Verify a Botrite Observe receipt

Install lattiq-verify, fetch the trust-anchor file, and verify any receipt offline against the daily-published merkle log. Three commands.

1. Install the verifier

lattiq-verify is a small Python CLI. Install it from PyPI:

pip install lattiq-verify

On Windows or in environments where multiple Python interpreters are present, use:

python -m pip install lattiq-verify

v0.1 is the supported verifier contract for the merkle workflow shown below. If your package manager currently resolves lattiq-verify to 0.0.1, wait for the v0.1 release before relying on the merkle command.

2. Run the recipe

From a working directory of your choice, save the receipt JSON returned by POST /v1/observe to a file (the POST response body is the receipt JSON), then run these three commands:

Verify recipe

            curl -fsS https://botrite.lattiq.ai/keys/KEY_FINGERPRINTS.txt -o KEY_FINGERPRINTS.txt
git clone https://github.com/Botrite/observe-merkle-log && cd observe-merkle-log
lattiq-verify merkle --receipt /path/to/receipt.json --date 2026-04-29 --merkle-mirror . --key-fingerprints ../KEY_FINGERPRINTS.txt
          

A few practical notes:

The --date argument is the UTC date prefix of the receipt’s observed_at field — the first 10 characters of the timestamp.
--merkle-mirror . tells the verifier to read the published merkle data from the current working directory; you are inside the cloned observe-merkle-log directory after running the second command.
--key-fingerprints ../KEY_FINGERPRINTS.txt points back to the parent directory because that is where you saved the trust-anchor file before changing into the cloned repo.

3. Cross-check the trust anchor

After downloading KEY_FINGERPRINTS.txt, compute its SHA-256 locally and compare it against the published value below. If those hashes do not match, stop and refresh the file before continuing.

sha256sum KEY_FINGERPRINTS.txt

Current SHA-256 of KEY_FINGERPRINTS.txt

babb51c24c29fe8a6c47f8c4e5f792a37fa3430c2466778c02e32a6cc6f804d1

The value above updates whenever the trust-anchor file is regenerated. If the file you downloaded does not match this hash, refresh it from https://botrite.lattiq.ai/keys/KEY_FINGERPRINTS.txt.

Brand-stack

The tool is lattiq-verify, the repo is Botrite/observe-merkle-log, both are operated by Botrite Operations LLC under Lattiq, LLC.

Where to learn more

For the full Botrite Observe API contract — receipt schema, field semantics, error envelopes, and the trust model — see the documentation:

Open docs security.txt