GET /v1/verify/:id (retired)

Why it was retired

Any verdict a server produces represents the server's trust policy, not yours. The old handler also had no access to a caller's trust roots, so the strongest result it could honestly report was structural consistency. Treeship's model is that the Hub is transport and index only: it stores and serves signed bytes, and callers verify those bytes against their own pinned trust roots. A verifier you don't run yourself is not a verifier.

Request

GET /v1/verify/:id

No authentication required.

Response

For an artifact that exists, the endpoint returns 410 Gone:

{
  "outcome": "retired",
  "message": "server-side verification is retired; fetch the signed artifact and verify it locally",
  "artifact_url": "/v1/artifacts/art_f7e6d5c4b3a2f7e6"
}

Errors

What to do instead

1. Fetch the signed artifact: GET /v1/artifacts/:id returns the DSSE envelope exactly as it was pushed.
2. Verify it locally against your own trust roots:

# CLI — local artifact verification (full signature + chain checks)
treeship verify art_f7e6d5c4b3a2f7e6

// In-process — @treeship/verify, runs anywhere WASM runs
import { verifyReceipt } from '@treeship/verify';
const result = await verifyReceipt('https://treeship.dev/receipt/ssn_abc');

verifyReceipt() is structural only -- the same self-consistency check GET /v1/receipt/{session_id} describes, not a signature check. For a real, actor-signed anchor, verify the full .treeship package's record.json with package verify, or verify a specific signed artifact by id instead: the browser verification page at treeship.dev/verify/:id runs the WASM verifier entirely client-side against your own trust roots, so the Hub cannot forge a passing result for a named artifact -- that guarantee doesn't extend to the receipt's own narrative fields.