Verifying a Regulatory Evidence Package

This guide is for banks, auditors, supervisors, counterparties and anyone else who has been sent a link to a package, or its bundle, and must decide whether to rely on it.

You do not need an account. A package’s verification page answers three questions in plain language: is this evidence still current, did the named people approve it, and are the files in front of you the ones they approved.

What you may receive

You were sent	What to do
A link	Open it. Everything below is on the page.
A link that allows downloads	Open it, download the files from the Files card, then check them.
A bundle (a zip)	Check it with or without a link; see Without the link. It verifies on its own.
A file alone, with no link or bundle	Ask the sender for a link or the bundle. A file alone proves nothing.

Is it still current?

The first card on the page gives the package’s state now, with its date.

State	Meaning
Valid	This is the current evidence. It has not been replaced or revoked. If it has an expiry date, the date is shown.
Superseded	Newer evidence exists. Ask whoever sent you the link for it. The checks below still show what was approved.
Revoked	Do not rely on this evidence. Its files are no longer offered. The checks below show only what was approved before it was revoked.
Expired	It has not been replaced or revoked, but its own expiry date has passed.

Under it, one line says what Foundry’s own check of the credential says at that moment: that Foundry confirms the credential is valid, that Foundry reports it as revoked, or that Foundry did not confirm it or could not be reached. In the last case the state shown is the issuer’s own record.

Did the named people approve it?

The page checks the credential in your browser:

This credential is authentic, or a plain statement that it was revoked or could not be verified.
What was checked lists each step, marked Passed, Partly checked, Not run or Failed.
Approvals the credential required states how many approvals were required, how many approvers were named, and how many approvals the package proves. Each approver is listed by name.

Are these the files that were approved?

Drop any file you hold onto Are these the files that were approved?

The page first checks the package’s file list against the credential. A list that does not match is refused, and no file is checked against it.
Each file you drop is fingerprinted in your browser and looked up in that list.
Nothing is uploaded.

Result	Meaning
unchanged since it was approved	It is a file of the package, byte for byte.
changed since it was approved	The package has a file of this name, and this one differs. Do not rely on it.
not part of this package	It matches none of the package’s files. The approvals do not cover it.

The package’s files are listed with Unchanged beside each one you have checked, so you can see which remain.

Downloading the files

A link that allows downloads shows a Files card with Download beside each file. Once downloaded, drop them on the page to check them. A revoked package no longer offers its files.

Without the link

The bundle carries everything needed, and verifies on its own:

Open /verify on the sender’s Regulatory Evidence address, with nothing after it. The bundle’s manifest.json names the package’s verification link, which gives that address. A link that no longer opens shows the same place to drop files.
Drop verify-package.keri.json from the bundle.
When asked, drop manifest.json from the bundle. It lists the package’s files.
Drop the files from the evidence/ folder.

A check without the link cannot say whether the package was later superseded or revoked. Only the link asks.

When a link does not open

This verification link is not valid means the link was mistyped, withdrawn by whoever sent it, or has passed its end date. A withdrawn or ended link answers as if it never existed. Ask the sender for a new link, or check the bundle without one.

What the sender sees

Each use of a link is recorded for the sender: that it was opened and the state it showed, the result of each file you checked on the page, and each file downloaded, with when and which link. No file content and no details about you are recorded.

Using the result in your process

Soft check: read the page during onboarding or periodic review, and keep the bundle in the case file.
Hard gate: let a step continue only when the files match, the credential is valid on Foundry and the evidence is current. Require vLEI authority only when your own policy asks for it. A package without it is not a failed package.
Check again later: open the same link. If the evidence was superseded or revoked since, the page says so.

Rely only on a package whose link reads Valid, whose credential is authentic and confirmed by Foundry, with every file unchanged since it was approved. A bundle checked without its link cannot show that the package is still current.