# verify.nexart.io — Verification Portal

URL: https://docs.nexart.io/docs/verify-nexart

Use verify.nexart.io to check a Certified Execution Record or Project Bundle by hash, review each verification check, and confirm the attestation node.

## Overview

verify.nexart.io is the public verification portal for NexArt records. It supports two verification flows: one for individual CERs and one for Project Bundles.

Verification runs in the browser
All cryptographic checks execute locally in the browser using `@nexart/ai-execution`. The node provides data (bundles, receipts, public keys). Trust comes from the cryptographic verification itself, not from the node serving the data.

## Certificate Hash Verification

Route: `/c/:certificateHash`

Verifies a single Certified Execution Record by its certificateHash.

Example URL

```
https://verify.nexart.io/c/sha256%3A9e8d7c6b5a4f3210...
```

Checks performed:

- Bundle integrity: recomputes the certificateHash and confirms it matches
- Node signature: validates the Ed25519 signature against the node's published key (if attestation is present)
- Receipt consistency: confirms the receipt references the correct certificateHash
- Verification envelope: validates the envelope signature (when present)

## Project Bundle Verification

Route: `/p/:projectHash`

Verifies an entire Project Bundle by its projectHash.

Example URL

```
https://verify.nexart.io/p/sha256%3Aab12cd34ef56...
```

Checks performed:

- Project hash integrity: recomputes the projectHash from all steps
- Per-step CER verification: each embedded CER is verified individually
- Step registry consistency: confirms step ordering and structure are intact
- Project-level node receipt: validates the project-level attestation (if present)

## Also Supported

- By execution ID: `/e/:executionId` for records created through the certify API
- By bundle upload: paste or drag-and-drop a CER JSON bundle for offline-style verification

## What Is Visible

- Verification status, hash, timestamp, and node identity are always shown
- Raw input and output content is never exposed. The record contains SHA-256 hashes only.
- Metadata fields may be included or redacted based on the record's export settings

Public verification limitation
Because `snapshot.input` and `snapshot.output` are redacted on public endpoints:- Full envelope verification (Layer 3) is NOT possible from public data alone.
- Receipt verification (Layer 2) IS possible.
- certificateHash verification (Layer 1) IS possible against the public-safe representation.

## Trust Model

The verifier does not ask you to trust the node. It fetches the CER data and the node's public keys, then runs all checks locally in the browser. If the hashes match and the signatures are valid, the record is verified. The node is an independent witness, not a trust authority.

See Attestation and Node Role for more on how the node fits into the trust model.