Fetch a signed SMLTP compliance receipt
curl --request GET \
--url https://secureai.hiperai.ai/api/external/receipts/{bundleId} \
--header 'Authorization: Bearer <token>'import requests
url = "https://secureai.hiperai.ai/api/external/receipts/{bundleId}"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://secureai.hiperai.ai/api/external/receipts/{bundleId}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));Seguridad, Guardrails & Auditoría
Compliance Receipts
Fetch the signed SMLTP compliance receipt for a completion
GET
/
receipts
/
{bundleId}
Fetch a signed SMLTP compliance receipt
curl --request GET \
--url https://secureai.hiperai.ai/api/external/receipts/{bundleId} \
--header 'Authorization: Bearer <token>'import requests
url = "https://secureai.hiperai.ai/api/external/receipts/{bundleId}"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://secureai.hiperai.ai/api/external/receipts/{bundleId}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));Compliance Receipts
When a completion is routed through the SMLTP gateway, SecureAI produces a signed compliance receipt — cryptographic proof of the policy that governed the call. This endpoint fetches that receipt by its bundle id. Receipts exist only for gateway-routed deployments. On direct-provider deployments there is no gateway to sign receipts, and this endpoint returns404.
Endpoint
GET /receipts/:bundleId
Where the bundle id comes from
Completion responses expose the bundle id whenever an SMLTP entitlement is minted for the call:- Classic endpoint:
metadata.smltp.bundle_id(and a ready-mademetadata.smltp.receipt_url). - OpenAI-compatible endpoint:
secureai.smltp_bundle_id.
jti-…) is returned even on native/direct-provider deployments. The signed receipt at that id, however, only exists when traffic is routed through the SMLTP gateway — on direct deployments this endpoint returns 404 (see below).
Authentication
Authorization: Bearer sk-your-api-key-here
Request Example
curl -X GET "https://{customer.name}.hiperai.ai/api/external/receipts/bnd_9f2c...e71" \
-H "Authorization: Bearer sk-your-api-key-here"
Response
200 OK
{
"success": true,
"receipt": {
"bundle_id": "bnd_9f2c...e71",
"...": "signed SMLTP receipt payload (policy, entitlement, verdict, signatures)"
}
}
receipt object is the signed payload emitted by the gateway. See SMLTP Security for how receipts fit into the transparency and audit model.
404 Not Found
{
"success": false,
"error": "Receipt not found",
"message": "No receipt for this bundle id. Receipts are only available when requests are routed through the SMLTP gateway, and are retained in its in-memory store for a limited time. The authoritative record is the hash-chained audit log."
}
400 Bad Request
Returned when the bundle id is missing or longer than 128 characters.Notes
- Receipts are held in the gateway’s in-memory store for a limited time. For long-term proof, rely on the hash-chained audit log — the authoritative, immutable record. See Immutable Logs.
- Not every deployment routes through the gateway; treat a
404as “no gateway receipt for this call,” not an error in your integration.