Validations are submitted to the WAF++ validation gateway as the central trust authority. The gateway verifies the server sub-CA certificate, signs the envelope with its intermediate key, and returns a permanent validation ID.
API endpoint
POST https://validate.waf2p.dev/api/v1/validations
Request body
The request body must be JSON and contain the following fields:
{
"server_certificate": "-----BEGIN CERTIFICATE-----\nMIIB...\n-----END CERTIFICATE-----",
"local_attestation": {
"public_key": "-----BEGIN PUBLIC KEY-----\nMCow...\n-----END PUBLIC KEY-----",
"signature": "base64...",
"certificate": "-----BEGIN CERTIFICATE-----\nMIIB...\n-----END CERTIFICATE-----"
},
"run": {
"run_id": "string",
"project_id": "string",
"canonical_hash": "hex...",
"validated_at": "2026-08-16T12:00:00Z",
"expires_at": "2027-08-16T12:00:00Z"
}
}
| Field | Description |
|---|---|
server_certificate |
PEM-encoded X.509 sub-CA certificate issued to the wafpass-server deployment by the gateway. |
local_attestation |
The local attestation bundle from the server (public key, signature, optional certificate). |
run |
The canonical run record to be validated. |
Response
On success, the gateway returns 201 Created with the signed validation
envelope:
{
"validation_id": "123e4567-e89b-12d3-a456-426614174000",
"status": "official",
"canonical_hash": "hex...",
"server_signature": "base64...",
"gateway_signature": "base64...",
"certificate_chain": ["-----BEGIN CERTIFICATE-----\n..."],
"badge_url": "https://validate.waf2p.dev/api/v1/validations/123e4567-e89b-12d3-a456-426614174000/badge.svg",
"verify_url": "https://validate.waf2p.dev/api/v1/validations/123e4567-e89b-12d3-a456-426614174000/verify",
"certificate_url": "https://validate.waf2p.dev/api/v1/validations/123e4567-e89b-12d3-a456-426614174000/certificate.pdf"
}
CLI submission
The recommended way to submit is via the wafpass CLI:
wafpass submit \
--server-url https://server.example.com \
--gateway-url https://validate.waf2p.dev \
--project my-project
The CLI collects the server sub-CA certificate, builds the attestation bundle, and POSTs the payload to the gateway.
Full edge-to-edge example
For a complete walkthrough that includes issuing the server certificate, building the local attestation, and the exact JSON request body, see the full edge-to-edge example.
Try it
You can inspect the current gateway status without submitting:
curl https://validate.waf2p.dev/api/v1/validations/root.crt