---
title: "Integrity-check an evidence record"
method: POST
path: "/api/v1/records/verify"
tags: ["records"]
---

# Integrity-check an evidence record

`POST /api/v1/records/verify`

## Request

- Base URL: `https://worthune.com`
- URL: `https://worthune.com/api/v1/records/verify`
- Auth: none required

Rebuilds the canonical JSON of {model, specVersion, inputs, outputs}, recomputes the SHA-256 and reports whether it matches. No engine run, no key.

## Request body

- object
  - `model` string, required
  - `specVersion` string, required
  - `inputs` object, required
  - `outputs` object, required: Rebuilt by family: { projection, monteCarlo? } for household-projection, { decision } for decision-*.
  - `sha256` string, required
  - `signature` RecordSignature: Proves Worthune minted the record's hash. Absent when the deployment has no signing key; a stored decision is signed only when its hash is recomputed from the stored inputs.
    - `alg` 'Ed25519', required
    - `keyId` string, required: Matches a key at GET /api/v1/records/keys.
    - `value` string, required: base64url signature.
    - `message` string, required: What was signed: "worthune-record:v1:" + sha256. Rebuild it from the hash when verifying.

## Response `200`

The check — `ok` is true whether or not the digest matched; read `match`.

- object
  - `ok` unknown, required
  - `match` boolean, required
  - `computedSha256` string, required
  - `model` string, required
  - `specVersion` string, required
  - `knownModel` boolean, required
  - `currentSpecVersion` string: Present when the model is a catalog model.
  - `specUrl` string
  - `meaning` string, required
  - `signature` 'valid' | 'invalid' | 'unknown-key' | 'malformed' | 'absent', required: The sent signature checked against the published keys; absent when none was sent.
  - `signatureMeaning` string, required

## Other responses

- `400`: Malformed JSON or a body missing one of the five fields.
- `429`: Hourly per-org stateful quota, a per-route durable limit, or the 120 requests/minute per-IP burst backstop.

---

[API](https://skmtc.dev/worthune/apis/worthune-api.md) · [All operations](https://skmtc.dev/worthune/apis/worthune-api/llms.txt) · [OpenAPI document](https://skmtc.dev/worthune/apis/worthune-api/revisions/9f2241072555?raw)