CrawlCheck Receipt API
The Receipt API from CrawlCheck — 2 operation(s) for receipt.
Work with this as data
Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/crawlcheck-io:crawlcheck-io-receipt-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
OpenAPI Specification
openapi: 3.2.0
info:
title: Crawlcheck Io Receipt API
version: '1'
contact:
name: CrawlCheck
url: https://crawlcheck.io/policy
email: hello@crawlcheck.io
license:
name: Terms
url: https://crawlcheck.io/policy
x-core-contract:
promise: 'These operations are the core contract. They stay at /api/v1 and keep answering for at least 180 days after any /api/v2 is announced; their stable fields change only in a new major version, and their provisional fields only after 30 days'' notice, per /docs/api/compatibility. Verifying what they return needs none of these calls: crawlcheck-verify.mjs checks a document on your machine against the published keys (/.well-known/http-message-signatures-directory) and the rotation record, read once with --online or saved for --keys. Everything else documented here is useful but secondary, and may change with the notice its fields'' tags promise.'
operations:
- method: GET
path: /api/v1/resolve
operationId: resolveDomainV1
- method: POST
path: /api/v1/resolve
operationId: resolveBatchV1
- method: POST
path: /api/v1/preflight
operationId: preflightV1
- method: GET
path: /api/v1/decisions/{sha256}
operationId: decisionCheckV1
- method: GET
path: /api/v1/revocations
operationId: revocations
- method: GET
path: /api/v1/visitor
operationId: visitorResolveV1
- method: POST
path: /api/v1/visitor
operationId: visitorResolveBatchV1
- method: GET
path: /api/v1/mcp/scan
operationId: mcpScanUrl
- method: POST
path: /api/v1/mcp/lock/check
operationId: mcpLockCheck
list: https://crawlcheck.io/api/v1/core
description: 'Operations tagged Receipt across 2 of this provider''s published API definitions: crawlcheck-io-openapi.json, crawlcheck-io-openapi.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://crawlcheck.io
tags:
- name: Receipt
paths:
/api/receipt:
get:
operationId: getReceipt
summary: 'A signed remediation receipt by its id (rc1:): the record before a fix, the…'
parameters:
- name: id
in: query
required: true
schema:
type: string
- name: download
in: query
schema:
type: string
responses:
'200':
description: receipt + verification
content:
application/json:
schema:
type: object
required:
- ok
- receipt
- verification
properties:
ok:
type: boolean
receipt:
$ref: '#/components/schemas/RemediationReceiptV1'
verification:
type: object
outcomes:
type: object
description: 'out1: for the domain''s owner, FixOutcomesV1 with available:true; for anyone else {available:false, why, url}. Outside the signed receipt, so it never affects verification'
offline:
type: object
examples:
worked:
summary: 'Produced by the real Worker code in the build harness: gretel.ai scanned, the CrawlCheck Fix plugin''s install recorded, the fix re-measured by the scheduled re-scan, the receipt issued and signed with a test Ed25519 key. Production signs with the key published at /.well-known/http-message-signatures-directory.'
value:
ok: true
receipt:
receipt_id: rc1:34404eab9aac4fda3954c67eac4ce9ed57801f43045016a7024da0ea7f23d80a
kind: crawlcheck-remediation-receipt
v: 1
issued_at: '2026-10-01T13:59:40.372Z'
issuer:
observer: crawlcheck-worker
version_id: null
version_tag: null
key:
kid: LyAI8HHzeyqT5CxiHGtDPtYB_sqCFTks0xItYzw6R0U
jwk:
kty: OKP
crv: Ed25519
x: 04AsqEw9oocJkSD1LeZbuX3XO8O5xuOfERy51_64Log
published_in: https://crawlcheck.io/.well-known/http-message-signatures-directory
subject:
domain: gretel.ai
before:
report_id: 4nklzvp1c6
scanned_at: '2026-10-01T13:59:29.683Z'
grade: D
score: 66
score_version: 26
refused: false
findings: 3
manifest_sha256: ee8aaedac158316727b81a7336fd5f340117543e6406ca41a2a91d416738f05c
decision_root: f94686a53415a0c29d4d4f66223fb4d3373bb56f3e1351db91fa2c8315c6c4bd
trace_id: e2390e950b821749ecde705f2f98a6ad
declared_fix:
kind: crawlcheck-fix plugin
declared_by: the site itself (the plugin's ping)
declared_at: '2026-10-01T13:59:36.196Z'
plugin_version: 1.2.0
fixes:
- robots
- llms
note: null
deployed:
at: '2026-10-01T13:59:36.196Z'
basis: the site first answered the plugin's check at this time
after:
report_id: dwgvz7p5q0
scanned_at: '2026-10-01T13:59:36.233Z'
grade: D
score: 66
score_version: 26
refused: false
findings: 3
manifest_sha256: 3ee8be103e153fd424379d9a9e373a31c10fa03d6a210936ac5822df1703305d
decision_root: 4c2e2b8cdb8a751e606d8488bc50e000a955782275a598352656690726fa7ddf
trace_id: e98f76519690115bbf57dd8148267de8
verification:
verdict: unchanged
summary: 'No measured change: 0 findings cleared, 0 new; 0 rows now pass, 0 now fail; D 66 → D 66'
comparable: true
findings:
cleared: []
new: []
kept: 3
rows:
now_passing: 0
now_failing: 0
files: []
rollback_needed: false
rollback_steps: []
method: 'rbkCompare over the two stored records: findings by fingerprint, scored rows by section and key, machine files by the sha256 of the bytes each scan received'
links:
before: https://crawlcheck.io/api/verify?id=4nklzvp1c6
after: https://crawlcheck.io/api/verify?id=dwgvz7p5q0
rollback: https://crawlcheck.io/api/rollback?from=4nklzvp1c6&to=dwgvz7p5q0
signature:
v: 1
alg: Ed25519
kid: LyAI8HHzeyqT5CxiHGtDPtYB_sqCFTks0xItYzw6R0U
over: receipt_sha256
receipt_sha256: 34404eab9aac4fda3954c67eac4ce9ed57801f43045016a7024da0ea7f23d80a
message: 'crawlcheck-receipt-v1
34404eab9aac4fda3954c67eac4ce9ed57801f43045016a7024da0ea7f23d80a'
sig: aue1srlFjYBKr9GBr9fGVo9ou5Sa9BSvfkwOQ4GruULki1avalGG0Qt2aK--FaePluIZ2CJQ_vM5r6Vqh_cLCg
signed_at: '2026-10-01T13:59:40.372Z'
canonical: sha256 over canonical JSON (keys sorted at every level, no whitespace) of the receipt without receipt_id and signature
verification:
ok: true
receipt_id: rc1:34404eab9aac4fda3954c67eac4ce9ed57801f43045016a7024da0ea7f23d80a
checks:
- id: receipt_hash
ok: true
why: the receipt hashes to its id
- id: key_id
ok: true
why: the key's RFC 7638 thumbprint is the signature's key id
- id: key_published
ok: true
why: the key is in this observer's published directory
- id: signature
ok: true
why: Ed25519 signature over the receipt digest verifies
offline:
verifier: https://crawlcheck.io/crawlcheck-verify.mjs
sha256: 84c7f88630caa7ce588b26cd68536f6d082ca4027e3dea5d4cb47745d9ea09d5
run: node crawlcheck-verify.mjs receipt.json
download: https://crawlcheck.io/api/receipt?id=rc1%3A34404eab9aac4fda3954c67eac4ce9ed57801f43045016a7024da0ea7f23d80a&download=1
'404':
description: unknown id
x-codeSamples:
- lang: Shell
label: curl
source: curl -s 'https://crawlcheck.io/api/receipt?id=rc1:34404eab9aac4fda3954c67eac4ce9ed57801f43045016a7024da0ea7f23d80a'
security: []
x-auth: public; no credential read
tags:
- Receipt
servers:
- url: https://crawlcheck.io
/api/receipt/verify:
post:
operationId: verifyReceipt
summary: 'Verify any remediation receipt: POST its JSON; receipt_hash, key_id…'
responses:
'200':
description: checks
content:
application/json:
schema:
type: object
properties:
kind:
type: string
ok:
type: boolean
receipt_id:
type:
- string
- 'null'
checks:
type: array
items:
type: object
properties:
id:
type: string
ok:
type:
- boolean
- 'null'
why:
type: string
examples:
worked:
summary: 'Produced by the real Worker code in the build harness: gretel.ai scanned, the CrawlCheck Fix plugin''s install recorded, the fix re-measured by the scheduled re-scan, the receipt issued and signed with a test Ed25519 key. Production signs with the key published at /.well-known/http-message-signatures-directory.'
value:
kind: crawlcheck-receipt-verification
ok: true
receipt_id: rc1:34404eab9aac4fda3954c67eac4ce9ed57801f43045016a7024da0ea7f23d80a
checks:
- id: receipt_hash
ok: true
why: the receipt hashes to its id
- id: key_id
ok: true
why: the key's RFC 7638 thumbprint is the signature's key id
- id: key_published
ok: true
why: the key is in this observer's published directory
- id: signature
ok: true
why: Ed25519 signature over the receipt digest verifies
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/RemediationReceiptV1'
examples:
worked:
summary: The request behind the worked response
value:
receipt: (the receipt JSON)
x-codeSamples:
- lang: Shell
label: curl
source: 'curl -s -X POST -H ''content-type: application/json'' --data @receipt.json ''https://crawlcheck.io/api/receipt/verify'''
security: []
x-auth: public; no credential read
x-crawlcheck-budget:
request_body_max: 8388608
tags:
- Receipt
servers:
- url: https://crawlcheck.io
components:
schemas:
ReceiptSideV1:
type: object
required:
- report_id
- scanned_at
properties:
report_id:
type:
- string
- 'null'
x-stability: stable
scanned_at:
type:
- string
- 'null'
x-stability: stable
grade:
type:
- string
- 'null'
x-stability: stable
score:
type:
- number
- 'null'
x-stability: stable
score_version:
type:
- number
- 'null'
x-stability: stable
refused:
type: boolean
x-stability: stable
findings:
type:
- number
- 'null'
x-stability: stable
manifest_sha256:
type:
- string
- 'null'
x-stability: stable
decision_root:
type:
- string
- 'null'
x-stability: stable
trace_id:
type:
- string
- 'null'
x-stability: stable
x-stability: stable
RemediationReceiptV1:
type: object
additionalProperties: false
required:
- receipt_id
- kind
- v
- issued_at
- issuer
- subject
- before
- declared_fix
- deployed
- after
- verification
- signature
description: 'A signed remediation receipt (GET /api/receipt?id=). receipt_id = rc1: + sha256 of the canonical JSON of every field except receipt_id and signature; signature = Ed25519 over ''crawlcheck-receipt-v1\n'' + that sha256'
properties:
receipt_id:
type: string
pattern: ^rc1:[0-9a-f]{64}$
x-stability: stable
kind:
const: crawlcheck-remediation-receipt
x-stability: stable
v:
const: 1
x-stability: stable
issued_at:
type: string
x-stability: stable
issuer:
type: object
required:
- key
properties:
observer:
type:
- string
- 'null'
x-stability: stable
version_id:
type:
- string
- 'null'
x-stability: stable
version_tag:
type:
- string
- 'null'
x-stability: stable
key:
type: object
required:
- kid
- jwk
properties:
kid:
type: string
x-stability: stable
jwk:
type: object
x-stability: stable
published_in:
type:
- string
- 'null'
x-stability: stable
x-stability: stable
x-stability: stable
subject:
type: object
required:
- domain
properties:
domain:
type: string
x-stability: stable
x-stability: stable
before:
$ref: '#/components/schemas/ReceiptSideV1'
x-stability: stable
after:
$ref: '#/components/schemas/ReceiptSideV1'
x-stability: stable
declared_fix:
type: object
properties:
kind:
type: string
x-stability: stable
declared_by:
type:
- string
- 'null'
x-stability: stable
declared_at:
type:
- string
- 'null'
x-stability: stable
plugin_version:
type:
- string
- 'null'
x-stability: stable
fixes:
type:
- array
- 'null'
items:
type: string
x-stability: stable
note:
type:
- string
- 'null'
x-stability: stable
x-stability: stable
deployed:
type: object
properties:
at:
type:
- string
- 'null'
x-stability: stable
basis:
type:
- string
- 'null'
x-stability: stable
x-stability: stable
verification:
type: object
required:
- verdict
properties:
verdict:
enum:
- improved
- unchanged
- mixed
- regressed
x-stability: stable
summary:
type:
- string
- 'null'
x-stability: stable
comparable:
type: boolean
x-stability: stable
findings:
type: object
x-stability: provisional
rows:
type: object
x-stability: provisional
files:
type: array
items:
type: object
properties:
path:
type: string
x-stability: stable
state:
type: string
x-stability: stable
before_sha256:
type:
- string
- 'null'
x-stability: stable
after_sha256:
type:
- string
- 'null'
x-stability: stable
before_status:
type:
- number
- 'null'
x-stability: stable
after_status:
type:
- number
- 'null'
x-stability: stable
x-stability: stable
rollback_needed:
type: boolean
x-stability: stable
rollback_steps:
type: array
items:
type: object
x-stability: provisional
method:
type:
- string
- 'null'
x-stability: internal
x-stability: stable
links:
type: object
x-stability: provisional
signature:
type: object
required:
- alg
- kid
- receipt_sha256
- message
- sig
properties:
v:
type:
- number
- 'null'
x-stability: stable
alg:
const: Ed25519
x-stability: stable
kid:
type: string
x-stability: stable
over:
type:
- string
- 'null'
x-stability: stable
receipt_sha256:
type: string
pattern: ^[0-9a-f]{64}$
x-stability: stable
message:
type: string
x-stability: stable
sig:
type: string
x-stability: stable
signed_at:
type:
- string
- 'null'
x-stability: stable
canonical:
type:
- string
- 'null'
x-stability: internal
x-stability: stable
x-stability: stable
securitySchemes:
licenceKey:
type: apiKey
in: header
name: x-crawlcheck-key
description: 'Your licence key: cc_ followed by 32 hex characters. Sent on every keyed call.'
bearer:
type: http
scheme: bearer
description: The same licence key as a Bearer token. Accepted on /api/v1/* and /api/usage.
externalDocs:
url: https://crawlcheck.io/docs/api
description: Human-readable reference
x-refined-from:
- crawlcheck-io-openapi.json
- crawlcheck-io-openapi.yml