Receipt
curl --request GET \
--url https://tee.redpill.ai/v1/aci/receipts/{id} \
--header 'Authorization: Bearer <token>'import requests
url = "https://tee.redpill.ai/v1/aci/receipts/{id}"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://tee.redpill.ai/v1/aci/receipts/{id}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://tee.redpill.ai/v1/aci/receipts/{id}",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://tee.redpill.ai/v1/aci/receipts/{id}"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://tee.redpill.ai/v1/aci/receipts/{id}")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://tee.redpill.ai/v1/aci/receipts/{id}")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_bodyVerification
Receipt
The signed receipt for a response, with the full transparency event log.
GET
/
v1
/
aci
/
receipts
/
{id}
Receipt
curl --request GET \
--url https://tee.redpill.ai/v1/aci/receipts/{id} \
--header 'Authorization: Bearer <token>'import requests
url = "https://tee.redpill.ai/v1/aci/receipts/{id}"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://tee.redpill.ai/v1/aci/receipts/{id}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://tee.redpill.ai/v1/aci/receipts/{id}",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://tee.redpill.ai/v1/aci/receipts/{id}"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://tee.redpill.ai/v1/aci/receipts/{id}")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://tee.redpill.ai/v1/aci/receipts/{id}")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_bodyReturns the signed receipt for a response: a transparency event log that binds the request and
response hashes to the attested gateway, signed by a key from the attested
keyset. This is the canonical per-response proof. Look up a receipt by
the
New integrations should use
x-receipt-id header on the inference response, or by the response id. For how to read the
event log, see Receipts.
GET /v1/aci/receipts/{id}
Request
string
required
A receipt id (
rcpt-…) or the response id (chat id). The receipt id is returned in the
x-receipt-id response header on /v1/chat/completions.Response
200 OK, application/json. The bare canonical receipt:
| Field | Type | Description |
|---|---|---|
api_version | string | ACI version token, for example aci/1. |
receipt_id | string | The receipt id (rcpt-…). |
chat_id | string or null | The response/chat id, when the upstream returns one. |
workload_keyset_digest | string | Must match the attestation report. |
model | string or null | Model requested by the client. |
endpoint | string | The route served, for example /v1/chat/completions. |
method | string | HTTP method. |
served_at | number | Unix seconds. |
event_log | array | Ordered transparency events (below). |
key_id | string | Selects a receipt-signing key from the attested keyset. |
signature | string | Signature over the receipt, by a key in the attested keyset. |
event_log entries
type | Key fields |
|---|---|
request.received | body_hash |
middleware.forwarded | body_hash |
route.selected | target_route_id |
request.forwarded | body_hash |
transparency.request_modified | (present when forwarded body differs) |
upstream.verified | model_id, result, required, session_id |
response.received | body_hash |
transparency.response_modified | (present when returned response differs) |
response.returned | body_hash |
Example (truncated)
{
"api_version": "aci/1",
"receipt_id": "rcpt-e0eefe63b3673e2a5984951f",
"chat_id": "d3ad808b20a444c29e798db35f112033",
"workload_keyset_digest": "sha256:3eff0836…",
"model": "phala/gemma-4-26b-a4b-uncensored",
"endpoint": "/v1/chat/completions",
"method": "POST",
"served_at": 1781588857,
"event_log": [
{ "type": "request.received", "body_hash": "sha256:111d08a5…" },
{ "type": "route.selected", "target_route_id": "phala:gemma-4" },
{ "type": "upstream.verified", "model_id": "phala/gemma-4-26b-a4b-uncensored",
"result": "verified", "required": true, "session_id": "3681736b…" },
{ "type": "response.returned", "body_hash": "sha256:07703fb4…" }
],
"key_id": "receipt-v1",
"signature": "…"
}
Verifying the receipt
- Confirm
workload_keyset_digestmatches a verified attestation report. - Verify
signatureunder areceipt_signing_keysentry from the attested keyset. - Confirm
request.received.body_hashmatches the request you sent andresponse.returned.body_hashmatches the response you received. - Read
upstream.verified:result = verifiedandrequired = trueindicate a confidential model served from a verified, channel-bound upstream. Followsession_idto the attested session.
Legacy alias
GET /v1/signature/{id} returns the same receipt wrapped in a legacy envelope, for clients written
against earlier API versions. {id} is a receipt id or a response id.
| Field | Description |
|---|---|
api_version | ACI version token, for example aci/1. |
signing_algo | Signature algorithm, for example ecdsa. |
signing_address | Address that signed text. |
text | "<request body hash>:<response hash>", the signed message. |
signature | Signature over text. |
receipt | The full receipt object, identical to this endpoint’s response. |
/v1/aci/receipts/{id}.
Related
Get attestation report
Get session
Was this page helpful?