Resources
Technical documentation
The same API that powers the public verification portal and the QR-signed PDF report — open by design, so your own system can consume it too.
The verification API
Public and unauthenticated, by default
Every session and every case carry their own token (a 122-bit GUID, not guessable) that acts as the access control — no JWT or account on any panel needed. By default that token is enough on its own; if the case has been marked private, it also requires a second factor (today, a TOTP authenticator-app code, from a contact identified by phone or email) before returning anything — see the .../private-access endpoints below. Built so a court, an insurer or a law firm can verify evidence from their own case-management system, not just a browser.
/api/v1/verify/{token}Detail of an acquisition session: organization, case, examiner, dates, and the list of artifacts with their hash and RFC 3161 timestamp.
/api/v1/verify/{token}/artifacts/{artifactId}Direct download of an artifact from that session — including the session video, identified as just another artifact.
/api/v1/verify-case/{token}Detail of a full case: every one of its sessions, each with its artifacts — no need to query session by session.
/api/v1/verify/{token}/locationThe session's originating IP and host, an approximate geolocation, and the device-declared GPS if there is one.
/api/v1/verify/{token}/map.pngA map (PNG image) of the session's origin, ready to embed in your own system without processing coordinates.
/api/v1/verify/{token}/private-accessOnly if the case is marked private: second factor (a TOTP app code from a contact identified by phone or email) from a session token. Returns a 30-minute access token for the calls that follow.
/api/v1/verify-case/{token}/private-accessThe same second factor, from a full case's token.
Replace /api/v1/... with the base URL of your own Forensica.API deployment — there's no single public domain, each organization hosts its own instance.
For a private case, the read endpoints return 403 until the token obtained from .../private-access is attached as an?access=... parameter on every following call.
What the response actually guarantees
Every piece of data from the API is checkable, not a promise
Each artifact's SHA-256 hash was recomputed and confirmed server-side on receipt. The RFC 3161 timestamp can be validated against the issuing authority — there are actually two, one from the client and one independent one from the server. Artifacts in the same session are chained by hash, so inserting or reordering one afterwards wouldn't go unnoticed. And the file itself has been in read-only storage since the moment it was accepted.
Full detail of the mechanism on Security & compliance.
Integrating this into your own system?
We'll help you connect your platform to the verification API
Tell us which system you want to integrate and we'll show you the shortest path.