This isn't a format of ours: it's SHA-256, canonical JSON and OpenTimestamps on Bitcoin. Three public things anyone can reproduce. We publish how we combine them so nobody has to trust us, and so anyone who wants to can do the same.
The document is serialised as canonical JSON —sorted keys, no whitespace, UTF-8— and its SHA-256 is computed. Change a comma and the fingerprint changes.
canonical = json.dumps(payload, sort_keys=True, ensure_ascii=False, separators=(",", ":"))
fingerprint = sha256(canonical.encode("utf-8")).hexdigest()If you upload a PDF, the SHA-256 of the raw bytes is also recorded. That way the file on your disk can be checked directly, without rebuilding anything.
file_fingerprint = sha256(raw_bytes).hexdigest()
The fingerprint is submitted to OpenTimestamps' public calendars, which aggregate it in a Merkle tree and commit it to a Bitcoin block. The resulting proof (.ots) holds the path from your fingerprint to that block's root. It depends on no server, ours included.
Download the proof, install the official client and run:
pip install opentimestamps-client curl -o proof.ots https://www.aim-codex.ai/v/<FINGERPRINT>/proof.ots ots verify proof.ots
Anyone can ask for a fingerprint's status without an account. The response is JSON with these fields:
GET https://www.aim-codex.ai/api/v1/verify/<FINGERPRINT>
| authentic | true if the fingerprint is sealed and not revoked |
| status | sealed · revoked · draft |
| sealed_at | seal date and time, UTC |
| valid_until | expiry declared by the issuer, or null |
| is_latest | whether it is the document's latest version |
| revoked / revoke_reason | revocation and its reason, if any |
| credential | credential data, if it is one |
A credential issued with CODEX can be read as a Verifiable Credential, with the proof pointing to the anchor rather than to a signature of ours.
GET https://www.aim-codex.ai/v/<FINGERPRINT>/w3c.json