POST /verify

POST /verify
Content-Type: application/json
Authorization: Bearer <api-key>

Decision
    ↓
Attestation
    ↓
Verification

Decision
      ↓
Signed Attestation
      ↓
Independent Verification

{
  "attestation": {
    "...": "..."
  }
}

{
  "attestation": {
    "executionId": "claim-001",
    "policyId": "claims-approval",
    "policyVersion": "1.0.0",
    "signature": "..."
  }
}

Signature
     ↓
Valid?

Runtime Hash
      ↓
Known Runtime

Schema Version
       ↓
Supported?

Bundle
   ↓
Manifest
   ↓
Trust Root

Release Manifest
        ↓
Trusted Release

{
  "valid": true,
  "signatureVerified": true,
  "runtimeVerified": true,
  "schemaCompatible": true,
  "bundleVerified": true,
  "releaseVerified": true,
  "trustRootVerified": true
}

{
  "valid": true
}

{
  "valid": false,
  "signatureVerified": false
}

{
  "valid": false,
  "runtimeVerified": false
}

{
  "valid": false,
  "bundleVerified": false
}

curl -X POST https://your-runtime/verify \
  -H "Authorization: Bearer $PARMANA_API_KEY" \
  -H "Content-Type: application/json" \
  -d @attestation.json

Runtime
Verifier Service
CLI
External Auditor
Compliance Team

Trust Root
      ↓
Release Manifest
      ↓
Runtime
      ↓
Attestation
      ↓
Verification

{
  "error": "Invalid attestation"
}

{
  "error": "Unauthorized"
}

{
  "error": "Verification failed"
}

{
  "error": "Verifier failure"
}

Verified Signals
        ↓
Policy Evaluation
        ↓
Signed Attestation
        ↓
Independent Verification
        ↓
Trustworthy Evidence