Quickstart

You need no account and no credential. The primary endpoint answers anonymously.

1. Hash your document

Audrie verifies a hash, never a file. Compute it yourself:

sha256sum contract.pdf

On macOS: shasum -a 256 contract.pdf.

This is the whole zero-knowledge claim in one step — the document does not leave your machine, and no endpoint would accept it if you tried.

2. Ask for a verdict

curl -sX POST https://api.audrie.io/v1/verifications \
  -H "Content-Type: application/json" \
  -d '{"originalDocHash":"sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"}'

Replace the hash with your own, prefixed sha256:.

3. Read the answer

{
  "verdict": "no_record",
  "disclosureTier": "public",
  "assuranceLevel": "audrie.registry.v1",
  "mode": "partial",
  "originalDocHash": "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
  "verifiedAt": "2026-08-29T04:37:38Z",
  "matches": []
}

That is a success. no_record means Audrie has never seen this document — which is exactly what you want to learn about an unknown file. A document Audrie has authenticated returns verified, with the four cryptographic checks and the Hedera anchor proof in matches[].

What a credential changes

Nothing about the verdict. Adding a key from the portal (Settings → Organisation → API credentials) raises your rate limit, gives you a durable verification log you can reconcile against, and echoes your own reference back:

curl -sX POST https://api.audrie.io/v1/verifications \
  -H "Authorization: Bearer $AUDRIE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"originalDocHash":"sha256:e3b0…","reference":"matter-2026-114"}'

Read disclosureTier on the response rather than inferring it from whether you sent a key. An organisation still being validated is served at the public tier — a success, not an error, and the key does not need replacing.

Scopes, rotation, revocation and what to do about a leaked key are on API keys.

Three things that catch people out

• 503 means retry, never rotate the key. Your credential is still valid. Honour Retry-After on a 429 too. See Errors.
• matches returns at most 25 records and the response does not indicate truncation. Do not write paging logic against this field.
• GET /v1/verifications/{verificationId} always returns matches: []. Re-POST the hash to compute matches. The list operation returns summaries that carry no matches field at all.

Next: Introduction for the base URL and what a credential adds, or Disclosure tiers for which fields each tier carries.