Return the Merkle inclusion proof for one participant in your platform's tree for an asset: the leaf preimage, the sibling path, and the signed root the path resolves to.
This is a POST because the participant code is enumerable and sensitive; keeping it in the body keeps it out of URLs, proxy access logs, and browser history. The response is per-participant and is not cacheable.
The tree is always your own — the platform comes from your authenticated identity. Only participant_code is read from the body. Send nothing else: a stray field is normally rejected with 400, and where request validation runs at the edge instead it is ignored — but a platform identifier that is not your own is denied with 403 rather than honoured.
To verify: recompute the leaf hash from leaf, walk proof_path applying each sibling on the side given by direction and adding sums with checked u128 arithmetic, then require the resulting hash and sum to equal the values inside the verified commitment_cbor of root. Bind the check to the expected platform, asset, and spec_version — a mathematically valid root for the wrong tree still fails the assertion you care about.
This document describes the wire contract, not the hash construction. The exact preimage bytes — hash function, domain separation, field encoding and ordering, the participant-slot derivation, sentinel padding, the internal-node preimage, and the full set of signed CBOR entries — are defined in the versioned Proof of Reserves verification spec issued with the reference verifier at onboarding. You need that document to implement a verifier; this one is not sufficient on its own. If the two ever disagree, treat it as a defect on our side and raise it — do not pick one and proceed.
Note that a Merkle Sum Tree proof conceals which participants the siblings represent, but not their aggregated balances: each sibling's subtree sum is disclosed.
No rate limit is applied on these routes by this API. Edge limits may still apply, so handle 429 and honour Retry-After rather than assuming an unlimited budget.
| Time | Status | User Agent | |
|---|---|---|---|
Retrieving recent requests… | |||