Read a private proof state

Resume a proof with its secret state token.

GET/v1/links/{state}

Access: Private code required
Client: Local or server client

Parameters#

Name	Location	Meaning
`state`Required	Path	The private 64-character hexadecimal state returned by start.

Request examples#

cURL

curl -fsS 'https://veil.rip/v1/links/PROOF_STATE'

Response#

HTTP 200application/json

The challenge or verified grant, expiry and transfer information. Treat this response and the state as private.

Field	Type	Meaning
`state`	`string`	Private proof-session state.
`identity`	`integer`	Target card number.
`platform`	`string`	Platform identifier.
`method`	`string`	Proof method.
`status`	`string`	pending, returned, verified, used or expired.
`expiresAt`	`string`	Session expiry time.
`subject`	`string \| null`	Verified normalised account identifier.
`display`	`string \| null`	Verified display name.
`grant`	`string \| null`	Single-use signed grant after verification, until used.
`grantExpiresAt`	`string \| null`	Grant expiry time.
`challenge`	`string \| null`	Public challenge instructions.
`claimed`	`string \| null`	Account requested at the start, for methods that require it.
`holder`	`integer \| null`	Current card holding the verified account.
`waitDays`	`integer \| null`	Takeover cancellation period if another card holds it.
`takeoverOpen`	`boolean \| null`	Whether a takeover is already open.

Response headers#

Header	Value	Meaning
`Content-Type`	`application/json`	Use the declared media type before choosing a parser.
`Date`	`HTTP date`	Server time. Compare it with your clock when signing requests.
`Cache-Control`	`no-store`	Do not persist private or temporary responses in a shared cache.
`Retry-After`	`integer seconds, on rate_limited or busy`	Wait at least this long before retrying. Other 429/503 codes do not necessarily include it.

Errors#

API errors return an error object. Use error.code for program logic; error.message is English text for people and can change. Response and error guide

HTTP Code Meaning and next step

400

HTTP	Code	Meaning and next step
400	`invalid_parameter`	A path, query or body field is missing, malformed or outside its accepted range. Correct the field named in `error.message` before sending again.
404	`not_found`	The requested card, key, alias, code or resource was not found. Check the identifier. Temporary codes and previews may already have expired or been used.

invalid_parameter

A path, query or body field is missing, malformed or outside its accepted range.

Correct the field named in error.message before sending again.

404

not_found

The requested card, key, alias, code or resource was not found.

Check the identifier. Temporary codes and previews may already have expired or been used.

Shared request errors

HTTP Code Meaning and next step

429

HTTP	Code	Meaning and next step
429	`rate_limited`	An anonymous, signed-request or API-key allowance was exceeded. Wait at least `Retry-After` seconds. Share a queue and retry budget across your workers.
500	`internal_error`	An unexpected server error occurred. Internal details are not returned. Retry reads with bounded backoff. Check write results before sending a new signed operation.
503	`busy`	The application has reached a temporary concurrency or database limit. Wait `Retry-After` seconds and retry with bounded backoff.

rate_limited

An anonymous, signed-request or API-key allowance was exceeded.

Wait at least Retry-After seconds. Share a queue and retry budget across your workers.

500

internal_error

An unexpected server error occurred. Internal details are not returned.

Retry reads with bounded backoff. Check write results before sending a new signed operation.

503

busy

The application has reached a temporary concurrency or database limit.

Wait Retry-After seconds and retry with bounded backoff.

Read this entry as JSON