Registry stack documentation: machine-readable Markdown.
Index of all pages: https://docs.registrystack.org/v/0.38.0/llms.txt
Full corpus: https://docs.registrystack.org/v/0.38.0/llms-full.txt

# evidence verify command reference

> Generated syntax and options for evidence verify.

{/* Generated from Clap command definitions by scripts/generate-cli-reference.mjs. Run npm run generate. */}

Re-verify one stored signed response offline against a pinned key set.

## Contract status

This page is generated from the public Clap command tree for Registry Stack source version `0.38.0` and catalog SHA-256 `cd13c658f65af295f9df3c6db86dc045ac06e9e040afc1f5f5b27c3184ab653d`. Hidden implementation commands are omitted.

## Description

Re-verify one stored signed response offline against a pinned key set. Exactly one stored response is named, and its format is named with it. The command never infers a format from the file's contents, so a credential can never be re-verified under the other format's rules.

## Usage

```text
evidence verify [OPTIONS] --jwks <JWKS> --policy <POLICY> <--jws <JWS>|--sd-jwt-vc <SD_JWT_VC>>
```

## Constraints

| Condition | Requirement |
| --- | --- |
| Command invocation | Exactly one of `--jws <JWS>`, `--sd-jwt-vc <SD_JWT_VC>` is required. |
| Command invocation | `--jws <JWS>` and `--sd-jwt-vc <SD_JWT_VC>` cannot be used together. |

## Options

| Option | Always required | Default | Values | Environment | Description |
| --- | --- | --- | --- | --- | --- |
| `--jws <JWS>` | No | n/a | n/a | n/a | Stored flattened JWS JSON response file |
| `--sd-jwt-vc <SD_JWT_VC>` | No | n/a | n/a | n/a | Stored compact SD-JWT VC response file |
| `--jwks <JWKS>` | Yes | n/a | n/a | n/a | Pinned trusted JWKS document. This file is the complete trust set |
| `--policy <POLICY>` | Yes | n/a | n/a | n/a | Relying-procedure verification policy document |
| `--at <AT>` | No | n/a | n/a | n/a | Verification instant as strict RFC 3339 UTC; system time by default |
| `-h, --help` | No | n/a | n/a | n/a | Print help (see a summary with '-h') |

## Generation contract

Run `npm run generate` from `docs/site` after changing a public command, argument, option, default, environment binding, or help description.