Governance

Verify a signed attestation (public)

Verifies an attestation against the public JWKS. PUBLIC — no authentication required — rate-limited by IP. The public key is looked up server-side by attestation.signer_key_id (the embedded key is never trusted); an unknown key yields signature_valid: false.

Steps: (1) EdDSA signature check over the canonical JSON of the attestation (excluding signature); (2) content_match = SHA256(normalize(content)) === attestation.content_hash; (3) best-effort stateless citation re-verification of the submitted content (citation_recheck.skipped: true when the jurisdiction has no active corpus).

Property: the signature validates offline with the public JWKS — no shared secret with Nexus. HMAC is used only for webhooks.

post/api/v1/attestations/verify

Request

  • Base URL: https://legal.nexusquantum.legal
  • URL: https://legal.nexusquantum.legal/api/v1/attestations/verify
  • Auth: none required

Request body

contentstring required

The exact analysis text the attestation was issued over (its hash is compared to content_hash).

Example request

{
  "attestation": {
    "attestation_version": "1",
    "signer_key_id": "att_20260712_a",
    "jurisdiction": "ES",
    "verify_engine_version": "2026-06-08.1"
  }
}

Response

Verification result.

signature_validboolean required

true if the EdDSA signature validates against the public key for signer_key_id. An unknown signer_key_id yields false.

content_matchboolean required

true if SHA256(normalize(content)) === attestation.content_hash.

verify_engine_versionstring
signer_key_idstring

Example response

{
  "verify_engine_version": "2026-06-08.1"
}

Changes

No recorded changes to this operation across all 1 revision of this API.