---
title: "Submit a recipient proof-of-open (rev 44 D210)"
method: POST
path: "/vaults/v1/{vault_id}/recipients/{principal_id}/proof-of-open"
tags: ["vault"]
---

# Submit a recipient proof-of-open (rev 44 D210)

`POST /vaults/v1/{vault_id}/recipients/{principal_id}/proof-of-open`

## Request

- Base URL: `https://api.run402.com`
- URL: `https://api.run402.com/vaults/v1/{vault_id}/recipients/{principal_id}/proof-of-open`
- Auth: one of:
  - API key in header `SIGN-IN-WITH-X`
  - HTTP bearer

Recipient-grade (`gitvault.read_envelope`) PLUS a strict principal self-match: the authenticated principal MUST equal the path's `principal_id` (never overridable, admin keys included -- proof-of-open is a recipient's own evidence). Mints a `recipient_open_receipt` recording fsck's own `chain_verified_to_generation` / `decryptable_to_generation` split -- the recipient's claim that it opened its envelope through the real reader path (`openEpochRotationForRecipient` traversal). The gateway verifies ledger consistency (the fingerprint names a live envelope on this vault; `decryptable_to_generation` does not exceed the newest committed generation; `chain_verified_to_generation >= decryptable_to_generation`) and refuses `OPEN_PROOF_MISMATCH` otherwise; THE DECRYPTION CLAIM ITSELF IS HONEST-CLIENT EVIDENCE the server cannot verify, and every consumer (the coverage read's openability dimension) presents it as recipient-attested. IDEMPOTENT on the tuple (principal, fingerprint, decryptable_to_generation): an exact replay returns `200` with the SAME previously-minted receipt. Never lifecycle-gated and never transfer-frozen.

## Path parameters

- `vault_id` string, required
- `principal_id` string, required

## Headers

- `SIGN-IN-WITH-X` string, required

## Request body

- object
  - `ek_fingerprint` string, required: The recipient's `ek_<32 hex>` fingerprint whose envelope was opened.
  - `chain_verified_to_generation` string, required: fsck's chain_verified_to_generation, verbatim (16-hex generation).
  - `decryptable_to_generation` string, required: fsck's decryptable_to_generation, verbatim (16-hex generation).
  - `reader_entrypoint` string, required: Audit provenance: the client implementation + reader entry point that produced the evidence (1-200 chars).

## Response `200`

Idempotent replay of the SAME previously-minted receipt for this identical tuple

- object

## Other responses

- `201`: A genuinely fresh recipient_open_receipt
- `400`: VALIDATION_FAILED -- malformed evidence shape
- `403`: VAULT_ACCESS_DENIED -- unauthorized, nonexistent, wrong-project, or the caller is not the named principal (self-match)
- `409`: OPEN_PROOF_MISMATCH -- the submitted evidence disagrees with the vault's ledger; refetch, re-run fsck, resubmit

---

[API](https://skmtc.dev/run402/apis/run402-api.md) · [All operations](https://skmtc.dev/run402/apis/run402-api/llms.txt) · [OpenAPI document](https://skmtc.dev/run402/apis/run402-api/revisions/893607557f50?raw)