---
title: "Verify Receipt"
method: POST
path: "/governance/verify-receipt"
tags: ["governance"]
---

# Verify Receipt

`POST /governance/verify-receipt`

Verify the posted receipt file and return the verdict document.

The request body is the receipt verbatim -- whatever the operator dropped,
of whatever content type. Nothing under ``.sdd`` and no key material is
read: the verifier works from the file's own bytes, so this endpoint
answers about the upload and not about the installation serving it.

The status is always 200 for a request that carried a body. A tampered
receipt, a file that is not a receipt, and an empty drop are all verdicts
about the evidence rather than failed requests, and each is the answer an
operator dropped the file to get.

No key can be pinned through this endpoint, so the pass it reports is
always the integrity-only tier and always carries the caveat saying so.
A key arriving in the same request as the receipt is not an out-of-band
anchor -- it is the same channel, and treating it as one would report
provenance on the strength of the upload rather than of any evidence.

## Response `200`

Successful Response

- unknown

## Changes

- **2026-09-02** `d7e8799d6c6a` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/sipyourdrink-ltd/apis/bernstein-task-server/changes/governance/verify-receipt/post.md)

---

[API](https://skmtc.dev/sipyourdrink-ltd/apis/bernstein-task-server.md) · [All operations](https://skmtc.dev/sipyourdrink-ltd/apis/bernstein-task-server/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/sipyourdrink-ltd/bernstein-task-server/revisions/1f35e916d7e4/schema)