Verification Certificates

Every verification performed through VeriflowAPI generates a signed certificate. Certificates provide a tamper-proof audit trail that proves a verification was performed at a specific point in time using specific data sources.

What is a verification certificate?

A verification certificate is a cryptographically signed record containing:

The verification ID
The provider details verified
The data sources checked
The result of the verification
A precise timestamp
A SHA256 hash signature

Certificates are useful for regulatory audits, compliance documentation, and legal defensibility. If you are ever asked to prove that you verified a provider’s credentials before onboarding, a VeriflowAPI certificate provides that proof.

Certificate fields

Every verification response includes two certificate-related fields:

Field	Description
`verification_id`	Unique identifier for this verification. Use this to retrieve the full certificate.
`certificate_hash`	SHA256 hash of the signed certificate. Use this to verify the certificate has not been tampered with.

Retrieve a certificate

GET https://api.veriflowapi.com/v1/certificate/{verification_id}

Response

{
  "verification_id": "vrf_a1b2c3d4e5",
  "issued_at": "2026-02-20T10:30:00Z",
  "provider": {
    "name": "Dr. Sarah Chen",
    "npi": "1234567890",
    "license_number": "ME149820",
    "state": "Florida"
  },
  "result": {
    "verified": true,
    "status": "active",
    "expiry_date": "2027-06-30",
    "disciplinary_flags": false,
    "oig_excluded": false
  },
  "sources_checked": ["NPPES", "OIG", "FL Department of Health"],
  "certificate_hash": "sha256_9f8e7d6c5b4a3b2c1d...",
  "signature": "vrf_sig_a1b2c3d4e5f6g7h8..."
}

Download PDF certificate

GET https://api.veriflowapi.com/v1/certificate/{verification_id}/pdf

Returns a PDF version of the certificate suitable for storage in compliance documentation systems or sharing with auditors. The PDF includes:

VeriflowAPI letterhead
All verification details
QR code linking to the online verification record
Digital signature

Certificate retention

VeriflowAPI retains all verification certificates for a minimum of 7 years from the date of issue, in line with standard healthcare compliance record retention requirements. Certificates are available via API at any time during the retention period using the original verification_id.

Verifying certificate integrity

You can verify that a certificate has not been tampered with by recomputing the SHA256 hash of the certificate body and comparing it to the certificate_hash field.

import hashlib
import json

def verify_certificate_integrity(certificate):
    # Extract the hash from the certificate
    expected_hash = certificate.pop('certificate_hash')
    
    # Compute hash of remaining certificate body
    body = json.dumps(certificate, sort_keys=True).encode()
    computed_hash = 'sha256_' + hashlib.sha256(body).hexdigest()
    
    return computed_hash == expected_hash

Getting Started

API Reference

Features

Compliance & Security

Support

Certificates

Verification Certificates

What is a verification certificate?

Certificate fields

Retrieve a certificate

Response

Download PDF certificate

Certificate retention

Verifying certificate integrity

​Verification Certificates

​What is a verification certificate?

​Certificate fields

​Retrieve a certificate

​Response

​Download PDF certificate

​Certificate retention

​Verifying certificate integrity

Verification Certificates

What is a verification certificate?

Certificate fields

Retrieve a certificate

Response

Download PDF certificate

Certificate retention

Verifying certificate integrity