Verify a signed scan receipt (machine-side, no auth needed)

Pass the receipt object from a scan response (or its fields). Returns whether the HMAC-SHA256 signature is valid. Works for both keyed (rk2) and legacy (rk1) receipts. Operators can also paste the receipt's verify_url in a browser for a human-readable page.

post/v1/receipts/verify

Request

  • Base URL: https://agent-shield.startekenterprises.com
  • URL: https://agent-shield.startekenterprises.com/v1/receipts/verify
  • Auth: none required

Request body

object required

The receipt object from a scan response

Response

Verification result

validboolean
receipt_idstring nullable
key_idstring nullable

Changes

No recorded changes to this operation across all 1 revision of this API.