Integrate Sealarca into your application.

curl https://api.sealarca.ch/v1/models \
  -H "Authorization: Bearer $SEALARCA_API_KEY"

{"data":[{"id":"<model-id>","object":"model"}]}

curl -i https://api.sealarca.ch/v1/responses \
  -H "Authorization: Bearer $SEALARCA_API_KEY" \
  -H "Content-Type: application/json" \
  -d "{\"model\":\"$SEALARCA_MODEL_ID\",\"input\":\"Summarize this file.\"}"

export SEALARCA_VAULT_PROOF_URL="<X-Sealarca-Vault-Proof-URL>"

curl "$SEALARCA_VAULT_PROOF_URL" \
  -H "Authorization: Bearer $SEALARCA_API_KEY"

{
  "schema": "sealarca-vault-proof/1",
  "receipt_id": "<receipt-id>",
  "status": "verified",
  "model": "<model-id>",
  "created_at": "<ISO-8601>",
  "updated_at": "<ISO-8601>",
  "verified_at": "<ISO-8601>",
  "expires_at": "<ISO-8601>",
  "admission": {
    "status": "verified",
    "checked_at": "<ISO-8601>",
    "attested_at": "<ISO-8601>",
    "expires_at": "<ISO-8601>",
    "evidence_digest": "sha256:<hex>",
    "keyset_digest": "sha256:<hex>"
  },
  "checks": [
    { "id": "attestation", "status": "verified" },
    { "id": "receipt", "status": "verified" }
  ],
  "hashes": {
    "request": "sha256:<hex>",
    "response": "sha256:<hex>",
    "request_received": "sha256:<hex>",
    "request_forwarded": "sha256:<hex>",
    "response_returned": "sha256:<hex>",
    "keyset": "sha256:<hex>",
    "evidence": "sha256:<hex>",
    "runtime": "sha256:<hex>"
  }
}

{
  "schema": "sealarca-vault-attestation/1",
  "status": "verified",
  "nonce": "<64-lowercase-hex-characters>",
  "verified_at": "<ISO-8601>",
  "expires_at": "<ISO-8601>",
  "checks": [{ "id": "<check-id>", "status": "verified" }],
  "measurements": {
    "evidence": "sha256:<hex>",
    "runtime": "sha256:<hex>",
    "keyset": "sha256:<hex>"
  },
  "key_fingerprints": {
    "receipt_signing": ["sha256:<hex>"],
    "tls": ["sha256:<hex>"],
    "e2ee": ["sha256:<hex>"]
  }
}

curl -f "$SEALARCA_VAULT_PROOF_URL/bundle" \
  -H "Authorization: Bearer $SEALARCA_API_KEY" \
  -o sealarca-vault-proof.jws.json

curl -f "https://api.sealarca.ch/v1/vault/proofs/signing-keys" \
  -o sealarca-vault-jwks.json

import { createHash, createPublicKey, verify } from "node:crypto";
import { readFileSync } from "node:fs";

const bundle = JSON.parse(readFileSync("sealarca-vault-proof.jws.json", "utf8"));
const jwks = JSON.parse(readFileSync("sealarca-vault-jwks.json", "utf8"));
const header = JSON.parse(Buffer.from(bundle.protected, "base64url"));
if (header.alg !== "EdDSA" || header.typ !== "sealarca-vault-proof+jws") throw new Error("Unexpected JWS algorithm");
const jwk = jwks.keys.find((key) => key.kid === header.kid);
if (!jwk || jwk.kty !== "OKP" || jwk.crv !== "Ed25519") throw new Error("Signing key not found or unsupported");
// Obtain this fingerprint independently from your current Sealarca contract/guide.
// Never trust a fingerprint received alongside an untrusted bundle.
const expected = process.env.SEALARCA_VAULT_JWK_SHA256;
if (!expected) throw new Error("Trusted JWK fingerprint required");
const thumbprint = createHash("sha256")
  .update(JSON.stringify({ crv: jwk.crv, kty: jwk.kty, x: jwk.x }))
  .digest("hex");
if ("sha256:" + thumbprint !== expected) throw new Error("Unexpected signing key");
const valid = verify(
  null,
  Buffer.from(bundle.protected + "." + bundle.payload),
  createPublicKey({ key: jwk, format: "jwk" }),
  Buffer.from(bundle.signature, "base64url"),
);
if (!valid) throw new Error("Invalid Vault proof signature");
console.log(JSON.parse(Buffer.from(bundle.payload, "base64url")));