Anyone holding the receipt body can recompute the digest and see whether it was altered. A digest is not a digital signature: it proves the body is unchanged, not who produced it.
A receipt digest shows the receipt was not altered. It is not a signature and does not by itself prove NOSHASHI issued it.
Looking one up
| Verb | What it does |
|---|---|
authority/check | POST — re-derive an authority certificate's digest from its own body. Free, unauthenticated, reads nothing. |
receipts/{digest} | GET — a receipt this account or its organization recorded, as it was served. read or verify scope, free. |
See the API reference for request and response shapes.
Generated from src/lib/policy.ts · supabase/functions/noshashi-verify/index.ts