{
  "_comment": "NoData sample receipt — REFERENCE FORMAT showing the exact structure of a sidecar (.nodatasig file). Do NOT POST this directly to /api/verify — the receipt_id is fictional and won't exist in the production database. To get a REAL receipt you can verify, run: nodata sign your-file.pdf — that produces a real receipt against the live chain. See: https://www.nodatacapsule.com/kit#sandbox",
  "schema": "nodatasig.v1",
  "receipt_id": "nd-rcpt-sampleref0",
  "chain_index": 142,
  "prev_receipt_id": "nd-rcpt-prevsampl1",
  "actor_nickname": "demo-signer",
  "actor_device_id_hash": "086fb29f1d7eaf2c4b9c3a8e5d1f6072c4a89b3e2f7d09e1a4b6c8d3f5a7b9c1",
  "subject_kind": "file",
  "subject_label": "secret-roadmap.pdf",
  "content_hash": "sha256:086fb29f1d7eaf2c4b9c3a8e5d1f6072c4a89b3e2f7d09e1a4b6c8d3f5a7b9c1",
  "perceptual_hash": null,
  "signed_at": "2026-04-25T12:34:56.789Z",
  "signing_version": 2,
  "event_hash": "9b2e7a1f6d4c3b8e5a09f2d7c1b4e6a8f3d9c5b7e2a4f6d8c1b3e5a7f9d2c4b6",
  "chain_hmac": "a3f7e92b1c8d4e6f5a09b2c7d1e3f6a8b4c5d7e9f1a2b3c4d5e6f7a8b9c0d1e2",
  "_format_notes": {
    "receipt_id": "Always 'nd-rcpt-' followed by 10 base36 chars. Generated client-side. Collision domain: 36^10.",
    "content_hash_in_sidecar": "Sidecars use 'sha256:<64hex>' format — the API parses it via parseSidecarHash().",
    "content_hash_in_api_body": "When you POST /api/verify, content_hash must be raw 64-char hex (NO 'sha256:' prefix) — see audit-chain-spec.md §8.",
    "chain_hmac_formula": "HMAC-SHA-256(server_secret, event_hash + '|' + (prev_receipt_id || '') + '|' + created_at) — see audit-chain-spec.md §4.",
    "to_verify_yourself": "1) nodata sign <your-file>  2) nodata verify <your-file>  — produces a real receipt against the live chain that returns valid:true."
  }
}