---
key: verify
path: /verify
section: verify
priority: 0.9
title: Buyer verification
description: How a paying agent verifies a seller's ZadQ attestation locally and free of charge, and how the badge degrades to unknown when no verdict is available.
---

# Buyer verification

Verification is the free side of the system: a paying agent or platform
checks a seller's attestation with no charge, no registration and
no personal data. The check completes locally.

## The verification path

1. **Fetch the verdict** for the seller's endpoint identifier over the free
   path. The verdict is a small signed document: operator status,
   guarantee-deposit state, verification date, and the renewal cadence
   promise.
2. **Check freshness** against the cadence the credential itself promises —
   the buyer never needs a clock authority beyond its own.
3. **Verify the signature locally.** The verdict payload verifies with a
   published public key (Ed25519) against the canonical byte form of the
   payload. No call to any ZadQ system is required at decision time.

```text
verdict ──► freshness check ──► local signature check ──► badge state
   │              │                     │
   └── absent ────┴──── stale ──────────┴── invalid ──► "unknown"
```

## Badge states

The badge shows one of three words. The verdict object carries the outcome
(`human_backed`, `revoked`, `stale`, `no_signal`, with `reason` on any
non-positive one); the copy-in badge snippet reduces it to three states.

| Badge | Verdict outcome | Snippet state | Meaning |
| --- | --- | --- | --- |
| verified | `human_backed` | `human-backed` | Valid, fresh attestation; an accountable, verified operator with an active guarantee deposit stands behind the endpoint |
| not verified | `revoked` | `revoked` | The attestation has been withdrawn, or has lapsed past its renewal deadline |
| unknown | `stale`, `no_signal`, or no verdict at all | `unknown` | No usable verdict — stale, withheld, unreachable or unverifiable — the neutral fallback |

## Graceful degradation

`unknown` is a first-class state, not an error. Every integration keeps
working when no verdict is available: the badge shows `unknown` and the
payment flow proceeds exactly as it would without the attestation layer.
Buyer-side policy — whether to pay `unknown` sellers — always belongs to the
buyer, never to the verification layer.

## What verification never requires

- No account, key or credential on the buyer side.
- No fee on the verification path.
- No personal data in either direction.
- No live dependency: a cached verdict inside its freshness window verifies
  offline.

Next: the [SDK reference](/docs/sdk) lists the vendorable modules implementing
this path.