How to verify a ClearRun receipt

Anyone can look up a verdict id at GET https://api.clearrun.net/api/verify/{verdictId}. No API key is needed, and it uses no credits. The lookup confirms ClearRun issued that score for that text. It does not check whether the answer is true.

Last updated

Look it up

  1. Copy the verdict id

    Copy the verdictId from the verdict you got back.

  2. Look it up

    curl -s https://api.clearrun.net/api/verify/6e07586d-e028-43d6-bec3-0f4821b22ca0

  3. Read the reply

    Read the fields in the next section.

Other ways to do the same lookup, all with no key:

  • Command line: clearrun verify 6e07586d-e028-43d6-bec3-0f4821b22ca0 (@clearrun/cli 1.2.0; the lookup has existed since 0.3.0).
  • SDK: createVerifyClient().verify({ verdictId }).
  • MCP app: the clearrun_verify tool.

Read the reply

  • verified: true when the signature is valid and the chain is intact.
  • signatureValid: whether ClearRun's signature checks out against its public key.
  • chainIntact: whether the receipt still links correctly to the receipts before it.
  • The receipt fingerprints and the public verdict.

If you get 404

  • Wrong id: check the id. The reply is {"error":"verdict not found"}.
  • Just scored: if the receipt was queued, the lookup returns 404 until it is saved. Try again in a few minutes.

Keys

ClearRun's public signing keys are at /.well-known/jwks.json. The verdict's signatureKeyId tells you which one was used.

Checking a whole workspace's chain at once needs a signed-in account or an API key. The single lookup above does not.

A verified receipt does not mean the answer is true. See What does signed and receipted mean?