Your first public read

Inspect the running application, read its current capability evidence, then try receipt verification. No account, API key or SDK installation is needed for the public reads below.

1 · Read the runtime identity

Open the build information JSON in your browser, or run one of these commands.

Windows PowerShell

curl.exe --fail --silent --show-error --max-time 20 https://a-11-oy.com/api/build-info

macOS or Linux

curl --fail --silent --show-error --max-time 20 https://a-11-oy.com/api/build-info

Read service, build.revision and receipt_minted in the JSON. The service should identify a11oy; a known revision identifies the source reported by this deployment. receipt_minted: false is expected for this read.

A response establishes reachability and reports runtime identity. It does not establish capability readiness or authorize an action. If the request fails, returns HTML, or reports an unknown revision, retain that result as UNAVAILABLE or UNKNOWN and retry later; do not infer a successful integration.

2 · Check the capability you want to use

Capability evidence

Read the current claims, limitations and evidence labels.

Storage status

Inspect the storage state before relying on retained results.

Command Center

Explore the application and inspect each capability's status.

Keep UNKNOWN, UNAVAILABLE and BLOCKED results visible. An HTTP 200 alone does not establish signing, durable storage, evaluation quality or permission to execute.

3 · Try receipt verification

Open the receipt verifier to check a single DSSE envelope with a supplied public key. Offline verification runs in your browser; online verification sends the envelope or receipt ID to this product host only after you choose it.

For a complete example, follow the offline chain-verification guide with its committed SAMPLE bundle. That bundle is for the guide's Python command, not the browser's single-envelope input.

The sample uses an ephemeral demonstration key. Passing its checks establishes the sample's signature and chain relationships; trusted signer identity, payload truth and action authority require their own evidence. Obtain a real signer's key fingerprint independently.

Build an integration

Use the API reference and OpenAPI JSON to inspect an operation before calling it. Authenticated actions require that operation's credential type, scope and governance checks. Public-read access grants no write access.

Self-service key provisioning and the unified SDK package releases are UNKNOWN in this quickstart. The key interface description and SDK interface description are not provisioning or package-publication confirmation. Start with the HTTP read above; configure credentials only for a verified operation you intend to use.

Read the trust contract · Inspect the product source · Open the proof registry