---
title: "Export STIX and Verify the Seal"
description: "Export workspace claims, download the canonical log, and check its records."
canonical: https://y2.dev/docs/ontology/how-to/export-and-verify/
---

Ontology & Fusion

# Export STIX and Verify the Seal

Export workspace claims, download the canonical log, and check its records.

## Before you begin

API commands require curl, jq, and a workspace-bound key with `ledger:read`. Set `Y2_API_KEY` to that key. Set `Y2_SUBJECT_ID` to a subject ID from your workspace. See [List ledger subjects](https://y2.dev/docs/api/reference/ontology-ledger/listLedgerSubjectsV2) to find the ID.

Offline checks also require Bun and a checkout of the Y2 platform repository. Run repository commands from its root. If you lack repository access, use [API verification](#verify-the-seal-in-place).

## Export a subject as STIX 2.1

In the app, select **Export STIX 2.1** in the ledger panel. The bundle uses the selected **Valid on** date.

For an API export:

```
curl --fail --silent --show-error --get \
  "https://api.y2.dev/api/v2/ledger/subjects/$Y2_SUBJECT_ID/stix" \
  --header "Authorization: Bearer $Y2_API_KEY" \
  --data-urlencode "history=true" \
  --output subject.stix.json
```

`history=true` includes retracted claims with `revoked: true`. Without it, the bundle includes only live claims. See the [STIX mapping](https://y2.dev/docs/ontology/reference/stix-export).

An incomplete subject neighborhood returns `400 VALIDATION_ERROR`. In that case, export the complete log below and project it locally:

```
bun packages/ontology/src/cli.ts stix ledger.ndjson > ledger.stix.json
```

## Export the sealed log

Run this Bash script in the directory where you want the export. It replaces `ledger.ndjson` and stops on request or JSON errors.

```
set -euo pipefail
ledger_after=0
: > ledger.ndjson
while :; do
  ledger_page=$(curl --fail --silent --show-error --get \
    "https://api.y2.dev/api/v2/ledger/records" \
    --header "Authorization: Bearer $Y2_API_KEY" \
    --data-urlencode "afterSeq=$ledger_after" \
    --data-urlencode "limit=200")
  printf '%s\n' "$ledger_page" | jq -r '.data[].line' >> ledger.ndjson
  ledger_after=$(printf '%s\n' "$ledger_page" | jq -er '.meta.nextAfterSeq')
  [ "$(printf '%s\n' "$ledger_page" | jq -er '.meta.hasMore | tostring')" = true ] || break
done
```

Each `line` is canonical text. Preserve its bytes and do not reformat its JSON. Pagination continues from `meta.nextAfterSeq` until `meta.hasMore` is false. If the script fails, discard the partial export and run it again.

## Check the export offline

From the repository root, run:

```
bun packages/ontology/src/cli.ts check ledger.ndjson
```

Use the export's full path if it is stored elsewhere. The checker verifies canonical JSON, record rules, sequence numbers, hashes, links, and increasing record times. It prints `ok` with the line count, or reports problems with rule codes.

A passing check establishes internal consistency. Compare the final sequence and hash with a trusted copy to detect a missing suffix or a completely replaced chain. The check does not establish that the claims are true.

## Verify the seal in place

To check stored records through the API:

```
curl --fail --silent --show-error --get "https://api.y2.dev/api/v2/ledger/verify" \
  --header "Authorization: Bearer $Y2_API_KEY" \
  --data-urlencode "afterSeq=0" \
  --data-urlencode "limit=200"
```

Check `data.ok`, `data.checked`, and `data.problems`. Continue from `meta.nextAfterSeq` until `meta.hasMore` is false.

This endpoint checks hashes and links within each window. Rules that require earlier records are enforced during writes and by the offline checker.