Independently verify any TeleVerify compliance record

Every compliance determination is signed with an Ed25519 private key and published as a standalone, canonical-JSON packet. Auditors and counterparties can verify authenticity and detect tampering without ever connecting to TeleVerify’s infrastructure.

What this page is

When TeleVerify evaluates whether a provider is authorized to see a patient in a given state, the result is written to a compliance packet: a self-describing JSON document containing the engine version, provider snapshot, patient location, determination, data-source snapshot dates, and the signing key id. The packet is serialized via RFC 8785 (JSON Canonicalization Scheme), hashed with SHA-512, and signed with Ed25519. The signature and signer’s public key are both published.

Any third party — an insurer, a state board, a plaintiff’s expert witness, an internal compliance officer — can fetch a packet and its signature, fetch the relevant public key, and verify both artefacts in under a second with standard cryptography tooling. No TeleVerify account, API key, or network trust is required.

Endpoints you need

GET /api/compliance/keys

All Ed25519 public keys TeleVerify has ever used to sign packets, including revocation timestamps. Fetchable without authentication.

POST /api/compliance/verify-packet

Optional convenience endpoint: submit a packet + signature and we run the same verification logic server-side. Useful for sanity checks; not required for trust.

Verification examples

Each snippet below fetches a packet, fetches the signer’s public key, canonicalizes the packet with RFC 8785 (JCS), and verifies the Ed25519 signature. All examples use only standard libraries where possible.

Node.js (18+)

Uses the built-in crypto.verify and the small canonicalize package (MIT, zero deps) for JCS.

// npm install canonicalize const crypto = require('crypto'); const canonicalize = require('canonicalize'); async function verifyPacket(sessionId) { const base = 'https://app.televerify.org'; // 1. Fetch packet + signature envelope for a session. const env = await fetch(`${base}/api/compliance/packet/${sessionId}`) .then(r => r.json()); const packet = env.packet; const signature = Buffer.from(env.signature, 'base64url'); // 2. Fetch the public key used to sign this packet. const keys = await fetch(`${base}/api/compliance/keys`).then(r => r.json()); const keyRow = keys.keys.find(k => k.key_id === packet.signed_by.signing_key_id); if (!keyRow) throw new Error('Unknown signing key id'); const pubKey = crypto.createPublicKey(keyRow.public_key); // 3. Canonicalize with RFC 8785 (JCS), then verify. const canonical = Buffer.from(canonicalize(packet), 'utf8'); const ok = crypto.verify(null, canonical, pubKey, signature); console.log('signature valid:', ok, '| key:', keyRow.key_id, '| revoked_at:', keyRow.revoked_at); } verifyPacket('YOUR_SESSION_ID');

Python (3.8+)

Uses requests and cryptography. JCS is small enough to inline — the snippet below implements just the subset we need (sorted keys, no whitespace). For production auditing, prefer pypi.org/project/jcs.

# pip install requests cryptography import json, base64, requests from cryptography.hazmat.primitives.serialization import load_pem_public_key BASE = 'https://app.televerify.org' def canonicalize(obj): """Minimal RFC 8785 JCS: sort object keys, tight separators, UTF-8.""" return json.dumps(obj, sort_keys=True, separators=(',', ':'), ensure_ascii=False).encode('utf-8') def b64url_decode(s): s = s + '=' * (-len(s) % 4) return base64.urlsafe_b64decode(s) def verify_packet(session_id): env = requests.get(f'{BASE}/api/compliance/packet/{session_id}').json() packet, sig_b64 = env['packet'], env['signature'] keys = requests.get(f'{BASE}/api/compliance/keys').json()['keys'] key_row = next(k for k in keys if k['key_id'] == packet['signed_by']['signing_key_id']) pub = load_pem_public_key(key_row['public_key'].encode()) # Ed25519 .verify raises on mismatch, returns None on success. try: pub.verify(b64url_decode(sig_b64), canonicalize(packet)) print(f"valid - key {key_row['key_id']}, revoked_at {key_row['revoked_at']}") except Exception as e: print('INVALID:', e) verify_packet('YOUR_SESSION_ID')

curl + openssl (shell)

Two-step: use jq (or python -c) for JCS canonicalization, then openssl pkeyutl -verify for the Ed25519 check. OpenSSL 3.0+ required.

# Fetch envelope; split into packet + signature files. SESSION=YOUR_SESSION_ID curl -s https://app.televerify.org/api/compliance/packet/$SESSION \ | tee /tmp/env.json >/dev/null python3 -c 'import json,sys; e=json.load(open("/tmp/env.json")); \ sys.stdout.write(json.dumps(e["packet"], sort_keys=True, separators=(",",":")))' \ > /tmp/packet.canonical.json python3 -c 'import json,base64,sys; e=json.load(open("/tmp/env.json")); \ sys.stdout.buffer.write(base64.urlsafe_b64decode(e["signature"] + "=" * (-len(e["signature"]) % 4)))' \ > /tmp/packet.sig # Fetch the signing public key (matching the packet's signed_by.signing_key_id). KEYID=$(python3 -c 'import json; print(json.load(open("/tmp/env.json"))["packet"]["signed_by"]["signing_key_id"])') curl -s https://app.televerify.org/api/compliance/keys \ | python3 -c "import json,sys; [print(k['public_key']) for k in json.load(sys.stdin)['keys'] if k['key_id']=='$KEYID']" \ > /tmp/pub.pem # Verify. openssl pkeyutl -verify -pubin -inkey /tmp/pub.pem \ -rawin -in /tmp/packet.canonical.json -sigfile /tmp/packet.sig
Canonicalization matters. Ed25519 signs raw bytes. TeleVerify signs the RFC 8785 JCS serialization of the packet — any re-serialization that changes whitespace, key order, or escape sequences will break verification. When in doubt, use a named JCS library rather than rolling your own.

Verify in your browser

Paste a packet JSON and the base64url signature below. The page will fetch our public keys and run the Ed25519 verification locally via the Web Crypto API — nothing is sent back to us.

Browser support: Ed25519 in the Web Crypto API requires Chrome 113+, Firefox 119+, or Safari 17+. If verification fails with NotSupportedError, use one of the Node.js / Python / curl examples above instead.