API docs

Who can call it: anyone, no token

curl https://codeproof.enthernetservice.com/healthz

{
  "status": "ok",
  "database": "ok",
  "version": "0.1.0",
  "demo_mode": true,
  "ai_enabled": false,
  "sandbox": "linux-namespace",
  "policy_version": "codeproof-default@2026.10.1+ccd8b94b3478"
}

Who can call it: anyone, no token

curl https://codeproof.enthernetservice.com/api/v1/demo

Returns repository, base_commit, personas and scenarios (each with id, title, declared_task, expected and candidate_commit). The live values are in the scenario table below.

Who can call it: anyone, no token

curl -X POST https://codeproof.enthernetservice.com/api/v1/demo/login/developer

{
  "token": "…",
  "synthetic": true
}

Personas: developer, approver, security, auditor, admin, viewer.

Who can call it: any persona

curl -H "Authorization: Bearer $TOKEN" https://codeproof.enthernetservice.com/api/v1/me

{
  "user_id": "usr_demo_developer",
  "tenant_id": "demo",
  "name": "Ada Synthetic (developer)",
  "role": "DEVELOPER",
  "synthetic": true,
  "permissions": [
    "explanation.request",
    "review.ACKNOWLEDGE",
    "verification.read",
    "verification.submit"
  ]
}

Who can call it: any persona

curl -H "Authorization: Bearer $TOKEN" https://codeproof.enthernetservice.com/api/v1/repositories

{"repositories": [{"name": "DemoPay-API", "synthetic": true}]}

Who can call it: developer, security, admin

curl -X POST -H "Authorization: Bearer $TOKEN" https://codeproof.enthernetservice.com/api/v1/demo/scenarios/D/run

{
  "verification_id": "ver_91757889c3414b80a08b",
  "status": "QUEUED",
  "reused": false
}

202 for a new verification, 200 with "reused": true when the same change was already verified (idempotency).

Who can call it: developer, security, admin

curl -X POST -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
  -d '{"repository":"DemoPay-API","base_commit":"<base>","candidate_commit":"<candidate>",
       "declared_task":"Add receipt formatter","ai_assisted":"YES",
       "generation_metadata":{"source_type":"ide","human_or_ai":"YES","tool_name":"my-codegen"}}' \
  https://codeproof.enthernetservice.com/api/v1/verifications

Unknown fields are rejected with 422, so a tenant id, URL or command can't be passed in. Response is the same shape as the scenario run.

Who can call it: any persona

curl -H "Authorization: Bearer $TOKEN" "https://codeproof.enthernetservice.com/api/v1/verifications?limit=20"

limit defaults to 50, max 200. Each item has id, status, decision, outcome, evidence_hash, timeline, summary and effective (what CI should do).

Who can call it: any persona

curl -H "Authorization: Bearer $TOKEN" https://codeproof.enthernetservice.com/api/v1/verifications/ver_91757889c3414b80a08b

{
  "verification": {
    "id": "ver_91757889c3414b80a08b",
    "status": "COMPLETED",
    "decision": "REVIEW_REQUIRED",
    "outcome": "REVIEW",
    "summary": {
      "security_findings": 1,
      "secrets": 0,
      "dependencies_added": 0,
      "tests_executed": 18,
      "rules_fired": [
        "HIGH_SECURITY_FINDING",
        "AUTHENTICATION_FILES_CHANGED"
      ],
      "files_changed": 2
    },
    "effective": {
      "ci_status": "action_required",
      "label": "REVIEW_REQUIRED"
    }
  },
  "evidence": {
    "policy_decision": "REVIEW_REQUIRED",
    "policy_rules_fired": [
      {
        "rule": "HIGH_SECURITY_FINDING",
        "decision": "REVIEW_REQUIRED",
        "observed": 1,
        "threshold": {
          "op": "gt",
          "value": 0
        },
        "exception_allowed": true,
        "reason": "New high-severity static-analysis finding."
      }
    ],
    "diff_summary": "\u2026",
    "build_result": "\u2026",
    "test_result": "\u2026",
    "coverage_result": "\u2026",
    "security_findings": "\u2026",
    "secret_findings": [],
    "dependency_findings": [],
    "environment": "\u2026",
    "attestation": "\u2026",
    "ai_used_for_authority": false,
    "evidence_hash": "sha256:\u2026"
  },
  "integrity": {
    "hash_verifies": true,
    "attestation_verifies": true,
    "index_matches": true,
    "valid": true
  },
  "reviews": [],
  "explanations": [],
  "authority": {
    "verified_by": "AUTOMATION",
    "ai_authorization": "NEVER"
  }
}

Poll this until verification.status is COMPLETED (or an infrastructure failure such as SANDBOX_FAILED or TIMEOUT, which never carries a decision). A DemoPay run takes about a second.

Who can call it: any persona

curl -H "Authorization: Bearer $TOKEN" -o evidence.json \
  https://codeproof.enthernetservice.com/api/v1/verifications/<id>/evidence

Canonical JSON with an HMAC attestation. Check it offline with python -m codeproof.cli verify-evidence evidence.json (needs the signing key).

Who can call it: any persona

curl -H "Authorization: Bearer $TOKEN" https://codeproof.enthernetservice.com/api/v1/verifications/<id>/integrity

{
  "verification_id": "ver_\u2026",
  "evidence_hash": "sha256:\u2026",
  "hash_verifies": true,
  "attestation_verifies": true,
  "index_matches": true,
  "valid": true
}

Who can call it: ACKNOWLEDGE: developer, approver, security, admin · REQUEST_CHANGES / REJECT: approver, security, admin · APPROVE_EXCEPTION: approver, security (never the submitter, never admin)

curl -X POST -H "Authorization: Bearer $APPROVER_TOKEN" -H "Content-Type: application/json" \
  -d '{"action":"APPROVE_EXCEPTION","reason":"Header check is behind the support VPN; accepted."}' \
  https://codeproof.enthernetservice.com/api/v1/verifications/<id>/reviews

action: ACKNOWLEDGE, APPROVE_EXCEPTION, REJECT or REQUEST_CHANGES. reason: 10–2,000 chars. Returns 201. The evidence and decision never change; the review is layered on top and shows in effective (for example REVIEW_REQUIRED — EXCEPTION APPROVED).

Refusals: 403 wrong role or you submitted the change · 409 PASS needs no exception, the verification isn't complete, a fired rule can't be waived (SECRET_DETECTED, MANDATORY_CHECK_INCOMPLETE), or evidence integrity failed.

Who can call it: all except viewer

AI is switched off on this server, so this returns 503 with "verification_unaffected": true. When enabled, the explanation is stored separately and can never change evidence or the decision.

Who can call it: any persona

{
  "verifications_total": 14,
  "pass": 1,
  "review_required": 1,
  "blocked": 5,
  "not_verified": 7,
  "in_progress": 0,
  "security_findings": 2,
  "secrets_detected": 1,
  "dependencies_added": 1,
  "tests_executed": 116,
  "average_verification_ms": 645,
  "ai_assisted_changes": 10,
  "human_exceptions": 0
}