{"revision":"0ed62d2c742f8e20","language":"en","entry":{"id":"version-proof","kind":"endpoint","group":"history","title":"Read a version’s proof","method":"GET","path":"/v1/identities/{n}/versions/{k}/proof","paths":[],"summary":"Get the inclusion proof for a particular version under the current checkpoint.","response":"The same proof object supplied with a full card, for version k.","parameters":[{"name":"n","description":"Permanent positive card number.","in":"path","required":true},{"name":"k","description":"Positive published version number.","in":"path","required":true}],"sample":"/v1/identities/1/versions/1/proof","access":"public","base":"directory","notes":[],"errors":["400 invalid_parameter","401 invalid_api_key","403 api_key_scope","403 api_key_suspended","403 developer_suspended","404 not_found","410 erased","429 rate_limited","500 internal_error","503 busy","503 log_unavailable"],"related":[],"sections":[{"kind":"code","language":"shell","code":"curl -fsS 'https://veil.rip/v1/identities/1/versions/1/proof'"},{"kind":"code","language":"javascript","code":"const response = await fetch(\"https://veil.rip/v1/identities/1/versions/1/proof\");\nconst result = await response.json();"}],"verify":"Check the opening, leaf hash, inclusion and signed checkpoint.","live":true,"responses":[{"status":200,"contentType":"application/json","description":"The same proof object supplied with a full card, for version k.","fields":[{"name":"version","type":"integer","description":"Version covered by this proof."},{"name":"record","type":"string","description":"Exact canonical JSON text that was signed. Do not reformat before verifying."},{"name":"salt","type":"string","description":"Commitment salt in hex."},{"name":"serverSalt","type":"string","description":"Server’s salt contribution in hex."},{"name":"clientSalt","type":"string | null","description":"Device’s salt contribution in hex, when used."},{"name":"commitment","type":"string","description":"SHA-256 of salt bytes followed by record bytes, in hex."},{"name":"signedBy","type":"string","description":"Public signing key."},{"name":"signature","type":"string","description":"Signature over the identity-version prefix and exact record."},{"name":"entry","type":"string","description":"Exact canonical log entry text."},{"name":"logIndex","type":"integer","description":"Zero-based leaf index."},{"name":"leafHash","type":"string","description":"SHA-256 of 0x00 followed by entry bytes, in hex."},{"name":"checkpoint","type":"Checkpoint","description":"Signed checkpoint containing size, root and note."},{"name":"inclusion","type":"array<string>","description":"Audit-path hashes in hex, deepest sibling first."},{"name":"witnesses","type":"array<string>","description":"Witness cosignature lines also present in checkpoint.note."}]}],"responseObjects":[{"id":"checkpoint","title":"Checkpoint","fields":[{"name":"size","type":"integer","description":"Number of leaves in the signed tree."},{"name":"root","type":"string","description":"Root hash in base64."},{"name":"note","type":"string","description":"Full signed note, including log and witness signatures."}],"typeName":"Checkpoint"}],"errorFormat":"json","errorDetails":[{"status":400,"code":"invalid_parameter","description":"A path, query or body field is missing, malformed or outside its accepted range.","action":"Correct the field named in `error.message` before sending again.","scope":"endpoint"},{"status":401,"code":"invalid_api_key","description":"The bearer credential is malformed, unknown, expired or revoked.","action":"Use an active key. To use anonymous public access, remove `Authorization` entirely. Invalid credentials never fall back automatically.","scope":"optional-api-key"},{"status":403,"code":"api_key_scope","description":"The API key lacks read or verify scope, or the endpoint does not accept bearer keys.","action":"Use the correct scope. Identity writes and key management still require a device signature.","scope":"optional-api-key"},{"status":403,"code":"api_key_suspended","description":"This API key is suspended.","action":"Ask staff to restore it; another key cannot lift an account suspension.","scope":"optional-api-key"},{"status":403,"code":"developer_suspended","description":"The owner’s API account is suspended or the owner card is unavailable.","action":"Check the owner account and any staff restriction. Creating another key does not bypass suspension.","scope":"optional-api-key"},{"status":404,"code":"not_found","description":"The requested card, key, alias, code or resource was not found.","action":"Check the identifier. Temporary codes and previews may already have expired or been used.","scope":"endpoint"},{"status":410,"code":"erased","description":"The card existed and was erased or removed. The response also carries its public erasure receipt.","action":"Stop using this card as current authority. Retain only the public receipt if needed.","scope":"endpoint"},{"status":429,"code":"rate_limited","description":"An anonymous, signed-request or API-key allowance was exceeded.","action":"Wait at least `Retry-After` seconds. Share a queue and retry budget across your workers.","scope":"common"},{"status":500,"code":"internal_error","description":"An unexpected server error occurred. Internal details are not returned.","action":"Retry reads with bounded backoff. Check write results before sending a new signed operation.","scope":"common"},{"status":503,"code":"busy","description":"The application has reached a temporary concurrency or database limit.","action":"Wait `Retry-After` seconds and retry with bounded backoff.","scope":"common"},{"status":503,"code":"log_unavailable","description":"The public log cannot currently be read, verified or used for publication.","action":"For reads, keep the result unverified and try later. Before retrying a write, read the card to check whether publication completed.","scope":"endpoint"}],"responseHeaders":[{"name":"Content-Type","value":"application/json","description":"Use the declared media type before choosing a parser."},{"name":"Date","value":"HTTP date","description":"Server time. Compare it with your clock when signing requests."},{"name":"Retry-After","value":"integer seconds, on rate_limited or busy","description":"Wait at least this long before retrying. Other 429/503 codes do not necessarily include it."}],"documentationUrl":"https://veil.rip/docs/version-proof","supportsBrowserFetch":true,"browserMode":"fetch"}}