Verify a receipt

POST https://api.sidaxis.com/rest/v1/rpc/get_receipt_v2

A public read on the Data API: no key of ours, no account, and an unknown lookup returns null rather than a 404 so nobody can probe for existence.

Note the different path: this is the Data API, not functions. The only header is the publishable anon key.

curl -X POST https://api.sidaxis.com/rest/v1/rpc/get_receipt_v2 \
  -H "apikey: <publishable anon key>" \
  -H "content-type: application/json" \
  -d '{ "lookup_key": "RCP-4K2M-9QX7" }'

lookup_key accepts a sieve_hash or a receipt_code.

The public projection

It omits vrc_confidence and biovital_token_hash, and reports proof strength honestly: face, face_voice, face_voice_doc — or, for a receipt written before assurance existed, that the strength was not recorded (not_recorded) instead of inferring a level after the fact. That refusal to backfill is the honest-proof rule. See assurance.

{
  "receipt_code": "RCP-4K2M-9QX7",
  "occurred_at": "2026-09-16T12:01:42Z",
  "business": { "name": "Northwind" },
  "assurance": { "level": "face_voice_doc", "description": "Face and voice, with a verified document on record" },
  "mandate": {
    "granted_to": "agt_3f77c1de",
    "agent_display_name": "Your travel assistant",
    "agent_descriptor": "Books flights and hotels inside the limit you set"
  },
  "immutability_seal": { "anchored": true, "chain": "polygon", "tx": "0x..." }
}

When a mandate authorised the act, the receipt names the agent: granted_to, agent_display_name, agent_descriptor.

For a person

The human-facing page is /verify/:hash.