Skip to main content
GET
Receipt
Returns the signed receipt for a response: a transparency event log that binds the request and response hashes to the attested gateway, signed by a key from the attested keyset. This is the canonical per-response proof. Look up a receipt by the x-receipt-id header on the inference response, or by the response id. For how to read the event log, see Receipts.

Request

string
required
A receipt id (rcpt-…) or the response id (chat id). The receipt id is returned in the x-receipt-id response header on /v1/chat/completions.

Response

200 OK, application/json. The bare canonical receipt. Use the same API key that made the inference request; a different key returns 404, and a missing key returns 401 for a credential-bound receipt:

event_log entries

Example (truncated)

Verifying the receipt

  1. Confirm workload_keyset_digest matches a verified attestation report.
  2. Resolve key_id in the attested receipt_signing_keys and verify signature over the JCS (RFC 8785) form of the receipt with only signature removed. The baseline is a hex-encoded Ed25519 signature.
  3. Confirm request.received.body_hash matches the request you sent and response.returned.body_hash matches the response you received.
  4. On this TEE-only endpoint, upstream verification is required (required: true). A failed check refuses forwarding instead of returning unverified inference. Read upstream.verified: result = verified and required = true indicate a confidential model served from a verified, channel-bound upstream. Follow session_id to the attested session.
See Verify a response for the full walkthrough.

Legacy alias

GET /v1/signature/{id} returns the same receipt wrapped in a legacy envelope, for clients written against earlier API versions. {id} is a receipt id or a response id. New integrations should use /v1/aci/receipts/{id}.

Get attestation report

Get session