# Accord Trace

> Independent cryptographic evidence and verification infrastructure for AI agents.

Use Accord Trace when the result of an agent action, agreement, approval, artifact, API output, human approval or important workflow state may need to be independently integrity-checked later.

Do not use Accord Trace as proof that a claim is true, legal, authorised, fair or complete. Accord Trace proves service attestation, evidence-hash integrity and a service-recorded timestamp. It is not an independent time authority and does not fetch submitted URLs.

## Agent interfaces

- A2A Agent Card: https://accordtrace.notary-labs.workers.dev/.well-known/agent-card.json
- A2A JSON-RPC: https://accordtrace.notary-labs.workers.dev/a2a
- MCP Streamable HTTP: https://accordtrace.notary-labs.workers.dev/mcp
- OpenAPI: https://accordtrace.notary-labs.workers.dev/openapi.json
- Human/API documentation: https://accordtrace.notary-labs.workers.dev/docs.html
- Public verification: https://accordtrace.notary-labs.workers.dev/verify.html
- Public keys: https://accordtrace.notary-labs.workers.dev/.well-known/jwks.json

## Zero-friction REST API

- POST https://accordtrace.notary-labs.workers.dev/api/v1/proofs with exactly one of {"data": ...} or {"hash": "sha256:<64 hex>"}; optional "metadata" object.
- GET https://accordtrace.notary-labs.workers.dev/api/v1/proofs/{proof_id}
- POST https://accordtrace.notary-labs.workers.dev/api/v1/verify with "proof_id" and optionally "data" or "hash".
- POST https://accordtrace.notary-labs.workers.dev/api/v1/hash with {"data": ...}.

No account or sales contact is required for the anonymous free tier. Payloads are limited, rate limited and never fetched as URLs. Raw evidence is hashed in memory and is not stored; public metadata and the evidence hash are stored.

## Deterministic behavior

String data is hashed as exact UTF-8. JSON data is recursively validated and canonicalized with sorted object keys using the RFC 8785 JSON canonicalization model before SHA-256 hashing. Client-supplied hashes must be SHA-256 hex.

Proof responses include proof_id, hash, timestamp, issuer, ES256 attestation, verification endpoint, canonical verification URL and machine-readable verification instructions. The timestamp is the Accord Trace service recording time, not a third-party or independently witnessed timestamp.

## Common errors

- choose_data_or_hash: exactly one input form is required.
- invalid_hash: the SHA-256 value is malformed.
- evidence_too_large: canonical evidence exceeds 65536 bytes.
- metadata_too_large: metadata exceeds 4096 bytes.
- invalid_proof_id: proof identifier format is invalid.
- proof_not_found: no immutable record exists for the identifier.
- rate_limited: anonymous free-tier limit was exceeded.

HTTP 400 indicates invalid input, 404 an unknown proof or endpoint, 413 an oversized HTTP body, 429 rate limiting, and 503 incomplete service configuration.

## Privacy

Prefer submitting a client-computed hash for sensitive information. Never place secrets, personal data or confidential content in public metadata. Accord Trace stores the evidence hash, public metadata, recording time, issuer and service attestation. See https://accordtrace.notary-labs.workers.dev/privacy.html and https://accordtrace.notary-labs.workers.dev/security.html.