# GET /v1/verify/:id (retired)
Source: https://docs.treeship.dev/api/verify

> Server-side verification is retired. The endpoint returns 410 Gone; fetch the signed artifact and verify it locally.

<Callout type="warn">
  **This endpoint is retired.** It no longer verifies anything. For a known artifact it returns `410 Gone` with a pointer to the raw artifact. Verify locally instead: `treeship verify <artifact-id>` on the CLI, or [`@treeship/verify`](/docs/sdk/verify) anywhere WASM runs.
</Callout>

## Why it was retired

Any verdict a server produces represents the **server's** trust policy, not yours. The old handler also had no access to a caller's trust roots, so the strongest result it could honestly report was structural consistency. Treeship's model is that the Hub is transport and index only: it stores and serves signed bytes, and callers verify those bytes against their own pinned trust roots. A verifier you don't run yourself is not a verifier.

## Request

```
GET /v1/verify/:id
```

| Parameter | Type   | Description                                    |
| --------- | ------ | ---------------------------------------------- |
| `:id`     | string | The artifact ID (e.g., `art_f7e6d5c4b3a2f7e6`) |

No authentication required.

## Response

For an artifact that exists, the endpoint returns `410 Gone`:

```json
{
  "outcome": "retired",
  "message": "server-side verification is retired; fetch the signed artifact and verify it locally",
  "artifact_url": "/v1/artifacts/art_f7e6d5c4b3a2f7e6"
}
```

## Errors

| Status | Body                              | Cause                           |
| ------ | --------------------------------- | ------------------------------- |
| `400`  | `{"error": "..."}`                | Missing artifact ID             |
| `404`  | `{"error": "artifact not found"}` | No artifact exists with this ID |

## What to do instead

1. **Fetch the signed artifact:** `GET /v1/artifacts/:id` returns the DSSE envelope exactly as it was pushed.
2. **Verify it locally** against your own trust roots:

```bash
# CLI — local artifact verification (full signature + chain checks)
treeship verify art_f7e6d5c4b3a2f7e6
```

```ts
// In-process — @treeship/verify, runs anywhere WASM runs

const result = await verifyReceipt('https://treeship.dev/receipt/ssn_abc');
```

The browser verification page at `treeship.dev/verify/:id` still works — it runs the WASM verifier entirely client-side, so the Hub cannot forge a passing result.

<Callout type="info">
  Note the verdict semantics: a fetched receipt can only earn `structural-pass` (Merkle structure is consistent; signatures and issuer are **not** verified). A full `pass` requires the original envelope bytes and your pinned trust roots — the local CLI path. See [CLI verify](/docs/cli/verify).
</Callout>