Create durable evidence with one request.

Elucora captures a public source, selects exact evidence, returns a portable signed receipt, and publishes its payload hash to a public chain.

Authentication

Send your API key with Authorization: Bearer elu_live_…. Keys are displayed once, stored as SHA-256 hashes, and can be revoked immediately from the dashboard. Do not expose a live key in browser code or a public repository.

Create a receipt

curl -X POST https://www.elucora.com/v1/receipts \
  -H "Authorization: Bearer $ELUCORA_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: signal-btc-2026-08-13T14:31Z" \
  -d '{
    "url": "https://api.example.com/market.json",
    "selector": {
      "type": "json-pointer",
      "value": "/bitcoin/price"
    },
    "metadata": { "symbol": "BTC", "pipeline": "daily-signal" }
  }'

Request body

Selectors

Use json-pointer for stable machine-readable APIs. Use text-quote to bind a receipt to exact text found in UTF-8 HTML or plain text. Optional prefix and suffix follow the W3C TextQuoteSelector model and disambiguate repeated text.

{
  "type": "text-quote",
  "exact": "Revenue increased 18% year over year.",
  "prefix": "For the quarter, ",
  "suffix": " Gross margin also improved."
}

Retrieve a receipt

Returns the signed receipt plus a current signature_valid result. Retrieval is public so a receipt can travel with a report, AI answer, or dataset.

Download the captured artifact

Returns the original captured bytes to the owning account. Authenticate with the same account's API key. Compare the X-Elucora-Artifact-Hash header with artifact_hash before using the bytes.

Verify a signature

{ "id": "rcpt_4af921be38e1412396cc3887fa558119" }

You may also submit a complete payload and signature. Fetch the current key from GET /v1/public-key or all retained keys from /.well-known/jwks.json.

Inspect the transparency proof

Returns the payload hash, preceding entry hash, entry hash, sequence, and RFC 3161 timestamp token when a timestamp authority is configured. Use GET /v1/transparency for the current head and recent entries, and GET /v1/transparency/checkpoint for a signed statement of the head that you can archive yourself; a later log that contradicts a checkpoint you already hold is detectable without trusting us. A not_configured timestamp status is explicit: the hash chain exists, but the clock is still controlled by Elucora.

When OpenTimestamps calendars are configured, each entry digest is submitted for Bitcoin anchoring and GET /v1/transparency/{id}/ots returns the detached proof file for ots verify. The proof carries a calendar attestation first and a block attestation after confirmation, which the opentimestamps.status field reports as pending then complete. The entry_digest field is the bare SHA-256 of the entry if you would rather notarize it yourself. The chain entry is appended outside the capture request, so a create response can return transparency.status of pending with a null entry_hash. Independent timestamps are collected the same way. Poll GET /v1/transparency/{id} when you need the recorded entry or token; the receipt signature itself is complete and verifiable immediately.

Connect an AI agent with MCP

The stateless Streamable HTTP endpoint implements MCP protocol 2025-11-25 with elucora_capture, elucora_get_receipt, and elucora_verify. Send the same API key as a Bearer token. Hosts should keep a human approval step before elucora_capture because it contacts an external URL and consumes quota.

{
  "mcpServers": {
    "elucora": {
      "url": "https://www.elucora.com/mcp",
      "headers": { "Authorization": "Bearer $ELUCORA_API_KEY" }
    }
  }
}

Source custody and export

The create response includes artifact_expires_at. Source bytes are retained for 30 days on Free, 1 year on Builder, 3 years on Pro, and 7 years on Scale. The signed receipt and transparency entry remain after artifact expiry. Account owners can export receipt JSON from Dashboard → Settings → Data at no additional charge.

Retries and limits

Send a unique Idempotency-Key on every create request. Retrying the same body with the same account and key returns the original receipt without consuming quota twice. Reusing the key with different input returns 422. Responses include per-minute RateLimit-* headers, monthly X-Elucora-Monthly-* headers, and an X-Request-Id for support.

Idempotency-Key: report-run-2026-08-13-row-482

Errors

Errors use application/problem+json and include stable code and request_id fields. Branch on the HTTP status and code; display detail to a developer. Respect Retry-After after a 429.

{
  "type": "about:blank",
  "title": "Evidence not found",
  "status": 422,
  "detail": "The exact quote was not found in the captured source.",
  "code": "evidence_not_found",
  "request_id": "req_…"
}

Security model

Version 1.1 receipt payloads use ES256 over RFC 8785 canonical JSON. Version 1.2 API responses add a public hash-chain proof without changing the signed payload format. An issued RFC 3161 token independently timestamps the chain entry; not_configured does not. Neither mechanism proves source truth, browser appearance, or legal sufficiency.