> ## Documentation Index > Fetch the complete documentation index at: https://darknyx.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. > A Merkle inclusion proof for one note commitment, for spending or withdrawing. # Inclusion Proof The sibling path proving a commitment sits in the tree. The SDK feeds this straight into the VALID\_INPUT and VALID\_SPEND circuits. This is an authenticated read. Complete [Transport & Attestation](../getting-started/transport-and-attestation.mdx) before sending the bearer token. ## OpenAPI ````yaml api-reference/openapi/darknyx-public.yaml GET /tree/inclusion openapi: 3.1.0 info: title: Darknyx TEE API version: 4.1.0 description: | Public + authenticated REST and WebSocket API for the Darknyx dark pool TEE matching layer. One attested endpoint may expose several independently routed spot markets. Pairs with the v2 on-chain custody program (vault, program ID `C63vKvysCzX55PKraas4Wc22ijqjGJQdPC1mrzCFVWZx`). contact: name: Darknyx engineering license: name: PolyForm Perimeter License 1.0.1 url: https://polyformproject.org/licenses/perimeter/1.0.1 servers: - url: https://api.darknyx.example.com description: Mainnet placeholder; use the origin published with a deployment. - url: https://api.devnet.darknyx.example.com description: Devnet placeholder; use the origin published with a deployment. security: [] tags: - name: auth description: OAuth2 client-credentials and bearer-token lifecycle. - name: attestation description: | Darknyx engine and transport attestation plus the deployment gateway's separate evidence bundle. Programmatic clients verify the certificate on their actual connection with `/transport-attestation` before any credential or sensitive write. `/evidences/*` describes surrounding ingress infrastructure and is not a substitute for the engine check. - name: info description: | Application/instance metadata, boot-session id, and settlement signers. Verify measured identity through `/attestation`, not self-reported fields. - name: instruments description: Public market metadata. - name: orders description: Place / cancel / modify / inspect orders. - name: system description: Public engine liveness + server time (GTT slot conversion). - name: account description: Per-account open orders and preferences. Balances remain client-derived. - name: tree description: >- Convenience Merkle-tree mirror; clients can verify the same state on Solana. - name: transparency description: Public solvency snapshot + engine identity + aggregate stats. - name: settlement description: Batch settlement status (TEE → L1 tx_signature lookup). paths: /tree/inclusion: get: tags: - tree summary: | Inclusion proof for a specific note commitment. description: | Replacement for `MerkleShadow.witness()`. Clients build VALID_SPEND / VALID_INPUT proofs against the returned siblings. The TEE-served inclusion proof is verifiable: re-hash the leaf + siblings up to the returned merkle_root, compare against the on-chain MerkleTree[tree_id].current_root, accept the proof only if both match. The TEE cannot lie about an inclusion proof without the client detecting it on Solana — so this is a fast convenience read, not a trust assertion. A mirror known to diverge fails closed with 503/code 5002. parameters: - name: commitment in: query required: true schema: type: string description: 32-byte hex note commitment. - name: tree_id in: query required: false schema: type: integer default: 0 description: Which Merkle shard the commitment lives in. Default 0. responses: '200': description: Inclusion proof. content: application/json: schema: $ref: '#/components/schemas/InclusionProof' '401': description: >- Missing / invalid / expired / revoked bearer token, or a token invalidated by the operator. content: application/json: schema: $ref: '#/components/schemas/Error' '403': description: The account is suspended. content: application/json: schema: $ref: '#/components/schemas/Error' '404': description: Commitment not in the tree. content: application/json: schema: $ref: '#/components/schemas/Error' '503': description: Mirror diverged from Solana (code 5002); use an on-chain tree read. content: application/json: schema: $ref: '#/components/schemas/Error' security: - BearerAuth: [] components: schemas: InclusionProof: type: object required: - note_commitment - leaf_index - merkle_root - siblings properties: note_commitment: type: string leaf_index: type: integer merkle_root: type: string siblings: type: array minItems: 20 maxItems: 20 items: type: string description: 32-byte hex. Error: type: object description: | The error envelope. Every non-2xx response renders as this shape, with the mapped HTTP status. Success responses are NOT enveloped (their typed body is returned directly). Every response — success and error — carries an `x-request-id` header for correlation with server logs. required: - code - message properties: code: type: integer description: | Stable numeric error code. Ranges: 1000–1099 request validation, 1100–1199 auth, 1200–1299 conflict, 1300–1399 not found, 1400–1499 rate limit, 5000+ server. See the Error Codes reference. One exception to the ranges: `1402` is returned with HTTP 503, not 429. It signals that credential verification is momentarily at capacity and was refused rather than queued. Branch on the numeric code rather than inferring the status from its range. example: 1102 message: type: string example: trading_key_signature does not verify against the canonical body securitySchemes: BearerAuth: type: http scheme: bearer bearerFormat: JWT description: | Short-lived (≤ 1h) bearer token from POST /auth/token. Expiry is EXACT — there is no grace period past `expires_in`, on REST or on the streaming transport. Refresh on a margin. A structurally valid, unexpired token is still refused when it has been revoked (401), when the operator has invalidated the tokens the account was holding (401), or when the account is suspended (403). Suspension also blocks issuing a new one, so re-authenticating does not clear it. ````