Verify any FeedOracle evidence artifact in 30 seconds. Check hashes, signatures, and blockchain anchors.
Every API response carries a SHA-256 payload hash in evidence.payload_hash and a byte hash in the x-content-hash header. Protected routes additionally return an x-nomos-receipt-url header pointing at a signed execution receipt. The legacy ES256K evidence.signature is not produced and reports status: UNAVAILABLE — do not treat it as verification.
Execution receipts are signed with Ed25519 (EdDSA). The public key set is published at /.well-known/nomos-execution-jwks.json in standard JWK format (kty: OKP, crv: Ed25519), and the receipt names its key in x-nomos-receipt-kid. This is not an ES256K key set and must not be used as one.
Recompute SHA-256 of the data payload. If the hash matches content_hash, the data is untampered.
The hash is anchored on Polygon. Look up the transaction on PolygonScan to confirm the timestamp is immutable.
# 1. Fetch the response AND its headers curl -s -D headers.txt -H "X-API-Key: YOUR_KEY" \ "https://feedoracle.io/api/v1/rwa/registry/stats" > report.json # 2. Key-free check: recompute the payload hash jq -cS 'del(.evidence)' report.json | tr -d '\n' | sha256sum # Compare with .evidence.payload_hash.hex # 3. Hash the delivered bytes, compare with the header sha256sum report.json; grep -i x-content-hash headers.txt # 4. Fetch the signed execution receipt (URL from the header) RCPT=$(grep -i x-nomos-receipt-url headers.txt | cut -d' ' -f2 | tr -d '\r') curl -s -H "X-API-Key: YOUR_KEY" "$RCPT" > receipt.json # 5. Ed25519 public key set (execution JWKS, not an ES256K JWKS) curl -s "https://feedoracle.io/.well-known/nomos-execution-jwks.json" > jwks.json # 6. Verify the EdDSA signature over the canonical receipt core, then check # receipt.backend.response_sha256 == your hash from step 3. # The legacy ES256K evidence.signature is UNAVAILABLE and plays no part.
x-nomos-receipt-kid response header