nexart.iodocs

    verify.nexart.io — Verification Portal

    The public verification portal for CERs and Project Bundles at verify.nexart.io — no NexArt SDK required.

    Overview

    verify.nexart.io is the public verification portal for NexArt records. It supports two verification flows: one for individual CERs and one for Project Bundles.

    Verification runs in the browser
    All cryptographic checks execute locally in the browser using @nexart/ai-execution. The node provides data (bundles, receipts, public keys). Trust comes from the cryptographic verification itself, not from the node serving the data.

    Certificate Hash Verification

    Route: /c/:certificateHash

    Verifies a single Certified Execution Record by its certificateHash.

    Example URL
    https://verify.nexart.io/c/sha256%3A9e8d7c6b5a4f3210...

    Checks performed:

    • Bundle integrity: recomputes the certificateHash and confirms it matches
    • Node signature: validates the Ed25519 signature against the node's published key (if attestation is present)
    • Receipt consistency: confirms the receipt references the correct certificateHash
    • Verification envelope: validates the envelope signature (when present)

    Project Bundle Verification

    Route: /p/:projectHash

    Verifies an entire Project Bundle by its projectHash.

    Example URL
    https://verify.nexart.io/p/sha256%3Aab12cd34ef56...

    Checks performed:

    • Project hash integrity: recomputes the projectHash from all steps
    • Per-step CER verification: each embedded CER is verified individually
    • Step registry consistency: confirms step ordering and structure are intact
    • Project-level node receipt: validates the project-level attestation (if present)

    Also Supported

    • By execution ID: /e/:executionId for records created through the certify API
    • By bundle upload: paste or drag-and-drop a CER JSON bundle for offline-style verification

    What Is Visible

    • Verification status, hash, timestamp, and node identity are always shown
    • Raw input and output content is never exposed. The record contains SHA-256 hashes only.
    • Metadata fields may be included or redacted based on the record's export settings
    Public verification limitation
    Because snapshot.input and snapshot.output are redacted on public endpoints:
    • Full envelope verification (Layer 3) is NOT possible from public data alone.
    • Receipt verification (Layer 2) IS possible.
    • certificateHash verification (Layer 1) IS possible against the public-safe representation.

    Trust Model

    The verifier does not ask you to trust the node. It fetches the CER data and the node's public keys, then runs all checks locally in the browser. If the hashes match and the signatures are valid, the record is verified. The node is an independent witness, not a trust authority.

    See Attestation and Node Role for more on how the node fits into the trust model.