POST /receipt

Logs an audit event tied to a verify token. No PII is stored — the token_id provides accountability without identifying the speaker.

Request

POST /v1/receipt Content-Type: application/json

Field	Type	Required	Notes
`token`	string	Yes	Full JWT from `/v1/verify`
`action`	string	Yes	Namespaced action identifier
`result`	string	Yes	`"success"` or `"failure"`
`metadata`	object	No	Arbitrary key-value pairs (no PII)

{
  "receipt_id": "rec_1a2b3c4d5e6f",
  "logged_at": "2026-11-09T14:35:12Z"
}

await vm.receipt(
  verify.token,
  "payment.authorise",
  "success",
  { amount: 250.00, currency: "GBP" }
);

Receipts are keyed by token_id, which is anonymous. Do not include names, email addresses, or other personal data in metadata.

⌘I