Developer API

Verify a receipt from a clean machine in under 15 minutes. No API key is required for public verify. This page does not show secrets.

Not stored unless you ingest in a workspace.

1. Fetch the sample bundle

curl -sS http://localhost:3000/api/v1/examples/evidence-bundle -o bundle.json

2. Verify it

curl -sS -X POST http://localhost:3000/api/v1/verify \
  -H "content-type: application/json" \
  --data-binary @bundle.json

Expect HTTP 200, receiptId sha256:751f744d21be1f38defbc3abeac1b7deb71fc572fec9eb9b282e21b5763470c4, and an evidence matrix. overallState is not a certification.

3. OpenAPI and playground

• Machine-readable spec: /api/v1/openapi.json
• Secret-free playground: paste a bundle on /verify
• Written contract: docs/API.md and docs/DEVELOPERS.md

Local demo receipt (after seed)

With pnpm dev and POST /api/dev/seed (disabled in production):

curl -sS http://localhost:3000/api/v1/receipts/sha256/751f744d21be1f38defbc3abeac1b7deb71fc572fec9eb9b282e21b5763470c4

HTML: /r/sha256/751f744d21be1f38defbc3abeac1b7deb71fc572fec9eb9b282e21b5763470c4

API keys (workspace)

Create a key in the portal. It starts with awen_ and is shown once. Use it only on a server:

curl -sS -X POST http://localhost:3000/api/v1/ingest \
  -H "Authorization: Bearer $AWEN_API_KEY" \
  -H "content-type: application/json" \
  -H "Idempotency-Key: demo-1" \
  --data-binary @bundle.json

Never paste a live key into this page, tickets, or logs. Include a requestId when asking for help.

Evidence state only. Not a certification, guarantee, background check, or quality score.