Web Resource Ledger (WRL)

Cryptographic evidence of web content -- capture what a page looked like, when, with proof anyone can verify.

Submit a URL, get back a screenshot, rendered HTML, HTTP headers, and an Ed25519-signed WACZ bundle. The verification URL works for anyone -- no account needed. Deploy on your own infrastructure; your captures, your keys, your evidence.

WRL was built almost entirely by an LLM (Claude) with a human directing the work. Every phase -- from MVP to production -- is documented in docs/evolution/. The prompts, agent debates, decisions, and outcomes are all public.

For comprehensive guides on authentication, verification, batch captures, and MCP integration, see docs.webresourceledger.com.

Status: Production service, single-operator deployment. All three roadmap acts are complete. The API is pre-1.0 but functional, deployed, and serving real traffic.

What you get

A single API call produces:

• Dual screenshots (PNG) -- before and after cookie consent dismissal, so both the banner presence and the underlying page content are preserved
• Rendered HTML -- the DOM after JavaScript execution
• HTTP response headers -- the server's response at capture time
• Signed WACZ bundle -- all artifacts packaged, hashed, and signed with Ed25519
• Verification URL -- a shareable link anyone can use to confirm authenticity
• FRE 902(13) certification PDF -- GET /v1/captures/{captureId}/certificate returns a signed PDF describing the capture process and integrity evidence, designed to support a Rule 902(13) self-authentication foundation

Content Security

WRL screens every submitted URL against threat intelligence databases before capture begins:

• URLs identified as threats (malware, phishing, etc.) are rejected at submission time with a 422 response.
• Existing captures are re-scanned daily. Captures that fail re-screening are quarantined: metadata remains accessible, artifact downloads return 451.
• Screening degrades gracefully -- if the threat intelligence service is unavailable, captures proceed normally. The threatCheck field on a capture record reflects the outcome: pass, fail, or unavailable.

Configure the service via GOOGLE_WEB_RISK_API_KEY in your environment (see step 8b below). The key is optional; omitting it disables screening and all captures report threatCheck: unavailable.

Usage

Requires a running WRL instance. See Setup below.

export WRL_API_KEY=your_tenant_api_key

Tenant keys are created via the admin API (see step 8a). For deployments using the legacy static key, WRL_API_KEY is your CAPTURE_API_KEY value.

The examples below use api.webresourceledger.com. Replace with localhost:8787 for local dev or your own deployment URL if self-hosting.

Step 1: Submit a capture

curl -X POST https://api.webresourceledger.com/v1/captures \
  -H "Authorization: Bearer $WRL_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://example.com"}'

{
  "id": "cap_a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6",
  "statusUrl": "https://api.webresourceledger.com/v1/captures/cap_a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6/status",
  "note": "Use GET /v1/captures to list and search your captures."
}

Your captures are always accessible. Use GET /v1/captures to list them, or save t

... View full README on GitHub