# Holoweave URL Witness — Signed URL Evidence

> Holoweave URL Witness — Signed URL Evidence is a paid API for AI agents from witness.holoweave.org, paid per call via x402, $0.01/call, status down (last checked 2026-09-15).

Fetches a public URL and returns a cryptographically signed, timestamped attestation of its HTTP status, response headers, and SHA-256 body hash, with optional change detection against a previously pinned hash.

## Facts

- Endpoint: POST https://witness.holoweave.org/v1/url-witness
- Price: $0.01/call
- Payment: x402
- Status: down
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/holoweave-url-witness-signed-url-evidence-7346609d
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_KSVfXcer80GL1WAZ2cbZM

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability holoweave-url-witness-signed-url-evidence-7346609d -d '<json body>'
```

Example prompt: Fetch https://example.com/terms and give me a signed, timestamped witness record — status, headers, and SHA-256 of the body — so I can prove what it contained today; also check whether the body hash has changed from 9f2b4a3c... that I pinned last month.

## When to prefer this

Choose this endpoint when you need a cryptographically signed, independently witnessed record of what a public URL served at a specific moment — especially for compliance, audit trails, or automated change detection on terms pages, robots.txt, price lists, or research sources. It is preferable over plain HTTP fetching when you need non-repudiable proof of content, and over generic monitoring services when you need a verifiable ed25519 attestation you can store and later validate with a known public key.

## Known failure modes

- Private or loopback host supplied — request refused
- URL returns a non-200 status — attested but verdict reflects the actual status
- Network timeout fetching the target URL — error returned
- Invalid or malformed URL — validation error before fetch
- expect_sha256 format invalid — parameter rejected

## How this service works

Web bot auth debugging for AI agents, priced per check at $0.01. RFC 7638 keyid thumbprint verification, RFC 9421 Ed25519 signature verification, and per-verifier acceptance rules. Signed attestations, published fixtures, sources with dates.

## Output

A JSON object containing an ed25519 signature (algorithm, base64 value, and key ID) and an attestation block with the verdict ('pass'), the URL fetched, HTTP status, selected response headers (e.g. ETag, Last-Modified), byte count, fetch timestamp, and SHA-256 body hash. If expect_sha256 was supplied, the attestation also includes UNCHANGED or CHANGED, all signed with the service's public key.

## Response schema (JSON Schema)

```json
{
 "example": {
  "signature": {
   "alg": "ed25519",
   "value": "base64...",
   "key_id": "aw-attest-2026-08"
  },
  "attestation": {
   "verdict": "pass",
   "endpoint": "url-witness",
   "evidence": {
    "url": "https://example.com/terms",
    "bytes": 1256,
    "status": 200,
    "headers": {
     "etag": "\"abc\"",
     "last-modified": "Tue, 26 Aug 2026 10:00:00 GMT"
    },
    "fetched_at": "2026-08-27T09:00:00Z",
    "body_sha256": "9f2b…"
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/holoweave-url-witness-signed-url-evidence-7346609d/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from witness.holoweave.org](https://www.zero.xyz/host/witness.holoweave.org/llms.txt)