📡 API Reference

Programmatically verify certificates of completion. No API key required — the certificate hash is a publicly verifiable claim.

GET/api.php?hash={certificate_hash}

Pretty-URL form (requires mod_rewrite): https://aii.run.place/api/verify/{certificate_hash} · CORS enabled for all origins · No authentication needed

🧪 Live tester

Paste any certificate hash and hit Send — this page calls the real API and shows the response.

Open certificate page ↗

Same request via curl:

No certificates issued yet on this install — earn one, then paste its hash here.

🔎 Endpoint explorer

Select an endpoint, fill in the parameters, and try it against this live API — exactly like Swagger/OpenAPI tooling.

curl:

Endpoints

Method	Path	Description	Auth
GET	`/api.php?hash={hash}`	Verify a certificate by its public hash	None
GET	`/api/verify/{hash}` (pretty URL)	Same endpoint; needs Apache mod_rewrite	None

curl examples

✅ Valid certificate

curl -s "https://aii.run.place/api.php?hash=PLACE_YOUR_CERTIFICATE_HASH_HERE"

{
  "valid": true,
  "schema": "1.0",
  "verified_by": "HarDojo",
  "certificate": {
    "id": "7a8a34d319bdb11e5c89c60e734f971a0cfbe39821897d65",
    "learner": "alice",
    "path": "MCP",
    "path_slug": "mcp",
    "completed_at": "2026-08-22 05:04:27",
    "lesson_count": 6,
    "exercise_count": 8,
    "score_pct": 91,
    "verify_url": "https://aii.run.place/certificate.php?hash=7a8a34d319bdb11e5c89c60e734f971a0cfbe39821897d65"
  }
}

⛔ Revoked certificate (still exists, but is no longer valid)

curl -s "https://aii.run.place/api.php?hash=PLACE_YOUR_CERTIFICATE_HASH_HERE"

{
  "valid": false,
  "revoked": true,
  "revoked_at": "2026-08-22 12:00:00",
  "schema": "1.0",
  "verified_by": "HarDojo",
  "certificate": {
    "id": "7a8a34d319bdb11e5c89c60e734f971a0cfbe39821897d65",
    "learner": "alice",
    "path": "MCP",
    "path_slug": "mcp",
    "completed_at": "2026-08-22 05:04:27"
  }
}

Response reference

Status	Body	Meaning
`200`	`{"valid": true, "certificate": {…}}`	Certificate exists and is valid
`200`	`{"valid": false, "revoked": true, "revoked_at": "…"}`	Certificate exists but was revoked by an admin
`400`	`{"valid": false, "error": "missing_hash"}`	No `hash` parameter provided
`400`	`{"valid": false, "error": "invalid_hash"}`	Hash is not 48 lowercase hex characters
`404`	`{"valid": false, "error": "not_found"}`	No certificate with that hash
`405`	`{"valid": false, "error": "method_not_allowed"}`	Request was not `GET` / `OPTIONS`
`204`	empty	CORS preflight (`OPTIONS`)

Notes

No auth needed — the 48-character hash is the bearer token. It is a publicly verifiable claim, not a secret: anyone with the link can verify it, which is the point.
Response is JSON with Content-Type: application/json; charset=utf-8 and Cache-Control: public, max-age=300 (5-minute browser cache).
CORS — Access-Control-Allow-Origin: * plus preflight handling, so browser apps on any origin can call it directly with fetch().
Pretty URLs — if the host supports mod_rewrite, /api/verify/{hash} works; otherwise use the query-string form.
Revoked ≠ not found. Check valid first; a revoked certificate returns valid: false, revoked: true (status 200), while an unknown hash returns 404.
Rate limiting — none built in; responses are cached 5 minutes so light abuse is cheap. Add your own limits if you expose this to the public internet.