TTrustAccept
Tamper-evident API exchange receipts

Prove what crossed the API boundary—without turning raw secrets into a new evidence leak.

Wire Evidence hashes the exact non-empty request and response byte sequences, binds them to a scoped manifest and source-capture hash, and signs a statement covering the manifest hash, signing time, and signer metadata. The receipt contains fingerprints and bounded metadata, not raw credential-bearing payloads, authorization headers, packet captures, or TLS session secrets.

Evidence lifecycle

Capture locally. Hash exactly. Sign narrowly.

Acquire authorized evidence

Capture or export the smallest necessary API exchange under an approved test, incident, transaction, or audit procedure.

Extract exact byte sequences

Preserve the request and response byte boundaries used for hashing. Do not normalize whitespace, headers, encoding, or body bytes after extraction.

Build a bounded manifest

Record byte hashes and lengths, protocol, method, authority, path template, status, TLS metadata, action references, required capture hash, analyzer-report hash, and prior receipt hash.

Sign and chain the receipt

Sign a canonical statement containing the manifest hash, normalized signing time, and declared signer metadata, then compute a receipt hash that later evidence can link.

Verify and reconcile

A verifier reconstructs the signed statement, validates the signature and chain, recomputes hashes from retained customer-side bytes, and compares the evidence to the target-side outcome.

Public manifest shape

Auditable without publishing the transaction.

The schema is public so an auditor, customer, integrator, or verifier can understand the manifest bound by the signed statement. Sensitive byte sequences remain in the customer’s controlled evidence store or authorized capture environment.

{
  "schema": "trustaccept.wire-evidence.v1",
  "evidenceId": "wire_01J_EXAMPLE",
  "observedAt": "2026-08-23T15:00:00.000Z",
  "exchange": {
    "request": {
      "sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
      "byteLength": 842
    },
    "response": {
      "sha256": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
      "byteLength": 418
    },
    "pairSha256": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc"
  },
  "transport": {
    "protocol": "http/2",
    "method": "POST",
    "authority": "payments.example.internal",
    "path": "/v1/payments/:paymentId/release",
    "statusCode": 200,
    "tlsVersion": "TLS 1.3"
  },
  "context": {
    "organizationId": "org_example",
    "environment": "production",
    "actionId": "action_123",
    "actorId": "agent_payments",
    "targetId": "payment_gateway",
    "policyId": "policy_high_value_release"
  },
  "source": {
    "captureSha256": "dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd",
    "analyzerReportSha256": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
    "frameNumbers": [
      184,
      201
    ]
  },
  "chain": {
    "previousReceiptHash": null
  },
  "redaction": {
    "rawRequestStoredInReceipt": false,
    "rawResponseStoredInReceipt": false,
    "credentialValuesStoredInReceipt": false
  },
  "claimBoundary": [
    "Attests to the signed statement and bound manifest hash, not to human intent.",
    "Does not by itself prove capture completeness, target authorization, or business completion.",
    "Independent exchange verification requires retained bytes or another authorized source that can reproduce their hashes."
  ]
}
What the receipt can establish
  • The signer signed a statement binding the canonical manifest hash, recorded signing time, and declared signer metadata.
  • The manifest contains specific request and response byte fingerprints and non-zero lengths.
  • The request/response pair hash changes if either byte sequence or length boundary changes.
  • The manifest is linked to the stated capture, analyzer report, action references, and prior receipt hashes.
  • A later verifier can compare retained bytes and target evidence to the bound manifest.
The receipt does not by itself prove human intent, capture completeness, semantic correctness, target-side authorization, or downstream business completion.
High-value use cases

Where application logs are not enough.

AI-agent actions

Bind a governed action and authorization record to the request and response observed at the enforced execution boundary.

Regulated transactions

Preserve scoped, independently checkable fingerprints for approvals, submissions, payments, changes, and sensitive data exchanges.

Integration disputes

Establish the exact byte fingerprints and response status associated with a contract-sensitive API call without publishing the payload.

Incident evidence

Chain API exchange fingerprints into an investigation timeline while keeping raw captures inside the authorized evidence environment.

APIAuth handoff

Detection before attestation

APIAuth.org provides the free authentication-on-the-wire guides, browser inspector, and local PCAP analyzer. It prepares a redacted report and capture hash. TrustAccept adds the signed, chained evidence receipt.

Pilot offer

One consequential API exchange, fully bounded.

Start with a single action path. Define the capture authority, exact byte extraction, context fields, signer, customer-side retention, verifier, target outcome, and evidence handoff before expanding coverage.