# Verify a receipt

`POST https://api.sidaxis.com/rest/v1/rpc/get_receipt_v2`

A public read on the Data API: no key of ours, no account, and an unknown lookup returns null rather than a 404 so nobody can probe for existence.

Note the different path: this is the Data API, not `functions`. The only header is the publishable anon key.

```
curl -X POST https://api.sidaxis.com/rest/v1/rpc/get_receipt_v2 \
  -H "apikey: <publishable anon key>" \
  -H "content-type: application/json" \
  -d '{ "lookup_key": "RCP-4K2M-9QX7" }'
```

`lookup_key` accepts a `sieve_hash` or a `receipt_code`.

> An unknown lookup returns `200 null`, never a 404 — an existence check must not be a probing tool, and a 404 would be one.

## The public projection

It omits `vrc_confidence` and `biovital_token_hash`, and reports proof strength honestly: `face`, `face_voice`, `face_voice_doc` — or, for a receipt written before assurance existed, that the strength was **not recorded** (`not_recorded`) instead of inferring a level after the fact. That refusal to backfill is the honest-proof rule. See [assurance](/assurance).

200:

```
{
  "receipt_code": "RCP-4K2M-9QX7",
  "occurred_at": "2026-09-16T12:01:42Z",
  "business": { "name": "Northwind" },
  "assurance": { "level": "face_voice_doc", "description": "Face and voice, with a verified document on record" },
  "mandate": {
    "granted_to": "agt_3f77c1de",
    "agent_display_name": "Your travel assistant",
    "agent_descriptor": "Books flights and hotels inside the limit you set"
  },
  "immutability_seal": { "anchored": true, "chain": "polygon", "tx": "0x..." }
}
```

When a mandate authorised the act, the receipt names the agent: `granted_to`, `agent_display_name`, `agent_descriptor`.

## For a person

The human-facing page is `/verify/:hash`.