Verification

Replay a paid call

One purchase assembled as an integration test an agent can run without trusting this store: the certificate's signed bytes and their hash, the five accepted x402 terms recovered by matching the catalog against the certificate's signed quote with a JWS offer over them, the settlement transaction and where to read it, whether the delivery-audit row for that settlement is closed, and the exact refusal body a wrong-scope re-presentation gets. The whole kit is a detached JWS under the store's did:web key, and it names what the store does not retain. Free.

get/api/replay/{cert_id}

Request

  • Base URL: https://scvd.store
  • URL: https://scvd.store/api/replay/{cert_id}
  • Auth: none required

Path parameters

cert_idstring required

Any cert_id this store has issued; every purchase response and verify answer carries one.

Response

OK

artifact_class'replay_kit'
callobject

Which paid call this is: cert_id, item, patron_number, date.

offerobject

quote (the signed hash), accepted_terms (the five recovered, or null), recovered_from (how, or why not), jws (an offer signed over those terms on this read, or null), kid and did_document to resolve the key.

settlementobject

state, transaction, network, explorer, payer, paid_usdc, and the sale's standing including the delivery-audit row.

responseobject

form, signed_payload, signature, signature_jcs, public_key, artifact_hash — everything an ed25519 check needs.

refusalobject

wrong_scope: the purchase_input_mismatch body a settled payment gets when re-presented against a different product or inputs, charged once and never twice, plus the other refusal codes by name.

replaystring[]

The steps, in order, to check all of it yourself.

not_retainedstring[]

What this store does not keep, said out loud rather than left to be discovered.

kit_signatureobject

Detached JWS over the kit's RFC 8785 form. Proves this store assembled these parts on this read; makes no part truer than its own signature does.

Changes