NFT verification

POST /api/wallet/verify-ownership checks connected BSV wallet addresses for the signed-in account's primary BAP profile. Use the authenticated Sigma UI/session context; this is not an unauthenticated public ownership oracle.

Request

{ "origin": "transaction-id_output-index", "minCount": 1 }

Or use an exact collection identifier:

{ "collection": "collection-identifier", "minCount": 1 }

Choose one selector. origin matches an NFT's origin outpoint or its collection ID; collection matches collection metadata. Passing both can lead to ambiguous counting in the current route. minCount is an NFT count, not a fungible token balance.

Response

A successful check includes owns and count, and can include matching nfts. With no connected wallets the response can be { owns: false, count: 0, message: ... }. Fields on upstream NFT objects are not a stable Sigma certificate schema.

The route paginates the upstream indexer in batches of 100. However, an upstream failure can be caught without a distinct error response, so a negative result can mean incomplete data. Treat it as insufficient evidence, allow a retry, and do not promise it proves absence.

Identity and authorization

The current implementation resolves the primary profile; sending a bapId in the body does not switch that lookup. A session cookie authenticates the user but does not turn returned JSON into a proof another service can trust.

For protected content, perform the check through a trusted backend integration and enforce access there. Do not accept a browser-submitted count, cache access forever, or treat a token transfer as an immediate event Sigma pushes to your application.