Verify a receipt's hash and signature (helper; verification also works offline with the JWKS)

POST

/v1/receipts/verify

const url = 'https://api.trustysweep.com/v1/receipts/verify';
const options = {
  method: 'POST',
  headers: {'Content-Type': 'application/json'},
  body: '{"receiptVersion":"1","receiptId":"rcp_01J8Z3K9M2Q4R6S8T0V2W4X6Y8","executionId":"exe_01J8Z3K9M2Q4R6S8T0V2W4X6Y8","planId":"pln_01J8Z3K9M2Q4R6S8T0V2W4X6Y8","planHash":"example","tenantRef":"example","actor":{"type":"user","principalId":"example","delegatingUserId":"example","applicationId":"example","agentId":"example","grantId":"example"},"delegatingUserId":"example","authorization":{"actionDecisionId":"example","grantId":"example","commercialAuthorizationId":"example","policyVersion":"example","rateCardVersion":"example"},"intent":"example","simulated":true,"attempted":1,"completed":1,"failed":1,"objects":[{"assetId":"example","providerObjectId":"example","actions":["example"],"status":"completed","vaultObjectId":"example","vaultSha256":"example","providerResultId":"example","bytes":1,"error":"example","restorable":true}],"before":[{"sourceId":"example","provider":"google_gmail","usedBytes":1,"limitBytes":1,"observedAt":"2026-04-15T12:00:00Z"}],"after":[{"sourceId":"example","provider":"google_gmail","usedBytes":1,"limitBytes":1,"observedAt":"2026-04-15T12:00:00Z"}],"bytesPreserved":1,"bytesRemoved":1,"bytesTransferred":1,"measuredReclaimBytes":1,"charges":[{"meter":"example","quantity":1,"unit":"example","cents":1,"usageEventId":"example"}],"startedAt":"2026-04-15T12:00:00Z","finishedAt":"2026-04-15T12:00:00Z","restoration":{"capable":true,"until":"2026-04-15T12:00:00Z","method":"example"},"errors":["example"],"hash":"example","signature":{"alg":"Ed25519","kid":"example","sig":"example"}}'
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request POST \
  --url https://api.trustysweep.com/v1/receipts/verify \
  --header 'Content-Type: application/json' \
  --data '{ "receiptVersion": "1", "receiptId": "rcp_01J8Z3K9M2Q4R6S8T0V2W4X6Y8", "executionId": "exe_01J8Z3K9M2Q4R6S8T0V2W4X6Y8", "planId": "pln_01J8Z3K9M2Q4R6S8T0V2W4X6Y8", "planHash": "example", "tenantRef": "example", "actor": { "type": "user", "principalId": "example", "delegatingUserId": "example", "applicationId": "example", "agentId": "example", "grantId": "example" }, "delegatingUserId": "example", "authorization": { "actionDecisionId": "example", "grantId": "example", "commercialAuthorizationId": "example", "policyVersion": "example", "rateCardVersion": "example" }, "intent": "example", "simulated": true, "attempted": 1, "completed": 1, "failed": 1, "objects": [ { "assetId": "example", "providerObjectId": "example", "actions": [ "example" ], "status": "completed", "vaultObjectId": "example", "vaultSha256": "example", "providerResultId": "example", "bytes": 1, "error": "example", "restorable": true } ], "before": [ { "sourceId": "example", "provider": "google_gmail", "usedBytes": 1, "limitBytes": 1, "observedAt": "2026-04-15T12:00:00Z" } ], "after": [ { "sourceId": "example", "provider": "google_gmail", "usedBytes": 1, "limitBytes": 1, "observedAt": "2026-04-15T12:00:00Z" } ], "bytesPreserved": 1, "bytesRemoved": 1, "bytesTransferred": 1, "measuredReclaimBytes": 1, "charges": [ { "meter": "example", "quantity": 1, "unit": "example", "cents": 1, "usageEventId": "example" } ], "startedAt": "2026-04-15T12:00:00Z", "finishedAt": "2026-04-15T12:00:00Z", "restoration": { "capable": true, "until": "2026-04-15T12:00:00Z", "method": "example" }, "errors": [ "example" ], "hash": "example", "signature": { "alg": "Ed25519", "kid": "example", "sig": "example" } }'

Request Body^required

application/json

Durable, tamper-evident execution receipt signed with the platform Ed25519 key published at /.well-known/sweep-receipts.json.

object

receiptVersion

required

string

Allowed values: 1

receiptId

required

Prefixed ULID (rcp_…)

string

/^rcp_[0-9A-HJKMNP-TV-Z]{26}$/

executionId

required

Prefixed ULID (exe_…)

string

/^exe_[0-9A-HJKMNP-TV-Z]{26}$/

planId

required

Prefixed ULID (pln_…)

string

/^pln_[0-9A-HJKMNP-TV-Z]{26}$/

planHash

required

string

tenantRef

required

string

actor

required

object

type

required

string

Allowed values: user sweep_automation developer_application external_agent service connector

principalId

required

string

delegatingUserId

One of:

string
null

string

applicationId

One of:

string
null

string

agentId

One of:

string
null

string

grantId

One of:

string
null

string

delegatingUserId

One of:

string
null

string

authorization

required

object

actionDecisionId

required

string

grantId

One of:

string
null

string

commercialAuthorizationId

One of:

string
null

string

policyVersion

required

string

rateCardVersion

One of:

string
null

string

intent

required

string

simulated

required

boolean

attempted

required

integer

completed

required

integer

failed

required

integer

objects

required

Array<object>

object

assetId

required

string

providerObjectId

required

string

actions

required

Array<string>

status

required

string

Allowed values: completed partial failed skipped

vaultObjectId

One of:

string
null

string

vaultSha256

One of:

string
null

string

providerResultId

One of:

string
null

string

bytes

integer

error

One of:

string
null

string

restorable

boolean

before

required

Array<object>

object

sourceId

required

string

provider

required

string

Allowed values: google_gmail google_drive microsoft_outlook microsoft_onedrive dropbox apple_local s3_compatible trusty_vault simulated

usedBytes

One of:

integer
null

integer

limitBytes

One of:

integer
null

integer

observedAt

required

string format: date-time

after

required

Array<object>

object

sourceId

required

string

provider

required

string

Allowed values: google_gmail google_drive microsoft_outlook microsoft_onedrive dropbox apple_local s3_compatible trusty_vault simulated

usedBytes

One of:

integer
null

integer

limitBytes

One of:

integer
null

integer

observedAt

required

string format: date-time

bytesPreserved

required

integer

bytesRemoved

required

integer

bytesTransferred

required

integer

measuredReclaimBytes

One of:

integer
null

integer

charges

required

Array<object>

object

meter

required

string

quantity

required

number

unit

required

string

cents

required

integer

usageEventId

required

string

startedAt

required

string format: date-time

finishedAt

required

string format: date-time

restoration

required

object

capable

required

boolean

until

One of:

string
null

string format: date-time

method

One of:

string
null

string

errors

Array<string>

hash

Sha256 of canonical JSON of the receipt without hash/signature

string

signature

object

alg

required

string

Allowed values: Ed25519

kid

required

string

sig

required

Base64url Ed25519 signature over hash

string

Responses

200

application/json

object

valid

required

boolean

reason

One of:

string
null

string

Allowed values: unsigned hash_mismatch unknown_kid bad_signature

kid

One of:

string
null

string

Example

{
  "reason": "unsigned"
}

Headers

RateLimit-Limit

integer

Requests allowed in the current window.

RateLimit-Remaining

integer

Requests remaining in the current window.

RateLimit-Reset

integer

Seconds until the window resets.

400

Validation failed

application/problem+json

RFC 9457 problem details.

object

type

required

Https://developers.trustysweep.com/errors/

string format: uri

titlerequired

string

statusrequired

integer

detail

string

coderequired

Machine-readable error code from errors.json

string

request_idrequired

string

errors

Array<object>

object

pathrequired

string

messagerequired

string

`Example^generated`

{
  "type": "https://example.com",
  "title": "example",
  "status": 1,
  "detail": "example",
  "code": "example",
  "request_id": "example",
  "errors": [
    {
      "path": "example",
      "message": "example"
    }
  ]
}

`401`

Section titled “401”

Unauthenticated

Media typeapplication/problem+json
RFC 9457 problem details.
object
typerequired
Https://developers.trustysweep.com/errors/

string format: uri
titlerequired
string
statusrequired
integer
detail
string
coderequired
Machine-readable error code from errors.json

string
request_idrequired
string
errors
Array<object>
object
pathrequired
string
messagerequired
string
Example^generated
{
  "type": "https://example.com",
  "title": "example",
  "status": 1,
  "detail": "example",
  "code": "example",
  "request_id": "example",
  "errors": [
    {
      "path": "example",
      "message": "example"
    }
  ]
}

`403`

Section titled “403”

Forbidden / action denied / step-up required

Media typeapplication/problem+json
RFC 9457 problem details.
object
typerequired
Https://developers.trustysweep.com/errors/

string format: uri
titlerequired
string
statusrequired
integer
detail
string
coderequired
Machine-readable error code from errors.json

string
request_idrequired
string
errors
Array<object>
object
pathrequired
string
messagerequired
string
Example^generated
{
  "type": "https://example.com",
  "title": "example",
  "status": 1,
  "detail": "example",
  "code": "example",
  "request_id": "example",
  "errors": [
    {
      "path": "example",
      "message": "example"
    }
  ]
}

`404`

Section titled “404”

Not found

Media typeapplication/problem+json
RFC 9457 problem details.
object
typerequired
Https://developers.trustysweep.com/errors/

string format: uri
titlerequired
string
statusrequired
integer
detail
string
coderequired
Machine-readable error code from errors.json

string
request_idrequired
string
errors
Array<object>
object
pathrequired
string
messagerequired
string
Example^generated
{
  "type": "https://example.com",
  "title": "example",
  "status": 1,
  "detail": "example",
  "code": "example",
  "request_id": "example",
  "errors": [
    {
      "path": "example",
      "message": "example"
    }
  ]
}

`429`

Section titled “429”

Rate limited

Media typeapplication/problem+json
RFC 9457 problem details.
object
typerequired
Https://developers.trustysweep.com/errors/

string format: uri
titlerequired
string
statusrequired
integer
detail
string
coderequired
Machine-readable error code from errors.json

string
request_idrequired
string
errors
Array<object>
object
pathrequired
string
messagerequired
string
Example^generated
{
  "type": "https://example.com",
  "title": "example",
  "status": 1,
  "detail": "example",
  "code": "example",
  "request_id": "example",
  "errors": [
    {
      "path": "example",
      "message": "example"
    }
  ]
}

`Headers`

Section titled “Headers”

Retry-After

integer

Seconds to wait before retrying.

RateLimit-Limit

integer

Requests allowed in the current window.

RateLimit-Remaining

integer

Requests remaining in the current window.

RateLimit-Reset

integer

Seconds until the window resets.

`500`

Section titled “500”

Internal error

Media typeapplication/problem+json
RFC 9457 problem details.
object
typerequired
Https://developers.trustysweep.com/errors/

string format: uri
titlerequired
string
statusrequired
integer
detail
string
coderequired
Machine-readable error code from errors.json

string
request_idrequired
string
errors
Array<object>
object
pathrequired
string
messagerequired
string
Example^generated
{
  "type": "https://example.com",
  "title": "example",
  "status": 1,
  "detail": "example",
  "code": "example",
  "request_id": "example",
  "errors": [
    {
      "path": "example",
      "message": "example"
    }
  ]
}

Verify a receipt's hash and signature (helper; verification also works offline with the JWKS)

Request Bodyrequired

Responses

200

Example

Headers

400

Examplegenerated

401

Examplegenerated

403

Examplegenerated

404

Examplegenerated

429

Examplegenerated

Headers

500

Examplegenerated

Request Body^required

`Example^generated`

`401`

`Example^generated`

`403`

`Example^generated`

`404`

`Example^generated`

`429`

`Example^generated`

`Headers`

`500`

`Example^generated`