CLI/API usage

The witness CLI is a gateway client. Put the global gateway option before the subcommand, or set WITNESS_GATEWAY:

witness --gateway https://gateway.example attest --hash <64-hex-sha256>

The default gateway is http://localhost:8080.

Actual commands

witness attest --file document.pdf
witness attest --hash <64-hex-sha256> --output json --save job.json
witness status <64-hex-sha256> --output json
witness verify signed-attestation.json
witness config
witness anchors <64-hex-sha256> --output json
witness log sth --verify
witness log consistency --first 10 --second 20 --verify
witness verify-proof --hash <64-hex-sha256> --online

attest --file hashes locally. attest --hash requires a 64-character hex SHA-256 value. Submission returns a job snapshot and does not itself poll to confirmation; use status. A saved job is an AttestationJobResponse, while verify requires the nested SignedAttestation object.

Local and remote verification

verify fetches /v1/network and performs local threshold verification. It does not accept a local config path. verify-proof supports a saved bundle and --network-config for offline verification, or --online to fetch the home and missing peer configs. --peer-config is repeatable.

config calls /v1/config, which has no witness public keys and is not a verification trust anchor. anchors maps a gateway 404 to an empty display, so its empty output can represent an unknown, unbatched, or not-yet-externally- anchored attestation.

All commands use the HTTP routes described in HTTP API; the CLI does not contact witness signing nodes directly.