GET /v1/verify/:id (retired)

Why it was retired

Any verdict a server produces represents the server's trust policy, not yours. The old handler also had no access to a caller's trust roots, so the strongest result it could honestly report was structural consistency. Treeship's model is that the Hub is transport and index only: it stores and serves signed bytes, and callers verify those bytes against their own pinned trust roots. A verifier you don't run yourself is not a verifier.

Request

GET /v1/verify/:id

No authentication required.

Response

For an artifact that exists, the endpoint returns 410 Gone:

{
  "outcome": "retired",
  "message": "server-side verification is retired; fetch the signed artifact and verify it locally",
  "artifact_url": "/v1/artifacts/art_f7e6d5c4b3a2f7e6"
}

Errors

What to do instead

1. Fetch the signed artifact: GET /v1/artifacts/:id returns the DSSE envelope exactly as it was pushed.
2. Verify it locally against your own trust roots:

# CLI — local artifact verification (full signature + chain checks)
treeship verify art_f7e6d5c4b3a2f7e6

// In-process — @treeship/verify, runs anywhere WASM runs
import { verifyReceipt } from '@treeship/verify';
const result = await verifyReceipt('https://treeship.dev/receipt/ssn_abc');

The browser verification page at treeship.dev/verify/:id still works — it runs the WASM verifier entirely client-side, so the Hub cannot forge a passing result.