{"revision":"0ed62d2c742f8e20","language":"en","entry":{"id":"canary","kind":"endpoint","group":"orgs","title":"Read the warrant canary","method":"GET","path":"/v1/canary","paths":[],"summary":"Get the latest signed statement that no authority has asked Veil in secret for user data, with every earlier one.","response":"status is current, stale or none. current is the latest statement: its signed text and date, the signer’s card and key, the signature and the block. history lists every statement, newest first.","parameters":[],"sample":"/v1/canary","access":"public","base":"directory","notes":["This is the server’s copy. To check it, read current.block as a signature block: its text must be statement.en or statement.it with the date, word for word, and a key of the signer’s card must have made the signature. The page /canary does this in the browser, and POST /v1/verify gives the server’s answer.","A statement is stale once more than maxAgeDays (35) days have passed since its date. Count them from the signed date: stale is the server’s word.","An owner of the Veil organisation publishes the statement every month with a request signed by a key of their card. That call is for the staff and is not part of this reference."],"errors":["401 invalid_api_key","403 api_key_scope","403 api_key_suspended","403 developer_suspended","429 rate_limited","500 internal_error","503 busy"],"related":["canary-page","verify-message","staff-roles"],"sections":[{"kind":"code","language":"shell","code":"curl -fsS 'https://veil.rip/v1/canary'"},{"kind":"code","language":"javascript","code":"const response = await fetch(\"https://veil.rip/v1/canary\");\nconst { status, current } = await response.json();"}],"live":true,"responses":[{"status":200,"contentType":"application/json","description":"status is current, stale or none. current is the latest statement: its signed text and date, the signer’s card and key, the signature and the block. history lists every statement, newest first.","fields":[{"name":"status","type":"string","description":"current, stale (the latest is more than maxAgeDays days old) or none (never signed)."},{"name":"current","type":"Canary | null","description":"The latest statement, or null when none was ever signed."},{"name":"maxAgeDays","type":"integer","description":"Days after its date when a statement turns stale: 35."},{"name":"statement","type":"object","description":"The statement in en and it, with {date} where the ISO date goes."},{"name":"history","type":"array<Canary>","description":"Every statement, newest date first, the current one included."}]}],"responseObjects":[{"id":"canary","title":"Signed statement","fields":[{"name":"id","type":"integer","description":"Statement number on this server."},{"name":"date","type":"string","description":"The date the signed text names, YYYY-MM-DD in UTC."},{"name":"lang","type":"string","description":"en or it: the language of the signed text."},{"name":"text","type":"string","description":"The signed text, exactly: statement.en or statement.it with the date."},{"name":"signer","type":"CanarySigner","description":"The owner’s card that signed."},{"name":"key","type":"string","description":"The card’s key that made the signature: hex for Ed25519, base64 for a composite key."},{"name":"alg","type":"string","description":"ed25519 or mldsa65-ed25519."},{"name":"device","type":"string | null","description":"The key’s device name, as the server holds it."},{"name":"signature","type":"string","description":"The signature, in the spelling of POST /v1/verify."},{"name":"block","type":"string","description":"The signature block as the owner sent it. Check it like any block."},{"name":"signedAt","type":"string","description":"When this server took it, ISO 8601 UTC."},{"name":"staleAfter","type":"string, optional","description":"On current only: the last date before it is stale, YYYY-MM-DD."},{"name":"stale","type":"boolean, optional","description":"On current only: more than maxAgeDays days have passed since its date."}],"typeName":"Canary"},{"id":"canary-signer","title":"Signer","fields":[{"name":"n","type":"integer","description":"Permanent card number."},{"name":"url","type":"string","description":"Permanent card URL."},{"name":"name","type":"string","description":"Current display name; a hidden name becomes Card followed by its number, a closed card an empty string."},{"name":"nameHidden","type":"boolean","description":"Whether staff hide the name."}],"typeName":"CanarySigner"}],"errorFormat":"json","errorDetails":[{"status":401,"code":"invalid_api_key","description":"The bearer credential is malformed, unknown, expired or revoked.","action":"Use an active key. To use anonymous public access, remove `Authorization` entirely. Invalid credentials never fall back automatically.","scope":"optional-api-key"},{"status":403,"code":"api_key_scope","description":"The API key lacks read or verify scope, or the endpoint does not accept bearer keys.","action":"Use the correct scope. Identity writes and key management still require a device signature.","scope":"optional-api-key"},{"status":403,"code":"api_key_suspended","description":"This API key is suspended.","action":"Ask staff to restore it; another key cannot lift an account suspension.","scope":"optional-api-key"},{"status":403,"code":"developer_suspended","description":"The owner’s API account is suspended or the owner card is unavailable.","action":"Check the owner account and any staff restriction. Creating another key does not bypass suspension.","scope":"optional-api-key"},{"status":429,"code":"rate_limited","description":"An anonymous, signed-request or API-key allowance was exceeded.","action":"Wait at least `Retry-After` seconds. Share a queue and retry budget across your workers.","scope":"common"},{"status":500,"code":"internal_error","description":"An unexpected server error occurred. Internal details are not returned.","action":"Retry reads with bounded backoff. Check write results before sending a new signed operation.","scope":"common"},{"status":503,"code":"busy","description":"The application has reached a temporary concurrency or database limit.","action":"Wait `Retry-After` seconds and retry with bounded backoff.","scope":"common"}],"responseHeaders":[{"name":"Content-Type","value":"application/json","description":"Use the declared media type before choosing a parser."},{"name":"Date","value":"HTTP date","description":"Server time. Compare it with your clock when signing requests."},{"name":"Cache-Control","value":"public, max-age=300","description":"The answer may be cached for five minutes, as every page’s footer reads it."},{"name":"Retry-After","value":"integer seconds, on rate_limited or busy","description":"Wait at least this long before retrying. Other 429/503 codes do not necessarily include it."}],"documentationUrl":"https://veil.rip/docs/canary","supportsBrowserFetch":true,"browserMode":"fetch"}}