Skip to main content
POST
Verify a signed document

Authorizations

Authorization
string
header
required

Your workspace API key, e.g. sk_sovereign_..., sent as Authorization: Bearer <key>.

Body

application/json
document
object
required

The full signed JSON document exactly as downloaded (a certificate or evidence bundle carrying signature: { alg: 'HS256', key_id, value }). The document key must be present (400 'Body must be { document: }' otherwise); its value may be any JSON.

Response

Always 200 for a well-formed body: { ok: true, key_id: string } when the bytes are ours and unaltered; otherwise { ok: false, reason: 'unsigned' (no signature field) | 'malformed' (not an object or signature shape wrong) | 'unknown_key' (signed by a key this platform doesn't hold, e.g. after rotation) | 'mismatch' (any field was edited) | 'no_secret' (verification not configured on the platform) }.

The response is of type object.