Datoka API

Verify API Receipt

verify_api_receipt

Read-onlyIdempotent

Free signature and declaration verification. To try before buying, read datoka-api://demo-receipt or /demo/receipt.json and pass the returned JSON here. No wallet needed for public verification. Verifies issuer, scope and event commitment; compare original response bytes locally with the SDK or /verify/.

Input Schema

TableJSON Schema

Name	Required	Description	Default
`event`	Yes	Commitment-only HTTP exchange declaration built locally with the SDK. No raw URLs, headers or bodies.
`receipt`	Yes	Unmodified signed receipt returned by issuance or the public synthetic demo; verify against trusted issuer keys.

Output Schema

TableJSON Schema

Name	Required	Description
`apiId`	Yes	Caller-chosen API identifier; not a certified provider identity.
`scope`	Yes
`valid`	Yes
`receiptId`	Yes
`exchangeId`	Yes	Stable identifier for one declared HTTP exchange.
`attestation`	Yes

Schema Changelog

Changes observed during successful MCP inspections.

Changed18 schema fields changedOct 7, 2026

addedInput schema / properties / event / description

Added value: +"Commitment-only HTTP exchange declaration built locally with the SDK. No raw URLs, headers or bodies."

addedInput schema / properties / event / properties / attestation / description

Added value: +"The caller declares the exchange; Datoka does not independently observe it."

addedInput schema / properties / event / properties / bodyEncoding / description

Added value: +"Hash application bytes after HTTP decoding, without JSON reserialization."

addedInput schema / properties / event / properties / completedAt / description

Added value: +"Declared UTC completion with milliseconds; must be at or after startedAt."

addedInput schema / properties / event / properties / headerEncoding / description

Added value: +"Use the SDK header selection and JCS canonicalization before hashing."

addedInput schema / properties / event / properties / method / description

Added value: +"Actual HTTP method of the locally captured exchange, for example GET."

changedInput schema / properties / event / properties / requestBodyHash / anyOf

Previous value: -[
-  {
-    "additionalProperties": false,
-    "properties": {
-      "algorithm": {
-        "const": "sha256",
-        "type": "string"
-      },
-      "digest": {
-        "pattern": "^[a-f0-9]{64}$",
-        "type": "string"
-      }
-    },
-    "required": [
-      "algorithm",
-      "digest"
-    ],
-    "type": "object"
-  },
-  {
-    "type": "null"
-  }
-]New value: +[
+  {
+    "additionalProperties": false,
+    "properties": {
+      "algorithm": {
+        "const": "sha256",
+        "description": "Digest algorithm; always sha256.",
+        "type": "string"
+      },
+      "digest": {
+        "description": "SHA-256 of exact locally captured bytes, encoded as 64 lowercase hexadecimal characters.",
+        "pattern": "^[a-f0-9]{64}$",
+        "type": "string"
+      }
+    },
+    "required": [
+      "algorithm",
+      "digest"
+    ],
+    "type": "object"
+  },
+  {
+    "type": "null"
+  }
+]

addedInput schema / properties / event / properties / requestHeadersHash / properties / algorithm / description
```
Added value: +"Digest algorithm; always sha256."
```
addedInput schema / properties / event / properties / requestHeadersHash / properties / digest / description
```
Added value: +"SHA-256 of exact locally captured bytes, encoded as 64 lowercase hexadecimal characters."
```

changedInput schema / properties / event / properties / responseBodyHash / anyOf

Previous value: -[
-  {
-    "additionalProperties": false,
-    "properties": {
-      "algorithm": {
-        "const": "sha256",
-        "type": "string"
-      },
-      "digest": {
-        "pattern": "^[a-f0-9]{64}$",
-        "type": "string"
-      }
-    },
-    "required": [
-      "algorithm",
-      "digest"
-    ],
-    "type": "object"
-  },
-  {
-    "type": "null"
-  }
-]New value: +[
+  {
+    "additionalProperties": false,
+    "properties": {
+      "algorithm": {
+        "const": "sha256",
+        "description": "Digest algorithm; always sha256.",
+        "type": "string"
+      },
+      "digest": {
+        "description": "SHA-256 of exact locally captured bytes, encoded as 64 lowercase hexadecimal characters.",
+        "pattern": "^[a-f0-9]{64}$",
+        "type": "string"
+      }
+    },
+    "required": [
+      "algorithm",
+      "digest"
+    ],
+    "type": "object"
+  },
+  {
+    "type": "null"
+  }
+]

addedInput schema / properties / event / properties / responseHeadersHash / properties / algorithm / description
```
Added value: +"Digest algorithm; always sha256."
```
addedInput schema / properties / event / properties / responseHeadersHash / properties / digest / description
```
Added value: +"SHA-256 of exact locally captured bytes, encoded as 64 lowercase hexadecimal characters."
```

addedInput schema / properties / event / properties / startedAt / description

Added value: +"Declared UTC start with milliseconds, for example 2026-10-07T08:00:00.000Z."

addedInput schema / properties / event / properties / status / description

Added value: +"Actual HTTP response status, including error responses; for example 200 or 404."

addedInput schema / properties / event / properties / targetHash / properties / algorithm / description
```
Added value: +"Digest algorithm; always sha256."
```

addedInput schema / properties / event / properties / targetHash / properties / digest / description

Added value: +"SHA-256 of exact locally captured bytes, encoded as 64 lowercase hexadecimal characters."

addedInput schema / properties / event / properties / version / description
```
Added value: +"Declaration format version; preserve this literal."
```

addedInput schema / properties / receipt / description

Added value: +"Unmodified signed receipt returned by issuance or the public synthetic demo; verify against trusted issuer keys."

Changed8 schema fields changedOct 4, 2026

changedInput schema / $schema

Previous value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema"

addedInput schema / properties / event / properties / apiId / description

Added value: +"Caller-chosen API identifier; not a certified provider identity."

addedInput schema / properties / event / properties / exchangeId / description
```
Added value: +"Stable identifier for one declared HTTP exchange."
```

addedInput schema / properties / event / properties / requestHeadersHash / description

Added value: +"SHA-256 of locally canonicalized selected request headers. Never send raw headers."

addedInput schema / properties / event / properties / responseHeadersHash / description
```
Added value: +"SHA-256 of locally canonicalized selected response headers."
```

changedOutput schema / $schema

Previous value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema"

addedOutput schema / properties / apiId / description

Added value: +"Caller-chosen API identifier; not a certified provider identity."

addedOutput schema / properties / exchangeId / description

Added value: +"Stable identifier for one declared HTTP exchange."

Changed3 schema fields changedOct 1, 2026

addedInput schema / properties / event / properties / requestBodyHash / description

Added value: +"SHA-256 of exact application request bytes; null means no body, not an empty body."

addedInput schema / properties / event / properties / responseBodyHash / description

Added value: +"SHA-256 of exact application response bytes after HTTP decoding. Preserve those bytes; do not reserialize JSON."

addedInput schema / properties / event / properties / targetHash / description

Added value: +"SHA-256 of the exact UTF-8 target URL, computed locally. Never invent a digest or send the URL itself."

First observedSep 29, 2026

TDQS

A3.9/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly, idempotent, non-destructive and closed-world, so the safety profile is covered. The description adds genuinely new behavior: verification is free, requires no wallet, consumes a locally built commitment-only declaration, and defers raw-byte comparison to the SDK or /verify/. It does not describe failure modes (what an invalid signature yields).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Four short sentences, each carrying a distinct fact (what it verifies, the demo path, the no-wallet condition, the byte-comparison alternative), with the purpose front-loaded. Slightly dense but no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return-value explanation is not required, and annotations cover the safety profile. The description supplies the pricing/auth context (free, no wallet) and the demo entry point. It omits how to obtain trusted issuer keys and how to interpret an invalid result.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and both parameters (event, receipt) are heavily documented in the schema with nested field semantics, so the baseline is 3. The description only implies the receipt input via 'pass the returned JSON here' and adds no field-level guidance beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('signature and declaration verification') and names what is checked (issuer, scope, event commitment), which separates it from issue_api_receipt and prepare_api_exchange. It does not explicitly name the siblings, but the verify-vs-issue-vs-prepare distinction is unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives a concrete entry condition ('to try before buying, read datoka-api://demo-receipt'), states no wallet is needed for public verification, and points to an alternative byte-comparison path (SDK or /verify/). It stops short of saying when this tool is not appropriate or that trusted issuer keys must come from get_api_public_keys.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All Datoka API tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources

Need Help?