Export STIX and Verify the Seal

Before you beginCopy Anchor Link

API commands require curl, jq, and a workspace-bound key with ledger:read. Set Y2_API_KEY to that key. Set Y2_SUBJECT_ID to a subject ID from your workspace. See List ledger subjects to find the ID.

Offline checks also require Bun and a checkout of the Y2 platform repository. Run repository commands from its root. If you lack repository access, use API verification.

Export a subject as STIX 2.1Copy Anchor Link

In the app, select Export STIX 2.1 in the ledger panel. The bundle uses the selected Valid on date.

For an API export:

curl --fail --silent --show-error --get \
  "https://api.y2.dev/api/v2/ledger/subjects/$Y2_SUBJECT_ID/stix" \
  --header "Authorization: Bearer $Y2_API_KEY" \
  --data-urlencode "history=true" \
  --output subject.stix.json

history=true includes retracted claims with revoked: true. Without it, the bundle includes only live claims. See the STIX mapping.

An incomplete subject neighborhood returns 400 VALIDATION_ERROR. In that case, export the complete log below and project it locally:

bun packages/ontology/src/cli.ts stix ledger.ndjson > ledger.stix.json

Export the sealed logCopy Anchor Link

Run this Bash script in the directory where you want the export. It replaces ledger.ndjson and stops on request or JSON errors.

set -euo pipefail
ledger_after=0
: > ledger.ndjson
while :; do
  ledger_page=$(curl --fail --silent --show-error --get \
    "https://api.y2.dev/api/v2/ledger/records" \
    --header "Authorization: Bearer $Y2_API_KEY" \
    --data-urlencode "afterSeq=$ledger_after" \
    --data-urlencode "limit=200")
  printf '%s\n' "$ledger_page" | jq -r '.data[].line' >> ledger.ndjson
  ledger_after=$(printf '%s\n' "$ledger_page" | jq -er '.meta.nextAfterSeq')
  [ "$(printf '%s\n' "$ledger_page" | jq -er '.meta.hasMore | tostring')" = true ] || break
done

Each line is canonical text. Preserve its bytes and do not reformat its JSON. Pagination continues from meta.nextAfterSeq until meta.hasMore is false. If the script fails, discard the partial export and run it again.

Check the export offlineCopy Anchor Link

From the repository root, run:

bun packages/ontology/src/cli.ts check ledger.ndjson

Use the export's full path if it is stored elsewhere. The checker verifies canonical JSON, record rules, sequence numbers, hashes, links, and increasing record times. It prints ok with the line count, or reports problems with rule codes.

A passing check establishes internal consistency. Compare the final sequence and hash with a trusted copy to detect a missing suffix or a completely replaced chain. The check does not establish that the claims are true.

Verify the seal in placeCopy Anchor Link

To check stored records through the API:

curl --fail --silent --show-error --get "https://api.y2.dev/api/v2/ledger/verify" \
  --header "Authorization: Bearer $Y2_API_KEY" \
  --data-urlencode "afterSeq=0" \
  --data-urlencode "limit=200"

Check data.ok, data.checked, and data.problems. Continue from meta.nextAfterSeq until meta.hasMore is false.

This endpoint checks hashes and links within each window. Rules that require earlier records are enforced during writes and by the offline checker.