The Open Attestation Layer. All endpoints are public. Read endpoints require no authentication. All responses include CORS headers.
Returns an SVG badge with operator tier and score. Can be embedded on any website.
| Name | Type | Required | Description |
|---|---|---|---|
| hash | string | Yes | 64-character SHA-256 hash |
| size | string | No | small, medium (default), or large |
Verify a seal by hash. Returns tier, score, domain breakdown, and verification count.
| Name | Type | Required | Description |
|---|---|---|---|
| hash | string | Yes | 64-character SHA-256 hash |
Returns all public, non-revoked seals with hash, tier, score, date, and verify URL. Anonymized.
Full assessment methodology: weights, tiers, countermeasures, and framework mapping. Publicly published.
Maps 30 questions and 8 domains to EU AI Act 14(4)(a)-(e), NIST AI RMF, and ISO 42001.
Aggregated anonymized benchmarks by industry. Optional market filter.
| Name | Type | Required | Description |
|---|---|---|---|
| market | string | No | Industry filter, e.g. 'Financial Services' |
Full verification log with SHA-256 hash chain for tamper protection.
| Name | Type | Required | Description |
|---|---|---|---|
| hash | string | Yes | 64-character SHA-256 hash |
JSON-LD structured data for search engine indexing.
| Name | Type | Required | Description |
|---|---|---|---|
| hash | string | Yes | 64-character SHA-256 hash |
Full certificate with assessment details and Article 14 mapping.
| Name | Type | Required | Description |
|---|---|---|---|
| hash | string | Yes | 64-character SHA-256 hash |
Article 14(4)(a)-(e) compliance breakdown for a specific seal.
| Name | Type | Required | Description |
|---|---|---|---|
| hash | string | Yes | 64-character SHA-256 hash |
Revoke a seal. Requires authentication. Revoked seals remain in the registry but are marked as revoked.
| Name | Type | Required | Description |
|---|---|---|---|
| hash | string | Yes | 64-character SHA-256 hash |
| reason | string | Yes | Revocation reason |
Interactive demonstration of hash chain tamper detection. Shows what happens when an audit entry is modified.
System health check. Returns status of all backend services.
Admin audit trail of all seal operations.
Manage webhook subscriptions for compliance events. HMAC-signed payloads.
| Name | Type | Required | Description |
|---|---|---|---|
| action | string | Yes | list, create, delete, or test |
| url | string | No | Webhook URL (for create) |
| events | array | No | Event types to subscribe to |
Create a new API key for platform access. Returns key with 1,000 calls/day rate limit.
| Name | Type | Required | Description |
|---|---|---|---|
| organization_name | string | Yes | Organization name |
| scopes | array | No | Allowed scopes: verify, batch_verify, audit_trail, gdpr_export |
Batch verify up to 500 seals at once. Returns verification status for each hash.
| Name | Type | Required | Description |
|---|---|---|---|
| hashes | array | Yes | Array of SHA-256 hashes (max 500) |
Validate an API key and check permissions.
| Name | Type | Required | Description |
|---|---|---|---|
| api_key | string | Yes | API key to validate |
GDPR Article 20 - Right to data portability. Export all personal data.
| Name | Type | Required | Description |
|---|---|---|---|
| string | Yes | Email of the data subject |
GDPR Article 17 - Right to erasure. Permanently delete all personal data.
| Name | Type | Required | Description |
|---|---|---|---|
| string | Yes | Email of the data subject | |
| confirm | boolean | Yes | Confirm deletion (must be true) |
Triple AI cross-verification. Three independent model families from three different providers (xAI, Alibaba, Google) assess the same target. Returns convergence assessment with SHA-256 seal.
| Name | Type | Required | Description |
|---|---|---|---|
| target_url | string | Yes | URL of the company website to assess |
| company_name | string | Yes | Company name |
Stripe webhook handler for payment processing. Internal endpoint.
| Name | Type | Required | Description |
|---|---|---|---|
| stripe_signature | string | Yes | Stripe signature header |
12 months from assessment date
Seal expires 12 months from issue date. Expired seals remain in the public registry but are marked as expired.
Re-assessment required annually to maintain active status. A new assessment generates a new seal with a fresh hash.
Type: SHA-256 Hash Chain
Every seal verification is permanently logged with a timestamp and hash. Each entry cryptographically links to the previous entry, creating a tamper-evident chain. Any modification breaks the chain visibly.
Chain algorithm:
currentHash = SHA-256(prevHash + timestamp + sealHash + entryType + salt)
Genesis: GENESIS (hardcoded initial hash, never changes)
A lightweight SDK for integrating with your stack. Works in browser and Node.js. No dependencies.
import AuditProofClient from 'auditproof-sdk';
const client = new AuditProofClient('your_api_key');
// Verify a seal
const result = await client.verifySeal('6f21cc8c...');
// Batch verify
const batch = await client.batchVerify(['hash1', 'hash2']);
// Get registry
const registry = await client.getRegistry();
// Get badge SVG
const badge = await client.getBadge('6f21cc8c...', 'medium');
// Get QR code
const qr = await client.getQR('6f21cc8c...', 'svg');
// Get PDF certificate
const pdf = await client.getCertificatePdf('6f21cc8c...', 'en');
// Check renewal
const renewal = await client.checkRenewal('6f21cc8c...');Proof of Operator provides independent operator capability assessments. The seal constitutes evidence that an assessment was conducted by Brainiac Ltd. It is not a legal certification of compliance with EU Regulation 2024/1689 or any other regulation. Brainiac Ltd is not liable for regulatory decisions based on the seal. Companies should consult their own legal counsel regarding their specific regulatory obligations.