← Back
Open standard · v1

How the seal works, so you can check it or implement it

This isn't a format of ours: it's SHA-256, canonical JSON and OpenTimestamps on Bitcoin. Three public things anyone can reproduce. We publish how we combine them so nobody has to trust us, and so anyone who wants to can do the same.

1. The content fingerprint

The document is serialised as canonical JSON —sorted keys, no whitespace, UTF-8— and its SHA-256 is computed. Change a comma and the fingerprint changes.

canonical = json.dumps(payload, sort_keys=True, ensure_ascii=False, separators=(",", ":"))
fingerprint = sha256(canonical.encode("utf-8")).hexdigest()

2. The original file's fingerprint

If you upload a PDF, the SHA-256 of the raw bytes is also recorded. That way the file on your disk can be checked directly, without rebuilding anything.

file_fingerprint = sha256(raw_bytes).hexdigest()

3. The Bitcoin anchor

The fingerprint is submitted to OpenTimestamps' public calendars, which aggregate it in a Merkle tree and commit it to a Bitcoin block. The resulting proof (.ots) holds the path from your fingerprint to that block's root. It depends on no server, ours included.

4. Checking without us

Download the proof, install the official client and run:

pip install opentimestamps-client
curl -o proof.ots https://www.aim-codex.ai/v/<FINGERPRINT>/proof.ots
ots verify proof.ots

5. The public verification response

Anyone can ask for a fingerprint's status without an account. The response is JSON with these fields:

GET https://www.aim-codex.ai/api/v1/verify/<FINGERPRINT>
authentictrue if the fingerprint is sealed and not revoked
statussealed · revoked · draft
sealed_atseal date and time, UTC
valid_untilexpiry declared by the issuer, or null
is_latestwhether it is the document's latest version
revoked / revoke_reasonrevocation and its reason, if any
credentialcredential data, if it is one

6. Credentials, in the W3C standard

A credential issued with CODEX can be read as a Verifiable Credential, with the proof pointing to the anchor rather than to a signature of ours.

GET https://www.aim-codex.ai/v/<FINGERPRINT>/w3c.json
This specification is public. You may implement, extend or audit it without asking. The only thing you can't do is call it CODEX.
BIOMAG S.L.U. · NIF B-01037241 · Vitoria-Gasteiz