provenance

Notarize any file or hash into a public transparency log cosigned by 7 witnesses from 6 operators and anchored to Bitcoin. Hash-only: pass a sha256 hex string, or with the local stdio server a file path (hashed on your machine; the file never leaves it) — only 32 bytes reach the log. Returns a receipt with the leaf index, inclusion-proof URL, an offline c2sp.org/tlog-proof bundle URL, and the witness trust policy. Proves the hash existed no later than the covering checkpoint, in a single history everyone sees identically; does NOT prove authorship or that the content is true. Rate-limited (10/hour). Typical use: notarize an output the moment it is produced, keep the file, hand anyone the proof URL.

{
  "type": "object",
  "properties": {
    "path": {
      "type": "string",
      "description": "Local stdio server only: file to notarize, hashed on your machine and never uploaded. The hosted server refuses it."
    },
    "sha256": {
      "type": "string",
      "description": "Alternatively, a sha256 hex digest (with or without 'sha256:' prefix)."
    }
  },
  "additionalProperties": false
}

Commit any data (an AI output, a decision, a record) into a public, witnessed transparency log and get back a verifiable, tamper-evident provenance stamp (canonical markovian-provenance/v1). It proves the data existed and was committed at this time; it does NOT assert the data is correct (provenance, not truth). No wallet, account, or funding is required, the first stamp just works, and only the SHA-256 hash of your data is sent to the public API, the raw data is never stored. The returned merkle_root is the handle: save it, then call markovian_verify(merkle_root) to prove integrity later, or pass prior stamps in derived_from to build a lineage you can walk with markovian_trace. Typical use: stamp an agent output the moment it is produced, so anyone can later confirm it was not altered.

{
  "type": "object",
  "properties": {
    "data": {
      "type": "string",
      "description": "Exact bytes/string to stamp. Hashed server-side; raw data is not stored."
    },
    "wallet": {
      "type": "string",
      "description": "Optional. Omit and the protocol mints an ephemeral committer for you. Provide one to attribute the stamp."
    },
    "label": {
      "type": "string",
      "description": "Optional human label for the stamp."
    },
    "derived_from": {
      "type": "array",
      "description": "Optional lineage. A list of prior stamps this output was derived from, each {merkle_root, data_hash}. Bound inside the committed bytes so the link is tamper-evident; the payload is published so markovian_trace can walk it.",
      "items": {
        "type": "object",
        "properties": {
          "merkle_root": {
            "type": "string"
          },
          "data_hash": {
            "type": "string"
          },
          "relationship": {
            "type": "string"
          }
        },
        "required": [
          "merkle_root",
          "data_hash"
        ]
      }
    }
  },
  "required": [
    "data"
  ],
  "additionalProperties": false
}

{
  "type": "object",
  "properties": {
    "schema": {
      "type": "string"
    },
    "merkle_root": {
      "type": "string"
    },
    "data_hash": {
      "type": "string"
    },
    "wallet": {
      "type": "string",
      "description": "Compatibility alias for issuer (kept because existing clients require it)."
    },
    "issuer": {
      "type": "string",
      "description": "The committer handle, as named in the transparency-log leaf. Attribution metadata, not a cryptographic identity."
    },
    "zk_commitment": {
      "type": [
        "string",
        "null"
      ],
      "description": "Legacy field, null for stamps after 2026-07. Historical values are Pedersen points that shipped without an opening, so clients could never check them."
    },
    "block_height": {
      "type": [
        "integer",
        "null"
      ],
      "description": "Legacy field, null for stamps after 2026-07. Historical values are internal sequence heights of a retired chain (never a Bitcoin block)."
    },
    "stamped_at": {
      "type": "string"
    },
    "verify": {
      "type": "string"
    },
    "attestation": {
      "type": "string"
    }
  },
  "required": [
    "schema",
    "merkle_root",
    "data_hash",
    "wallet",
    "stamped_at",
    "verify",
    "attestation"
  ]
}

Look up a Markovian stamp by its merkle_root against the public verifier, with no key or account. verified:true means the stamp record exists and the response echoes its committed data_hash — recompute your content's SHA-256 and compare it to that data_hash yourself to confirm the content is unaltered. An unknown merkle_root returns verified:false. The trust-nobody path is the stamp's witnessed transparency-log leaf (log_index / inclusion URL from markovian_stamp): its inclusion proof verifies against the witnessed log head with no trust in this endpoint. Read-only; anyone can run it, including a party who does not trust the stamper.

{
  "type": "object",
  "properties": {
    "merkle_root": {
      "type": "string",
      "description": "merkle_root to verify."
    }
  },
  "required": [
    "merkle_root"
  ],
  "additionalProperties": false
}

Walk and verify a stamp's full provenance lineage by merkle_root. Use this when a stamp was created with derived_from links, to map what an output was built from. Returns a MAP of the graph (not a yes/no verdict): each node carries hash_binds and anchored, each edge carries edge_verified, and `valid` is true only if every node and edge checks out. A node whose payload was never published is an unresolved frontier (resolved:false). Read-only. Provenance, not truth.

{
  "type": "object",
  "properties": {
    "merkle_root": {
      "type": "string",
      "description": "root of the stamp to trace."
    }
  },
  "required": [
    "merkle_root"
  ],
  "additionalProperties": false
}