How it works · API

One request per deposit.

The verifier over HTTP, for exchanges, bridges and anyone else. Same code and same answers as the command line. Every read-only endpoint below has a Try it live button that calls the real API on mainnet.

Basics /verify /age /verify-link /events /stats, /health Errors

01 / Basics

No key, no account.

api.usevintage.siteBase URL, Zcash mainnet. JSON in and out. Open to any origin (CORS).

No logsNo request log, no IPs, no txids kept. The only record is the anonymous daily count at /stats.

Self-hostFor production, run vintage-api next to your own node, so nobody learns which deposits you check. See the integration guide.

02 / The check

GET /verify/{txid}?before={event or height}

Did every coin this transaction spends exist before the event? Answers PASS, FAIL or NOT_PROVABLE, with the evidence and the coins' age. Only act on "provisional": false.

Request

$ curl 'https://api.usevintage.site/verify/da9017e0fca0d8bd87def8e3faa7956067f2bd2234cfee91ca7ad4e67095e3a7?before=vintage-demo-2026-10'

Field	Meaning
verdict	PASS: every coin predates the event. FAIL: no information, never a flag. NOT_PROVABLE: non-Ironwood inputs, see reasons.
summary	One sentence for people.
provisional	true while unmined: the same txid could still be mined with another anchor.
age	Block and time by which every coin was in the pool.
evidence	Blocks covered and distinct pool states ruled out.

03 / No event needed

GET /age/{txid}

The coins' proven age, and for each registered event whether they predate it. One call screens a deposit against every event. The example is a stranger's transaction from the day before the Bitget hack.

Request

$ curl https://api.usevintage.site/age/d3252057850259c86ffae437d0df207ff8b500e4d83dfe4409f585dcd6b441e4

04 / Coins received after the event

POST /verify-link

The receipt-account link. The body is a bundle from vintage link prove and carries one single-use account's viewing key. The API holds it for the request only: never written to disk, a log or a cache. To send the key to nobody, run vintage link verify yourself.

Request

$ curl https://api.usevintage.site/verify-link \
    -H 'content-type: application/json' \
    -d '{"before": "vintage-demo-2026-10", "bundle": '"$(cat demo/mainnet-link-bundle.json)"'}'

Run it from a clone of the repository: demo/mainnet-link-bundle.json is our published demo bundle. Expected: PASS, inputs 0 and 1 funded by outputs 1 and 2 of da9017e0…. Try it in the browser in the lab, station 4.

05 / The registry

GET /events

The signed event registry for this network, its public key, and whether the signature verified. The exact signed bytes: /registry/events.json and .sig.

Request

$ curl https://api.usevintage.site/events

06 / Service

Counts and health.

GET /stats

Anonymous daily totals of checks, by verdict and by event. Nothing else is recorded.

GET /health

The network, the lightwalletd server the API reads from, and the chain tip.

07 / Errors

When there's no verdict.

Status	When
400	Malformed txid, missing before, unknown event, or a height before Ironwood's activation (block 3,428,143) or above the tip.
404	The server doesn't know the transaction.
502	The lightwalletd server couldn't be reached.

Errors are JSON: {"error": "…"}. Treat any error as no information and apply your normal process. Full field reference: docs/API.md. The same checks from a terminal: the command line.