Stateless · nothing stored · verifies nothing on faith

Verify a SCITT receipt or signed statement.

A free, stateless verification endpoint for SCITT receipts and signed statements (RFC9162_SHA256 vds=1 or CCF ccf.v1 vds=2). It verifies; it stores nothing; it issues nothing. Your bytes are verified in memory and discarded — nothing is stored or logged.

COSE Receipt base64

Log public key PEM

From the log’s /.well-known/did.json. Required to verify a receipt.

Leaf entry hex

Signed Statement base64

Statement public key PEM · optional

Without a key the statement’s fields are reported but the signature is not checked (verdict stays invalid until a key verifies it).

—

POST /verify · stateless · max 1 MB · the endpoint retains nothing but an anonymous request count.

The boundary

This is a verifier — NOT a Transparency Service.

	This service · verifier	A Transparency Service · separate concern
Operation	verify only	register statements, issue receipts, anchor
State	none (stateless)	a durable, append-only log
Trust commitment	none — verify it yourself	uptime, integrity, non-equivocation, witnessing
Risk class	low (read-only utility)	high (operational trust infrastructure)
Who must trust whom	nobody trusts the operator	the ecosystem trusts the log operator

A verifier that starts storing submissions, issuing receipts, or anchoring has silently become a Transparency Service with all of its obligations. This one has no write path, no persistence, and no key custody — by construction. To run a real log, see the transparency service ↗.

What it does

verify a SCITT COSE_Sign1 Signed Statement signature (if a key is given)
report the statement's issuer / subject / content-type / alg (payload-opaque)
verify a COSE Receipt inclusion proof + log signature (RFC 9162 SHA-256 vds=1, or CCF ccf.v1 vds=2)

What it does not do

operate a Transparency Service (register / issue receipts / anchor)
store, log, or retain submitted statements, payloads, or keys
validate any application profile's payload semantics (payload is opaque)
require authentication or an account (public read-only utility)

You don't need this service. The verifier is open source — pip install scitt-cose — and runs anywhere. This endpoint runs the identical library; the result is the same. For maximal privacy, verify locally: source ↗.

Privacy posture

What this endpoint retains — and does not retain.

stateless — nothing persists across requests; no database, no queue
retains nothing — no statement, payload, key, or header is stored
payload-opaque — payload bytes are never parsed for semantics and never echoed back (the response reports only payload_len)
no accounts, no authentication, no cookies, no analytics
operational logging only: HTTP method + status code + an anonymous request count — never bodies, query strings, or keys

Standards status

scitt-cose implements RFC 9943 (SCITT Architecture, published June 2026) and tracks draft-ietf-cose-merkle-tree-proofs-18 — an IETF Internet-Draft (Work in Progress), currently in the RFC Editor Queue, NOT yet published as RFCs. Substrate RFCs used: RFC 9052, RFC 9053, RFC 9162, RFC 9597, RFC 9943, RFC 9964 (9964 recognized, ML-DSA signing not implemented).