Integrate verification.

Auth

Mint a key in the vendor console (90-day expiry, revocable any time). Send it as Authorization: Bearer cpk_…. Unknown, revoked, and expired keys read as an identical 401 — key validity is never an oracle. Scopes are least privilege: verify submits and reads (pick this unless you review audits), read retrieves only, full additionally confirms or dismisses audit findings.

Quotas

• Per-key hourly cap (abuse friction): 429 past it, same bucket shape as every other client.
• Per-key monthly quota (vendor keys only): submits past the limit read 429 with a monthly vendor quota reached detail and the window reopening on the 1st (UTC). Account keys are unbounded and mirror browser credit economics instead.
• Metering counts submits, not polls: status and record reads never spend quota. Reused byte-identical submits reuse the earlier job and spend nothing. Watch your use live at GET /api/v1/usage.

Endpoints

POST /api/v1/verify	Submit a brief (text) or pre-extracted strings (citations[], never both). Returns 202 with a job_id and record_url.
POST /api/v1/verify/batch	Up to 10 documents; each spends exactly as a single submit. Malformed entries become per-item errors, never a failed batch.
POST /api/v1/verify/batch-zip	One .zip of native files (up to 10 entries), same economics as batch JSON.
POST /api/v2/audits	Audits the other side's brief with exhibit texts; same spend contract. Review findings and gates ride GET /api/v2/audits/{id}.
POST /api/v1/compare	Two briefs side by side; atomic (a failed side cancels the other, no lone spend).
GET /api/v1/records/{id}	Poll the structured record; 202 while running.
GET /api/v1/usage	This key's current UTC month use against quota. Read-only; polling it never spends.

Upstream failure degrades, never invents: unresolvable citations read couldn't check with a reason, never clean. Canadian cites verify against CanLII when enabled — same quota, same spend, same record shape. A 402 means paid access lapsed — credits or subscription, same as the web product.

Completion webhooks

Register one HTTPS endpoint per account in settings → webhooks (test-fire included). On every paid completion we POST a metadata-only payload — job id, document name, finding counts, bucket tallies, record URL, brief hash. The full record stays behind key-authenticated fetch, so a logging receiver never warehouses findings.

• Event: record.completed. Idempotent per job: retried completions re-affirm, never double-deliver.
• Signature: X-CiteProof-Signature: t=<unix>;h1=<hex> where hex is HMAC-SHA256(secret, timestamp + ":" + body) in constant-time compare. Reject anything else before parsing.
• Retries: backoff 60s doubling to hourly, 10 attempts, then dead loudly. 410 Gone stops delivery immediately — use it when decommissioning.

Reference SDKs

Single-file clients with zero dependencies — copy one into your product, no package to install. Inject a fake transport to test without quota or network (both suites do exactly that).

• Python (stdlib only): submit, cites-only submit, poll-to-complete with backoff, audits and reviews, usage, webhook verification.
• TypeScript (zero dependencies, Node 18+): the same surface with an injectable fetch.

Start cites-only: verify the plumbing against the sandbox fixtures before spending quota on live briefs. Joint evals run the same corpus machine-readably at /vendors/sandbox.json.

Display rules

These are contractual, not stylistic. Vendor surfaces must say checked by CiteProof on [date] with the snapshot date beside it — never "verified by CiteProof," never a bare checkmark, never diligence-proof language. Good law, proposition support, and interpretation stay outside the product; link the methodology instead of restating it. Misuse can suspend the key.

Open the vendor console Full API reference

CiteProof verifies citation existence and quote accuracy against public court records. It is not legal advice and does not replace attorney review. Terms · Privacy · Contact