---
title: "Verify a signed scan receipt (machine-side, no auth needed)"
method: POST
path: "/v1/receipts/verify"
---

# Verify a signed scan receipt (machine-side, no auth needed)

`POST /v1/receipts/verify`

## Request

- Base URL: `https://agent-shield.startekenterprises.com`
- URL: `https://agent-shield.startekenterprises.com/v1/receipts/verify`
- Auth: none required

Pass the receipt object from a scan response (or its fields). Returns whether the HMAC-SHA256 signature is valid. Works for both keyed (rk2) and legacy (rk1) receipts. Operators can also paste the receipt's verify_url in a browser for a human-readable page.

## Request body

- object: The receipt object from a scan response

## Response `200`

Verification result

- object
  - `valid` boolean
  - `receipt_id` string, nullable
  - `key_id` string, nullable

---

[API](https://skmtc.dev/startekenterprises/apis/agent-shield.md) · [All operations](https://skmtc.dev/startekenterprises/apis/agent-shield/llms.txt) · [OpenAPI document](https://skmtc.dev/startekenterprises/apis/agent-shield/revisions/858e23c6841d?raw)