Trust model

Every answer carries five separate dimensions. There is no verified field and no score, because the useful answers are mixtures and a single number cannot say which mixture.

The whole vocabulary is served by the deployment at GET /v1/verify/vocabulary, so it cannot drift from the build you are calling.

Trust — how strongly is this established?

Unestablished

UNESTABLISHED

Nobody has established how strongly this is known. That is not the same as it being weakly known.

Raw

UNVERIFIED_RAW

A provider said so and XRPC did not check it. Correct as often as that provider is correct.

Attested

ATTESTED_EXTERNAL

Somebody outside XRPC vouched for it. XRPC is relying on them, not on the chain.

Protocol

PROTOCOL_VERIFIED

The chain's own rules were applied to material XRPC holds, and they held.

Proof

PROOF_VERIFIED

XRPC checked a cryptographic proof itself and it held. The strongest thing here.

Certainty is expressed by fill, never by colour. Only a fully established state is drawn solid, and nothing below it is styled to look more certain than it is.

Coverage — how much was looked at?

Explicitly independent of trust. A perfectly trusted answer can cover a fraction of your question, and a complete answer can be weakly established. Collapsing them would hide whichever one you needed.

When coverage is partial the outcome is PARTIAL_COVERAGE and the HTTP status is 206, not 200. A 200 carrying a partial answer is the failure this distinction exists to prevent.

Evidence basis — what supports it, and who?

Whether the answer rests on a single source, on XRPC's own local state, or on material XRPC checked. SERVICE_LOCAL means XRPC read its own state and contacted nothing — a real answer about the engine, not an observation of the chain.

XRPC does not claim source independence. In its own words: "agreement between sources means nothing until independence is established, which this build does not do." Two public endpoints agreeing may be one upstream answering twice.

Read context — which view of the chain?

Four positions, kept apart. There is no latest_block, because "latest" is a different height depending on who you ask and when. A read at a stated reference is COHERENT; a single point-in-time read is SINGLE.

Finality — what does the chain say?

Each chain in its own vocabulary. There is no universal confirmation count.

Network	Condition	What it actually means
Ethereum	`FINALIZED`	Casper FFG finalises a checkpoint when a supermajority of stake attests to it. A block is final because it sits beneath a finalised checkpoint the chain names, never because a count was reached.
Base	`FINALIZED`	An OP Stack rollup. The sequencer's confirmation is a promise by the sequencer, not the protocol; irreversibility arrives when the batch is finalised on Ethereum. The node reports it; XRPC does not count to it.
Bitcoin	`PROBABILISTIC`	Depth is a risk policy. Bitcoin makes no finality claim, and XRPC does not invent one on its behalf.
Tron	`SOLIDIFIED`	A threshold rather than a depth, read from the chain rather than counted to.
Solana	`FINALIZED`	A rooted slot rather than a count.

Where distance_is_meaningful is false, a confirmation count is not a meaningful question on that chain and XRPC will not answer it as if it were.

Asking for a floor

A request may state the minimum trust you will accept. If nothing can meet it, you get no answer:

{
  "outcome": "NO_SAFE_ROUTE",
  "error": { "code": "UPSTREAM_UNAVAILABLE" },
  "floor_requested": "PROTOCOL_VERIFIED",
  "best_available": "UNVERIFIED_RAW"
}

The floors you can request are UNVERIFIED_RAW, ATTESTED_EXTERNAL, PROTOCOL_VERIFIED and PROOF_VERIFIED. best_available tells you what you would have got, so you can decide rather than guess.

The distinctions this model protects

UNSUPPORTED is not NOT_IMPLEMENTED.
UNKNOWN is not SAFE.
NOTHING_SEEN is not UNKNOWN.
A customer's source is not a trusted source.
Multiple routes are not source independence.
A healthy source is not the correct chain.
Broadcast is not inclusion; inclusion is not finality.
A simulation is not a guarantee.

What this means in Free Beta

Most answers today are UNVERIFIED_RAW with a SOURCE_ONLY or SERVICE_LOCAL basis. The model is not aspirational — those values are what the API returns, and they are accurate. Higher trust classes require engine work per network, and the registry says which networks have it.