---
title: "Check a verify code or a signed result"
method: POST
path: "/v1/verify"
tags: ["verify"]
---

# Check a verify code or a signed result

`POST /v1/verify`

## Request

- Base URL: `https://tektolo.com` (the document declares no server; this is the origin it was published from)
- URL: `https://tektolo.com/v1/verify`
- Auth: none declared

Check a verify code (from a document or a ``/verify/<code>`` link) or an API result's
``signature.jws``. Says whether Tektolo issued it, which tool, ruleset and engine it
used, when, and whether that ruleset is still current. With ``text``, also whether a
summary is word for word the one its code was issued for. Nothing is stored.

## Request body

- VerifyRequest
  - `code` string, nullable: A verify code, or a whole verify link (…/verify/<code>).
  - `text` string, nullable: Optional, for a summary's code: the summary's text, to check it was not changed. Compared in memory and not stored.
  - `jws` string, nullable: Instead of a code: an API result's signature.jws, to check its signature.

## Response `200`

Successful Response

- VerifyResponse
  - `signing` 'on' | 'off', required
  - `verified` boolean, required: True only when Tektolo's signature checks out.
  - `reason` string, required: Empty when verified; else malformed, unsupported, unknown_key, bad_signature or signing_off.
  - `message` string, required
  - `kid` string, nullable
  - `issued_on` string, nullable: The day it was issued (UTC).
  - `issued_at` string, nullable: JWS only: the exact time.
  - `capability` string, nullable
  - `capability_name` string, nullable
  - `tool_name` string, nullable: The web tool's name when a web tool issued it.
  - `operation` string, nullable
  - `document` string, nullable: What the code was printed on.
  - `ruleset` RulesetCheck
    - `version` string, nullable, required
    - `hash_prefix` string, nullable, required: The first 16 hex digits of the ruleset hash.
    - `status` 'current' | 'superseded' | 'unknown' | 'none', required
    - `current_version` string, nullable, required: The ruleset this site uses now.
  - `engine` EngineCheck
    - `version` string, required
    - `current_version` string, nullable, required
  - `result_hash` string, nullable: JWS only.
  - `covers` 'result' | 'text', nullable: What the code's keyed digest covers: one result, or a summary's text.
  - `text_check` 'not_asked' | 'matches' | 'differs' | 'not_available', nullable
  - `text_message` string, nullable

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/tektolo/apis/tektolo-capabilities-api.md) · [All operations](https://skmtc.dev/tektolo/apis/tektolo-capabilities-api/llms.txt) · [OpenAPI document](https://skmtc.dev/tektolo/apis/tektolo-capabilities-api/revisions/6e667aa7b6f7?raw)