Verifying a document
What this page is — the public check that a document really was issued by your organisation, and has not been altered since.
What it is for — so anyone holding a copy can confirm it is genuine and current without contacting you.
The problem it solves — a PDF is easily edited, and without a check a forged certificate or offer letter looks exactly like a real one.
Route: /verify/<code> · Permission: none — the page is public, and the code is the credential
1. What it is
Every time a document is sealed, the PDF is recorded as an artifact. The artifact gets a short verification code and a QR code printed on the page. Anyone who scans or types that code lands here. The page answers two questions: was a document with this code issued? and is it still the one in force?
| Verification | A share link | The public library | |
|---|---|---|---|
| Shows the document's contents | No | Yes | Yes |
| Who can use it | Anyone holding the code | Whoever you sent the link to | Anyone |
| Can you switch it off | No — revoking changes the answer, not the access | Yes, revoke the link | Yes, unpublish |
| What it proves | Issuance, current status, integrity | Nothing — it is delivery | Nothing — it is publication |
Two kinds of artifact carry a code. The finalized PDF gets one when the document is sealed. When a signing request completes, a signed PDF with a folded-in completion certificate is produced, and it carries its own code.
2. Why you would use it
- Forgery stops being cheap. A PDF can be edited in minutes. Without a check, a forged offer letter looks exactly like a real one. With one, the forgery either fails the lookup or fails the fingerprint.
- Your team stops answering "is this genuine?" emails. The recipient checks for themselves at any hour, and nobody in your organisation has to look anything up.
- Out-of-date copies announce themselves. A copy that has been amended or superseded says so when it is checked. Without this, a counterparty keeps relying on a version you replaced months ago.
- It is safe to print on anything. The page shows issuance facts, never contents. A code on a certificate handed to strangers leaks nothing about the parties, values or clauses.
3. How a check works
- The code is trimmed and upper-cased, so
ab12cdandAB12CDare the same code. Anything longer than 32 characters is treated as unknown without a lookup. - An unknown code gets the same answer every time —
{"valid": false}— and it arrives after a deliberate delay. The page never hints whether a code is nearly right, so nobody can guess their way to a real one. - A known code gets the issuance facts plus a status that is computed at the moment of the check, not stored when the document was sealed. If you revoke a document tomorrow, a check made the day after says revoked.
4. Field reference
| Field on the page | Where the value comes from |
|---|---|
| Authentic document banner | Shown when the code matches an artifact |
| Document number | The number allocated at finalize. Blank on types with no numbering sequence |
| Title, type and family | The document and its type |
| Issued by | The organisation's name |
| Issued on | When the artifact was created, not when the document was drafted |
| Pages | Page count of that artifact |
| Content fingerprint (SHA-256) | The hash of the sealed PDF bytes |
| Signed flag | Whether a signed artifact exists for the same version |
| Later documents | Counts of sealed amendments, renewals or extensions of this document |
| Status chip | One of the four statuses below |
The four statuses
| Status | Colour | Set when | What the page tells the holder |
|---|---|---|---|
| active | Green | None of the other rules apply | Nothing more — the copy is current |
| amended | Amber | A sealed amendment, renewal or extension exists | Still in force, but no longer the complete agreement |
| superseded | Amber | The document was superseded, or the scanned copy seals an older version than the one marked effective | "This document has been superseded by a newer version. Contact the issuer for the current one." |
| revoked | Red | The document was revoked | "This document has been revoked by the issuer and should no longer be relied upon." |
An amendment modifies the original, it does not void it. Showing superseded would tell a counterparty their contract is dead, which is legally false. Showing active would hide that a newer document exists. Only a sealed successor counts, so a draft amendment is never announced on this public page.
5. Using the fingerprint
The metadata only proves that a document with this number was issued. The fingerprint proves that the copy in your hand is that document. To compare, open the PDF's properties or run any SHA-256 tool on the file, and compare the result character by character with the page.
| If they | Then |
|---|---|
| Match | The file is byte-for-byte the sealed original |
| Differ | The file has been changed. Even re-saving it in another viewer changes the hash, so ask the issuer for the original before concluding it is forged |
6. Worked example
Priya applies for a flat and hands the letting agent an employment letter, number HR-EMP-2026-0142, with a QR code in the footer.
- The agent scans the QR code and lands on
/verify/7KQ2M9XA. - The page shows Authentic document, issued by Gatiro Technologies on 3 March 2026. It is an Employment confirmation letter with 2 pages and status active.
- The agent runs
sha256sum letter.pdfon the emailed file. The result starts9f41c0…, the same as the page, so the copy is genuine and unaltered. - In June, HR issues a corrected letter and supersedes the old one. When the agent re-checks the original code, the chip is now amber — superseded — with the instruction to contact the issuer.
Had Priya edited the salary figure, step 2 would still say authentic, because the code is real. Step 3 would fail, and that is the check that matters.
7. The admin contract
| What must be true | Otherwise |
|---|---|
| The document is finalized | There is no artifact, so there is no code to print or check |
| The type's template places the QR/code block | The code exists, but nobody holding the paper can find it |
| A numbering sequence is set on the type | The page shows no document number |
| Revocation is done with a reason | Revoking refuses without one: "reason is required to revoke a document" |
| The document is not under legal hold | Revoke and supersede both refuse: "document is under legal hold and cannot be revoked" |
8. Downstream
- Revoking a document flips every check to red, and it also kills every share link to it.
- Superseding flips checks to amber, but existing share links keep working.
- Making a different version effective marks copies of the older version as superseded, even when the document itself was never superseded.
- Completing a signature adds a second code — the signed PDF's. Both codes keep resolving.
9. Don't confuse this with…
| Share links | Show the document to someone you chose. Verification shows nobody the document |
| Sending for signature | Proves who agreed. Verification proves what was issued and that it is unchanged |
| Public library | Documents you chose to publish. Verification works for every sealed document |
10. Troubleshooting
| Symptom | Cause |
|---|---|
| No matching document | The code was mistyped (O and 0 are easy to swap), or it came from a draft preview that was never sealed |
| The response is slow for a wrong code | Deliberate — unknown codes are delayed so they cannot be guessed quickly |
| Authentic, but the fingerprint differs | The file was altered or re-saved. Ask the issuer for the original PDF |
| superseded on a document nobody superseded | A newer version was made effective, and this copy seals the older one |
| amended on a signed contract | A sealed amendment or renewal exists. The original still stands, but read both |
| No document number | The type has no numbering sequence |