# Signed results

`GET https://api-verify.secuveri.com/v1/verifications/{id}/result` with your API key, where `id` is the verification id or the session id, returns `{ "result": "<JWS>" }` once the verification has finished (409 before). A key reads only its own environment's results.

```shell
{
  "iss": "https://api.secuveri.com",
  "aud": "<your organization id>",
  "sub": "VRF-7KQ2M9XA",
  "iat": 1792746902,
  "jti": "1f0b6c1e-…",
  "verification": {
    "verification_id": "VRF-7KQ2M9XA",
    "session_id": "6f1c2e0a-8f43-4f7e-9a51-2b7c1d9e4a10",
    "workflow_id": "<workflow id>",
    "vendor_data": "customer-1042",
    "metadata": null,
    "status": "COMPLETE",
    "verdict": "APPROVED",
    "trust_level": "HIGH",
    "outcome_reason": null,
    "expected_details": null,
    "document": {
      "type": "PASSPORT",
      "country": "CHE",
      "chip_verified": true,
      "outcome": null
    },
    "checks": {
      "document": "PASS",
      "morph": "PASS",
      "liveness": "PASS",
      "face-match": "PASS",
      "deepfake": "PASS"
    },
    "completed_at": "2026-10-23T09:15:01.902Z"
  }
}
```

### Verify it

Pick the key whose `kid` matches the JWS header from `/.well-known/jwks.json`, require `alg` ES256, check the signature, and check that `aud` is your organization id. Cache the key set for a few minutes; when a `kid` is unknown, fetch it again (during a key change both keys are listed).

Node.js:

```js
import { createPublicKey, verify } from "node:crypto";

// jwks: await (await fetch("https://api-verify.secuveri.com/.well-known/jwks.json")).json(), cached for a few minutes.
export function verifySecuveriResult(jws, organizationId, jwks) {
  const [header64, payload64, signature64] = jws.split(".");
  const header = JSON.parse(Buffer.from(header64, "base64url").toString());
  if (header.alg !== "ES256") throw new Error("Unexpected algorithm");
  const jwk = jwks.keys.find((key) => key.kid === header.kid);
  if (!jwk) throw new Error("Unknown signing key; fetch the JWKS again");
  const valid = verify(
    "sha256",
    Buffer.from(`${header64}.${payload64}`),
    { key: createPublicKey({ key: jwk, format: "jwk" }), dsaEncoding: "ieee-p1363" },
    Buffer.from(signature64, "base64url")
  );
  if (!valid) throw new Error("Invalid signature");
  const payload = JSON.parse(Buffer.from(payload64, "base64url").toString());
  if (payload.aud !== organizationId) throw new Error("Result is for another organization");
  return payload;
}
```

Python:

```python
import base64
import json

from cryptography.exceptions import InvalidSignature
from cryptography.hazmat.primitives import hashes
from cryptography.hazmat.primitives.asymmetric import ec
from cryptography.hazmat.primitives.asymmetric.utils import encode_dss_signature


def _b64(data: str) -> bytes:
    return base64.urlsafe_b64decode(data + "=" * (-len(data) % 4))


def verify_secuveri_result(jws: str, organization_id: str, jwks: dict) -> dict:
    """jwks: the JSON from https://api-verify.secuveri.com/.well-known/jwks.json, cached for a few minutes."""
    header64, payload64, signature64 = jws.split(".")
    header = json.loads(_b64(header64))
    if header.get("alg") != "ES256":
        raise ValueError("Unexpected algorithm")
    jwk = next((key for key in jwks["keys"] if key["kid"] == header.get("kid")), None)
    if jwk is None:
        raise ValueError("Unknown signing key; fetch the JWKS again")
    public_key = ec.EllipticCurvePublicNumbers(
        int.from_bytes(_b64(jwk["x"]), "big"), int.from_bytes(_b64(jwk["y"]), "big"), ec.SECP256R1()
    ).public_key()
    raw = _b64(signature64)
    if len(raw) != 64:
        raise ValueError("Invalid signature")
    signature = encode_dss_signature(int.from_bytes(raw[:32], "big"), int.from_bytes(raw[32:], "big"))
    try:
        public_key.verify(signature, f"{header64}.{payload64}".encode(), ec.ECDSA(hashes.SHA256()))
    except InvalidSignature:
        raise ValueError("Invalid signature")
    payload = json.loads(_b64(payload64))
    if payload.get("aud") != organization_id:
        raise ValueError("Result is for another organization")
    return payload
```