - `signature` string, required: Base64.
    - `signed` string, required: What was signed: manifest.json, or receipt.
    - `signed_at` string, date-time, required

## Other responses

- `404`: No such object in this organisation (`not_found`).
- `409`: A name is already taken, or the target is archived (`conflict`, `archived`).

---

[API](https://skmtc.dev/ironfang/apis/ironfang-rig-api.md) · [All operations](https://skmtc.dev/ironfang/apis/ironfang-rig-api/llms.txt) · [OpenAPI document](https://skmtc.dev/ironfang/apis/ironfang-rig-api/revisions/3e86a312dad1?raw)