VerdifaX

Quickstart, curl

When you're evaluating Verdifax for procurement, sometimes the language-specific SDKs aren't enough, you want to know that the raw HTTP surface behaves predictably. This page is for that.

Prerequisites

A Verdifax orchestrator. The examples use a self-hosted one at http://localhost:9090, which needs access to the private image (see the Docker quickstart). Without that access, use the hosted API at https://api.verdifax.com with an API key, issued after an access request at verdifax.com/request, replace http://localhost:9090 with it below, and add the header -H "X-Verdifax-Key: $VERDIFAX_KEY" to each request.

Health probe

curl -s http://localhost:9090/health

{
  "ok": true,
  "service": "verdifax-orchestrator-api",
  "version": "1.0.0",
  "orchestrator_version": "...",
  "orchestrator_git_sha": "...",
  "time": "2026-04-30T03:35:04Z"
}

Attestation

curl -s -X POST http://localhost:9090/execute \
  -H "Content-Type: application/json" \
  -d '{
    "payload_text": "hello verdifax",
    "program_id":   "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
    "route_id":     "route-test",
    "registry_record_hash": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
  }'

You'll get a JSON response with ok, run_id, duration_ms, and a manifest object containing every sealed manifest field plus the final ManifestHash, assuming the run resolved to OK.

Note on non-OK outcomes: If the run resolves to pepg_deny, ccv_halt, macc_halt, aivp_t4_halt, or attestation_gap, the response includes a sealed receipt instead (deny_receipt, ccv_halt_receipt, macc_halt_receipt, aivp_t4_halt_receipt, or attestation_gap_receipt). The response status is 422 and ok is false. See Errors and Sealed artifacts for the response shapes.

Authentication

Once any API key has been created on the deployment, revoked or not, open mode ends for good, and every authenticated endpoint requires the key:

curl -s http://localhost:9090/runs \
  -H "X-Verdifax-Key: vfx_your_secret_here"

Public endpoints (/health) require no header.

Inspect a previous run

RUN_ID=42

curl -s http://localhost:9090/runs/$RUN_ID \
  -H "X-Verdifax-Key: vfx_..." | python3 -m json.tool

Verify a run (server-side check)

The verify endpoint re-derives the manifest hash from the sealed fields and confirms it matches what was originally recorded:

curl -s http://localhost:9090/runs/$RUN_ID/verify \
  -H "X-Verdifax-Key: vfx_..."

{
  "ok": true,
  "verified": true,
  "manifest_hash": "6c1428f81519c5bb...",
  "recomputed_hash": "6c1428f81519c5bb...",
  "verification_at": "2026-04-30T03:35:04Z",
  "verification_kind": "manifest-self-seal",
  "formula_version": "v1.9 (execution record)",
  "dcae_engine_hint": {
    "available_at": "POST /dcae/verify",
    "engine_version": "verdifax-dcae/1.0.0"
  }
}

Download the audit PDF

curl -s http://localhost:9090/runs/$RUN_ID/report.pdf \
  -H "X-Verdifax-Key: vfx_..." \
  -o /tmp/verdifax-audit.pdf

The PDF includes the manifest hash, run metadata, sealed manifest fields, regulatory mapping (EU AI Act / HIPAA / SOX), a verification statement, and a QR code linking to the public verify page for the run.

Aggregate stats

curl -s http://localhost:9090/stats \
  -H "X-Verdifax-Key: vfx_..." | python3 -m json.tool

Returns total runs, runs today, last-24h, pass rate, average duration, and a top-10 breakdown by program_id.

Continue