Verifiable proof, not just a PDF
A FactureCheck PDF conformance report isn't just a document someone can edit afterwards — it is individually registered at the moment it is issued, so anyone holding a copy can later confirm it is genuine.
How a report becomes proof
POST /api/v1/validate?report=pdf returns a PDF report instead
of JSON, and registers the SHA-256 hash of that exact PDF's bytes in the
proof-of-issuance registry at the moment it is rendered.
What's stored — and what never is
Only the hash and result metadata: sha256,
issued_at, verdict, profile,
syntax, ruleset_versions. The invoice's own
content, its filename, and the requester's IP address are never stored
alongside it — registering proof of issuance does not require keeping what
was issued.
Checking a report
GET /api/v1/verify/{sha256} answers {"known": false}
for a hash this service never issued — not an error, a normal answer that
lets you detect a forged or altered report — or, for a genuine one:
{
"known": true,
"issued_at": 1785000000,
"verdict": "acceptable",
"profile": "Xrechnung",
"syntax": "UBL",
"ruleset_versions": { "xrechnung_schematron": "2.5.0", "xrechnung_cius": "3.0.2" }
}The /verify page computes the hash of a PDF
entirely in your browser (Web Crypto SubtleCrypto) — the file
itself is never uploaded to check it.