PUBLIC TECHNICAL EVIDENCE · 18 OCTOBER 2026

See what we checked. Reproduce the checks.

These are first-party Truthlocks engineering results from an authorized QA workspace. They are not an independent audit, certification, performance benchmark or proof of customer adoption.

Download the sanitized dated check record (JSON). Account identifiers, credentials and private documents are excluded.

How to reproduce

Use your own workspace and records, with a server-side credential authorized for that environment. The examples below target production; sandbox accounts use https://sandbox-api.truthlocks.com/v1 and sandbox credentials. Export RECEIPT_ID before running the receipt example. A new workspace may have no agents or receipts yet; create them using the linked API guides.

What the evidence does and does not establish

The recorded calls returned HTTP 200 and the response fields listed in the JSON report. Check each verification verdict independently. A signature does not prove the factual truth of an action, and signature validity does not establish transparency-log inclusion.

Receipt log inclusion was not verified in the earlier human Slack check. These results establish neither production-scale reliability nor a complete attributed signup-to-activation journey. No organic acquisition or search ranking result is claimed.

Individual and business email delivery, verification and sign-in were completed using replacement verification messages. Those results do not establish a separately tested fresh automatic signup journey. Real-person identity verification remains pending the participant's availability.

IMPLEMENTATION AND EVIDENCE

List the agents in your workspace

Use a server-side workspace credential to inspect agent identities and their recorded status. An identity record does not independently enforce permissions in your other tools.

Run this from your terminal or backend. Keep access tokens in your environment; never place them in public browser code. Examples use production records. Sandbox uses its own endpoint and authorized environment.

curl --fail-with-body "https://api.truthlocks.com/v1/agents" \
  -H "Authorization: Bearer $TRUTHLOCKS_ACCESS_TOKEN"

A JSON response with agents and total. An empty list is valid for a new workspace.

On 18 October 2026, this endpoint returned HTTP 200 for an authenticated QA workspace. This is a scoped functional check, not a performance benchmark or independent audit. Inspect the dated check record.

Business production access follows approved onboarding. Starting an account does not require purchasing a plan.

IMPLEMENTATION AND EVIDENCE

Check a signed action receipt

Set RECEIPT_ID to a receipt your workspace can access. Preserve the complete maip-receipt: identifier and URL-encode it as one path segment.

Run this from your terminal or backend. Keep access tokens in your environment; never place them in public browser code. Examples use production records. Sandbox uses its own endpoint and authorized environment.

ENCODED_ID=$(node -p 'encodeURIComponent(process.env.RECEIPT_ID)')
curl --fail-with-body "https://api.truthlocks.com/v1/agent-receipts/verify/$ENCODED_ID" \
  -H "Authorization: Bearer $TRUTHLOCKS_ACCESS_TOKEN"

Inspect valid, verdict, signature_verified and transparency_verified separately. A valid signature does not establish log inclusion or the truth of the action described.

A retained QA receipt returned HTTP 200 in the 18 October 2026 endpoint check. Earlier human Slack checks verified its signature; transparency-log inclusion remained unverified. Inspect the dated check record.

Business production access follows approved onboarding. Starting an account does not require purchasing a plan.

IMPLEMENTATION AND EVIDENCE

Check a public document record

Replace the identifier below with an accessible public record. This checks the registered record; it does not compare a newly supplied file unless you supply the documented file evidence.

Run this from your terminal or backend. Keep access tokens in your environment; never place them in public browser code. Examples use production records. Sandbox uses its own endpoint and authorized environment.

curl --fail-with-body "https://api.truthlocks.com/v1/verify" \
  -H "Content-Type: application/json" \
  --data '{"attestation_id":"YOUR_PUBLIC_RECORD_ID"}'

Inspect verdict, reasons, signature_verified, log and governance. HTTP 200 means the check returned a result, not that every check passed. Private and sandbox records may be unavailable anonymously.

An accessible QA record returned HTTP 200 with signature, log and governance fields on 18 October 2026. Missing historical evidence must remain visible as a limitation. Inspect the dated check record.

Business production access follows approved onboarding. Starting an account does not require purchasing a plan.