VeytoReceipts
Every payment that clears the policy gate produces a receipt, signed with Ed25519 over a canonical serialization.
const { items } = await veyto.listReceipts({ limit: 25 });
const receipt = await veyto.getReceipt(id);The shape
{
receipt_id, intent_id, created_at,
signed: { body_canonical, signature }, // exactly what was signed
finality: { state, observed_at, evidence, signed: false, source },
}signed.body_canonical comes back byte-identical to what was signed — not reshaped,
not prettified, not merged with anything. That is what makes it checkable by someone who
does not trust the API that served it.
What the signed body binds
| field | what it is |
|---|---|
amount_minor, currency | what was authorized |
payee_canonical | who was to be paid |
settled_amount_minor, settled_payee | what actually settled |
settlement_mismatch | whether those two disagree |
rail, tx_hash | where, and which transaction |
policy_digest | a fingerprint of the exact rules in force at that instant |
policy_version | which version produced the decision |
caller_asserted_goods_digest | a hash of the bytes you say arrived (opt-in) |
sig.alg, sig.kid, sig.pub, canon_v | how to check it, years later, with nothing else |
policy_digest is the one nobody else can give you
It is a fingerprint of the rules that actually governed that payment, taken by the thing that made the decision, at the moment it made it. It proves the policy was not edited afterwards to make a payment look compliant. Only the decider can produce it, and only then.
caller_asserted_goods_digest is your claim, not ours
Enable it with attestGoods: true. Veyto records the digest you reported for the bytes
that arrived. It is non-repudiation, not proof that Veyto inspected the goods — the word
caller_asserted is in the field name for that reason.
Finality sits outside the signature
finality is what Veyto believes now about settlement — learned after the receipt was
issued. It travels beside the signed body and is marked signed: false.
It is outside for a reason: a signature is fixed at signing time and cannot learn things. Folding later knowledge into it would make every receipt fail to verify.
Three separate questions, deliberately not merged:
- the signed receipt — what Veyto attested, at signing time;
- finality — what Veyto believes now about settlement;
- delivery — whether the goods were any good, which Veyto does not judge.