# No auth. 10 scans/day free. Max 50MB.
curl -X POST https://certify.sbix.io/api/v1/scan-public \
-F "file=@image.jpg"
# 200 response
{
"success": true,
"data": {
"alert": "SIMILAR", // ORIGINAL | SIMILAR | MODIFIED_COPY | EXACT_COPY | CERTIFIED
"matches_found": 3,
"trust_index": 62, // 0=confirmed copy, 100=certified original
"db_size": 6463807, // fingerprints in index at scan time
"matches": [
{
"proof_id": "teia_871500",
"platform": "teia",
"similarity_percent": 97.4,
"first_indexed_at": "2021-06-14T08:22:00Z",
"source_url": "https://ipfs.io/ipfs/QmS9fXRz...", // direct image URL, never HTML
"verify_url": null // only set for proof_ entries
}
]
}
}
# Bearer auth. 0.08 EUR/call. Merkle batch up to 10,000 leaves.
curl -X POST https://certify.sbix.io/api/certify \
-H "Authorization: Bearer YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{
"leaves": ["e3b0c44298fc1c149afbf4c8996fb924..."],
"leaves_hashed": true,
"filename": "artwork_v2.jpg",
"case_reference": "CASE-2026-001"
}'
# 201 response
{
"proof_id": "proof_9cec4ed9a95e4ed8",
"merkle_root": "6e8f29ea620642d3c4e998c5...",
"timestamp": "2026-04-15T09:26:09+00:00",
"tsa_type": "eIDAS Qualified",
"eidas_qualified": true,
"tsr_bytes": 1307 // RFC-3161 TSR from AlfaSign QTSA
}
# No auth. Permanent. Works without SBIX account or uptime.
curl https://certify.sbix.io/api/v1/verify/proof_9cec4ed9a95e4ed8
# 200 response
{
"success": true,
"data": {
"verified": true,
"proof_id": "proof_9cec4ed9a95e4ed8",
"hash": "sha256:e3b0c44298fc1c149afb...",
"timestamp": "2026-04-15T09:26:09+00:00",
"tsa_type": "eIDAS Qualified",
"blockchain": "tezos",
"verify_url": "https://verify.sbix.io/verify/proof_9cec4..."
}
}
# Also works by SHA-256 hash directly
curl https://certify.sbix.io/api/v1/verify/hash/{sha256_hex}
# Pro only. Full pipeline: pHash + 8 flip variants + ORB/RANSAC + DINOv2.
curl -X POST https://certify.sbix.io/api/v1/check \
-H "Authorization: Bearer YOUR_KEY" \
-F "file=@image.jpg"
# 200 response
{
"success": true,
"data": {
"alert": "EXACT", // EXACT | COPY | SIMILAR | CLEAN | CERTIFIED
"decision": "BLOCK", // Matrice v4.3 output
"trust_index": 8.4, // TI = 0.35T + 0.25F + 0.25N
"is_original": false,
"decision_reason": "A1 proof_phash0_bypass", // audit trail
"best_match": {
"proof_id": "proof_7b0fecc7657b0f55",
"platform": "certify",
"match_type": "EXACT",
"distance": 0,
"similarity_percent": 100.0,
"verify_url": "https://verify.sbix.io/verify/proof_7b0f..."
}
}
}
# Partner only. scope=certify_lite + is_partner=true required.
# Pipeline: file_hash -> AlfaSign QTSA -> proof JSON -> PDF lite -> DB
curl -X POST https://certify.sbix.io/api/v1/certify-lite \
-H "Authorization: Bearer PARTNER_KEY" \
-H "Content-Type: application/json" \
-d '{
"file_hash": "9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08",
"filename": "contract_2026.pdf",
"case_reference": "REF-2026-001"
}'
# 201 response
{
"proof_id": "proof_7b0fecc7657b0f55",
"timestamp": "2026-04-15T09:26:09+00:00",
"tsr_bytes": 1307,
"tsa_type": "eIDAS Qualified",
"certificate_url": "https://certify.sbix.io/api/v1/certificates/proof_7b0f.../evidence-pack",
"verify_url": "https://verify.sbix.io/verify/proof_7b0fecc7657b0f55"
}
Five endpoints. One decision surface.
All responses follow the same envelope. Auth via Bearer token header. Base: certify.sbix.io
FREE
POST /api/v1/scan-public
No auth. 10/day free, unlimited Pro. Upload image, get alert (ORIGINAL / SIMILAR / EXACT_COPY / CERTIFIED), matches array, trust_index, db_size. Max 50MB. Latency ~200ms server-side.
AUTH
POST /api/certify
0.08 EUR/call. Merkle batch up to 10,000 leaves. Returns proof_id, merkle_root, eIDAS Qualified RFC-3161 TSR from AlfaSign QTSA, Tezos anchor. File never stored, hash only.
OPEN
GET /api/v1/verify/{proof_id}
No auth, permanent. Verify by proof_id or SHA-256 hash. Returns certificate data, timestamp, blockchain anchor. Works independently of SBIX uptime once TSR is issued.
AUTH
POST /api/v1/check
Pro only. Full pipeline: pHash + 8 flip/rotation variants + ORB/RANSAC geometric verifier + DINOv2 semantic embeddings. Returns Matrice v4.3 decision (BLOCK/REVIEW/SAFE), trust_index, decision_reason audit trail.
PARTNER
POST /api/v1/certify-lite
scope=certify_lite + is_partner required. Send SHA-256 hash only, no file upload. AlfaSign QTSA timestamp, proof JSON, PDF lite, DB record. RGPD: zero personal data stored. Active: instamp.app.