Fetch the signed documents and Ed25519 proof bundle
Returns only what independent verification needs: the signed documents
at their JSON-pointer paths, the Ed25519 proof bundle, and the public
JWKS URL. Same ?sig share-link capability as /verify. Verify offline
with npx @decionis/verify "<this URL>". Exit 0 means the presented
proof artifacts are cryptographically valid; it does not by itself
establish current execution eligibility.
Path Parameters
uuidQuery Parameters
The share-link capability from a dossier's verification envelope. An access gate, not proof of authenticity — the Ed25519 signatures in the proof bundle are what prove the dossier. A missing or wrong value returns the same 404 as an unknown dossier.
Expiry (epoch seconds) of a v2 org-scoped share link. Bound into the signature — stripping or editing it invalidates the link. Absent only on legacy expiry-less links, which deployments may refuse.
Response Body
application/json
application/json
application/json
curl -X GET "https://example.com/v1/public/decision-dossiers/497f6eca-6276-4993-bfeb-53cbbbba6f08/proof-bundle?sig=string"{ "service": "decionis", "dossier_id": "8a9bfc13-db6c-4e62-a117-1a4399450d29", "dossier_payload": {}, "jwks_url": "http://example.com", "jwks_path": "string", "verify_with": {}, "message": "string"}Verify a Decision Dossier — no account required GET
Runs the real Ed25519 verification against the published public JWKS — the same check anyone can reproduce offline with @decionis/verify — and returns a share-safe, masked projection of the dossier. The ?sig capability comes from a dossier's verification envelope and only gates access (it keeps dossier ids from being enumerated); the signatures prove authenticity. Every capability failure collapses to the same 404 — no oracle about which check failed.
Deterministically re-run the recorded decision GET
Re-runs the recorded inputs through the recorded policy bundle in the protocol engine — side-effect-free, nothing persisted — and reports whether the same verdict comes out. Same ?sig capability as /verify; because replay actually runs the policy engine, results are cached for about 60 seconds and capped at 20 requests per minute per dossier.