---
title: "Verify a receipt"
method: POST
path: "/receipts/verify"
---

# Verify a receipt

`POST /receipts/verify`

## Request

- Base URL: `https://tetheredtrust.com/v1`
- URL: `https://tetheredtrust.com/v1/receipts/verify`
- Auth: one of:
  - none
  - HTTP bearer

Check a Tethered Trust receipt: is the signature ours, is it still within valid_until, and have the records behind it changed since? A valid receipt proves what we said and when; it doesn't guarantee the verdict was right.

## Request body

- object
  - `receipt_id` string: The receipt id (rcpt_...) from a check.
  - `jws` string: Or the full signed receipt string, if someone handed it to you.

## Response `200`

OK

- object
  - `signature_valid` boolean, required
  - `issued_by_tethered_trust` boolean
  - `status` 'valid' | 'expired' | 'revoked' | 'data_changed' | 'invalid_signature' | 'unknown_key', required
  - `explain` string
  - `receipt_id` string
  - `claim` object
  - `issued_at` string
  - `valid_until` string
  - `changed_subjects` object[]
  - `disclaimer` string

## Other responses

- `400`: Bad input (code bad_request), or plain HTTP (https_required).
- `401`: Missing or invalid API key where one is required.
- `402`: Payment required: pay with x402 or credits and retry. Verified first, settled only for a completed decision.
- `429`: Rate limit; see Retry-After.
- `500`: Our error; retry once.
- `503`: Temporarily unavailable, or paid access is off (paid_access_off).

---

[API](https://skmtc.dev/tetheredtrust/apis/tethered-trust-api.md) · [All operations](https://skmtc.dev/tetheredtrust/apis/tethered-trust-api/llms.txt) · [OpenAPI document](https://skmtc.dev/tetheredtrust/apis/tethered-trust-api/revisions/f737ac591159?raw)