Version 1 / Guides / Evidence

Verify the record outside the hosted UI

The record pull route streams the retained signed archive. Verification is local and deterministic: preserve the received bytes and apply the published verifier contract.

Verification sequence

1. 1

   Pull the complete record

   Use GET /v1/lots/{lotId}/record from a trusted backend and retain the response bytes.

2. 2

   Validate the media type and envelope

   Reject truncated, unknown-version or structurally invalid material before interpreting entries.

3. 3

   Verify canonical bytes, chain and signatures

   Resolve the registered signing key and validate each cryptographic link under its validity window.

4. 4

   Record provenance and result

   Keep key identity, verification time and failure code with the retained record.