API

Two endpoints, one rule: attach, never mutate. Base URL https://api.reverify.co.uk

C1 — Submit claims

POST /v1/claims
Authorization: Bearer rvf_live_…

{
  "claims": [{
    "claim_text": "Plugin requires PHP 7.4 or later",
    "claim_type": "version_requirement",
    "subject": { "kind": "php", "value": "7.4" },
    "confidence": { "positive": 0.91, "negative": 0.05, "undefined": 0.04, "method": "verbalised" },
    "decay_class": "versioned",
    "valid_as_of": "2026-07-29T12:00:00Z",
    "source_ref": { "system": "yourapp", "finding_id": "f_123" },
    "verification_hint": { "checker": "endoflife", "params": { "product": "php" } }
  }]
}

201 → { "results": [{ "claim_id": "clm_…", "verdict": "supported|contradicted|not-covered|pending" }] }

Batch up to 100 claims. Verdicts return inline within a 500ms budget, else pending (completed in background).
decay_class: volatile rechecks 6h, versioned 24h, stable once.
Submit safety-positive claims — we guard claims of safety; don't submit findings you already know are bad.
Idempotent: an identical claim (same text + subject) returns the existing claim_id with deduplicated: true and its latest verdict — history compounds, no duplicates.

Claim types & checkers

claim_type	checker	example
version_requirement	endoflife	“Requires PHP 7.4”
currency	endoflife	“WP 7.0 is current”
dependency_clean	osv	“Bundles lodash 4.17.21, no known CVEs”
plugin_version	wporg	“Plugin X is at version 9.8.5”
plugin_status	wporg	“Plugin X is listed/open on wp.org”
tested_up_to	wporg	“Tested up to WP 6.8”
library_semantics	context7	“auth() is synchronous”
judgment	adversarial	“PostgreSQL is better for this workload”

C2 — Receive challenges

POST {your webhook URL}
X-Reverify-Signature: sha256=<hmac_hex>   # HMAC-SHA256 over "{timestamp}.{raw_body}"
X-Reverify-Timestamp: <unix>              # reject >5min skew
X-Reverify-Delivery: <uuid>               # idempotency key

{
  "event": "claim.challenged",
  "claim_id": "clm_…",
  "challenge": {
    "type": "challenge",
    "content": "php 7.4 reached end-of-life on 2022-11-28 …",
    "confidence": { "positive": 0.99, "method": "verified" },
    "evidence": [{ "source": "endoflife.date/api/php.json", "quote": "…",
                   "source_tier": "primary", "retrieved_at": "…" }],
    "signature": { "algorithm": "ed25519", "public_key_id": "…", "signature": "…" }
  }
}

Retries 0s/5s/30s then parked — recover any time via GET /v1/challenges?since=…, plus automatic redelivery for 24h.
method: "verified" = deterministic ground truth; "verbalised" = adversarial review (contested, never “incorrect”).
Every challenge carries quoted evidence. Absence of evidence is never contradiction.

Other endpoints

GET  /v1/claims?since=&limit=  batch status sync (claims + latest verdict)
GET  /v1/claims/:id           claim + latest verification + challenges
POST /v1/claims/:id/recheck   force immediate re-verification
GET  /v1/transitions?since=   claims whose verdict changed between checks
GET  /v1/challenges?since=    missed-webhook recovery
GET  /v1/facts/wordpress/latest
GET  /v1/health

Rate limit: 60 req/min per key. Status: reverify.betteruptime.com