How verification works

Most facts point at a stored capture: the raw bytes Bixel observed, content-addressed by SHA-256. Captures are batched into hash-chained manifests, and each batch's Merkle root is anchored with OpenTimestamps proofs anchored in the Bitcoin blockchain. That chain is what a proof bundle exposes.

The honesty boundary

Every proof bundle carries this statement, verbatim:

This proof attests that the referenced raw content was observed by Bixel at the recorded time and is included in a hash-chained batch anchored in the Bitcoin blockchain via OpenTimestamps. It does not attest that Bixel's structured extraction of that content is correct; the raw bytes are pointed at so you can read the source yourself.

In other words: the proof machinery makes "we saw these bytes at this time" independently checkable. Whether Bixel read those bytes into the right structured fact is a claim you can audit by reading the raw source the bundle points at.

Getting the raw bytes (verify step 1)

The bundle's capture.raw.fetch_url serves the archived source itself:

curl -H "x-api-key: bx_..." -O "https://api.bixel.com/v1/captures/{capture_id}/raw/"
sha256sum <downloaded file>   # must equal the bundle's capture.sha256

Any API key works, including the free tier's — the key is identity and rate limiting, not a paywall. One capture per request; there is no bulk or listing surface. The bytes are served exactly as the sha256 commits to them (already integrity-checked server-side; a mismatch refuses rather than serves), as a plain-text download so archived pages never render or execute. Steps 2–4 (inclusion, chain, anchor) verify fully offline from the bundle alone via bixel-verify.

Archived copies are served solely so cited observations can be verified. If you control a page we captured and want a copy removed: support@bixel.com.

Get a proof bundle

curl "https://api.bixel.com/v1/companies/pinecone.io/facts/pricing.model/proof"

The bundle contains:

• fact — the fact being proven, with its extractor version.
• capture — the observation: SHA-256, captured_at, source_url, and a pointer to the raw bytes.
• inclusion_proof — the Merkle path from the capture to the batch root (constant depth by construction).
• anchor — the manifest-chain head, embedded base64, plus its OpenTimestamps proof and the previous chain link.

Facts derived from live network signals with no stored capture answer proof_not_available honestly. Captures newer than the last anchored export answer proof_not_yet_anchored until the twice-weekly anchoring run includes them.

Verify offline

bixel-verify checks a saved bundle without talking to Bixel:

curl -o bundle.json \
  "https://api.bixel.com/v1/companies/pinecone.io/facts/pricing.model/proof"
npx bixel-verify bundle.json

It re-hashes the capture, walks the inclusion path to the committed root, follows the manifest hash chain, and validates the OpenTimestamps anchor against Bitcoin block headers. Any tampering — a changed byte, a substituted root, an edited date — fails loudly.

The transparency log

Chain heads are mirrored to a public git repository, bixel-ai/bixel-transparency, commitments only. Git history makes retroactive rewriting of the chain publicly detectable: a rewritten head would have to rewrite a repository other people have cloned.

The same machinery backs every record page on bixel.com — the API's proof endpoint is the raw form of the "receipts" the site shows inline.