Public verification proof for Roche
Jump to verification details
Cryptographic validation status
GAFAIG validates the returned canonical signed public payload using the published verification key for this record. Verification MUST be performed against the exact proof.messageString returned by the API. Reconstructing payloads from JSON fields is not permitted and will invalidate verification.
- /api/verify returns the canonical public record and proof.
- proof.messageString is the exact canonical signed public payload.
- proof.signature is the cryptographic signature.
- Never reconstruct or verify from JSON fields.
- /api/.well-known/gafaig-public-key exposes the verification key.
If verification fails
Do not trust this record, do not display certification claims, and treat the record as invalid until the signature, messageString, and public key validate successfully.
Public record identity
These fields connect the public verification response to the Snowflake-originated public registry snapshot. Private Application ID and Case ID values are not displayed on this public proof page.
How this verification proof connects to GAFAIG public governance trust surfaces
This verification surface is one part of the full GAFAIG proof sequence. A record appears in the public registry, is verified through signed proof, exposes its machine-readable proof payload, and can then travel outside the platform through a portable widget, badge, SDK, or external modal.
The published certification record establishes the public governance trust outcome.
This verification surface validates the signed proof behind that record.
The machine-readable signed proof makes the public governance trust record portable.
The same public governance trust signal can appear outside GAFAIG.
This verification proof can be used outside GAFAIG
The certification record and this verification proof provide a readable public governance trust surface for customers, regulators, partners, and the public.
The Signed Proof JSON, signature, messageString, and public key allow external systems to inspect and consume the same trust result without relying on GAFAIG UI.
Open the public certification record that this proof supports.
See how the same public governance trust signal appears on an external site.
Open the machine-readable signed proof returned by the verification endpoint.
Technical verification reference
These fields are provided for reference and debugging. Public governance trust must be established using the exact proof.messageString returned by the API, the signature, and the public key.
Copyable public verification materials
External systems MUST treat messageString as the canonical input to signature verification. The record object is for display only; the verification proof object is the public governance trust layer. Do not reconstruct the canonical signed public payload from JSON fields.
Verification MUST use the exact messageString returned by the API. Never reconstruct it.
This exact string must be used for verification. Any change to whitespace, ordering, timestamp format, escaping, or field values will invalidate the signature.
{"registryId":"GAFAIG-00000014","entityName":"Roche","certificationStatus":"CERTIFIED","certifiedAt":"2026-06-09T19:19:43.000Z","validFrom":"2026-06-09T19:19:43.000Z","validTo":"2027-06-09T19:19:43.000Z","publishedAt":"2026-06-09T19:19:43.000Z"}sq453aWMmMpAUOngX7f0NuDdrBO8KQ75OvGFmPGuiYwpOmxoFpr25s84ko+QgLQEMde4R7CAM0F6l2VAKRmrDA==
Format: PEM / Ed25519. Use this key with the exact messageString and signature to verify the record. This key must be fetched from the official GAFAIG public key endpoint.
-----BEGIN PUBLIC KEY----- MCowBQYDK2VwAyEA+yTbmY5N4fRD9dUARcwfjl+i4u5pKdEKegorLkX0fMI= -----END PUBLIC KEY-----
curl https://www.gafaig.com/api/verify/GAFAIG-00000014
curl https://www.gafaig.com/api/badge/GAFAIG-00000014
{
"ok": true,
"verified": true,
"registryId": "GAFAIG-00000014",
"record": {
"registryId": "GAFAIG-00000014",
"registrySnapshotId": "8f8b3a58-c7a5-4ac6-9343-03cd25f72158",
"applicationId": "APP-DEMO-1024",
"caseId": "CASE-1024",
"entityName": "Roche",
"entityType": "company",
"country": "Switzerland",
"certificationStatus": "CERTIFIED",
"certifiedAt": "2026-06-09T19:19:43.000Z",
"validFrom": "2026-06-09T19:19:43.000Z",
"validTo": "2027-06-09T19:19:43.000Z",
"publishedAt": "2026-06-09T19:19:43.000Z",
"renewalStatus": "VALID",
"lifecycleStatus": "active",
"visibilityStatus": "public",
"verificationEligible": true,
"badgeEligible": true
},
"proof": {
"alg": "Ed25519",
"kid": "gafaig-ed25519-2026-01",
"signature": "sq453aWMmMpAUOngX7f0NuDdrBO8KQ75OvGFmPGuiYwpOmxoFpr25s84ko+QgLQEMde4R7CAM0F6l2VAKRmrDA==",
"signedAt": "2026-06-14T15:44:25.349Z",
"verificationKeyUrl": "https://www.gafaig.com/api/.well-known/gafaig-public-key",
"message": {
"registryId": "GAFAIG-00000014",
"entityName": "Roche",
"certificationStatus": "CERTIFIED",
"certifiedAt": "2026-06-09T19:19:43.000Z",
"validFrom": "2026-06-09T19:19:43.000Z",
"validTo": "2027-06-09T19:19:43.000Z",
"publishedAt": "2026-06-09T19:19:43.000Z"
},
"messageString": "{\"registryId\":\"GAFAIG-00000014\",\"entityName\":\"Roche\",\"certificationStatus\":\"CERTIFIED\",\"certifiedAt\":\"2026-06-09T19:19:43.000Z\",\"validFrom\":\"2026-06-09T19:19:43.000Z\",\"validTo\":\"2027-06-09T19:19:43.000Z\",\"publishedAt\":\"2026-06-09T19:19:43.000Z\"}"
}
}