Offline document verification: a practical guide

Why offline verification matters

High-stakes workflows — legal hold, regulatory audit, multi-party disputes — cannot depend on a vendor staying online or telling the truth about logs.

Offline verification means: given a bundle_id or a downloaded ZIP, anyone can recompute hashes and validate the platform signature using published keys from NIST SHA-256 (FIPS 180-4) and EIP-191 structured signing.

DocImprint's GET /v1/extract/:id/verify endpoint is free and does not require authentication for public bundles.

Step 1: Capture and store manifest_sha256

Every successful extract returns manifest_sha256 and bundle_id in the response envelope. Store both in your database at capture time — outside DocImprint storage.

If you only store the agent's paraphrase, you lose the ability to detect tampering later. The manifest is the anchor.

curl -X POST https://api.docimprint.com/v1/extract \
  -H "Authorization: Bearer dr_live_..." \
  -H "Content-Type: application/json" \
  -d '{"source":"https://example.com/filing.pdf"}'

# Save bundle_id + manifest_sha256 from response

Step 2: Download the evidence bundle ZIP

GET /v1/extract/:id/download returns a ZIP containing manifest.json, markdown.md, screenshot.png, and other artifacts listed in the manifest.

Recompute SHA-256 for each artifact file and compare to the hashes recorded in manifest.json. Any mismatch indicates tampering or corruption.

Step 3: Verify via API or client-side

Option A — call GET /v1/extract/:id/verify. A 200 response means all artifact hashes match the signed manifest.

Option B — use our free bundle verifier tool for a quick lookup, or the manifest hash checker to validate JSON you already have.

Option C — verify the secp256k1 signature against /.well-known/docimprint-keys.json without any API call.

FAQ: common verification failures

409 tamper_detected — an artifact byte changed since capture. Re-extract from the source URL if it is still available.

Signature mismatch — manifest was altered or signed with a different key. Check you are using the current published key.

Missing bundle — retention expired or legal hold blocked deletion. Contact support for hold policies.