API base
https://api.rootsure.app — use HTTPS. Keep authentication tokens out of URLs, browser analytics and public metadata.
Rootsure · Product and documentation
Rootsure API: hashes in, states out
The local MCP server uses the same document API. Direct registration requires the same account permissions.
POST /api/v1/documents/register-hash
Use a Bearer API key and JSON containing hash (SHA-256) and optional metadata. A successful 201 response includes hash and timestamp. This endpoint does not receive the file. Account plan and quota checks still apply.
GET /api/v1/documents/verify/{hash}
Public lookup without authentication. An unknown digest returns 404. A record includes hash, status, created_at and available stamped_at/tx_id data; a stamped record may include verified, merkle_root and batch_cids. Metadata can be returned publicly.
GET /api/v1/documents
Authenticated account listing with limit, offset and date filters, also exposed by list_certified_documents in MCP.
Interpretation matters
The current backend sets verified from its STAMPED state. That flag alone does not independently validate a Merkle proof or blockchain transaction. The public verifier reports the service state; inspect the anchor data before relying on the evidence.