Public Verification

A relying party — someone who received a file and a Jatobá certificate — verifies integrity here without an account. Responses contain only the public projection (serial, hash, timestamps, on-chain anchors) — never owner, IP, or storage details. Responses are cacheable for 60 s.

GET /api/public/verify

Look up a notarized record by SHA-256. Compute the hash of your copy locally; a match proves your file is byte-identical to the notarized original.

shasum -a 256 contrato.pdf
curl "https://jatoba-web3-production.up.railway.app/api/public/verify?hash=a1b2c3...64hex"

200

{
  "found": true,
  "document": {
    "serialNumber": "JAT-7K2M9",
    "sha256Hash": "a1b2c3...",
    "onchainStatus": "registered",
    "onchainTxHash": "0x...",
    "onchainAttestationUid": "0x...",
    "stacksStatus": "registered",
    "stacksTxId": "...",
    "createdAt": "2026-05-01T12:00:00.000Z"
  }
}

{ "found": false } when no record matches. 400 for a malformed hash. Rate limit: 30/min.

GET /api/public/documents/:serial

Resolves a serial number (the target of the certificate's QR code) to the canonical hash and on-chain anchors.

curl https://jatoba-web3-production.up.railway.app/api/public/documents/JAT-7K2M9

200 — the public document projection. 400 invalid serial format, 404 not found. Any tenant prefix is accepted (JAT-, ALR-, …).