API

Free, no auth, CORS enabled. Base URL: https://api.blockbible.net

Endpoints

GET /v1/{ver}/verse?ref=John+3:16   verse + Merkle proof
GET /v1/{ver}/john/3/16             same, path form
GET /v1/{ver}/john/3                whole chapter (no proofs)
GET /v1/{ver}/random/verse          uniform-random verse, with proof
GET /v1/{ver}/random/chapter        uniform-random chapter
GET /v1/{ver}/books                 66 books with chapter counts
GET /v1/{ver}/root                  Merkle root + Bitcoin anchor status

{ver} is kjv (King James Version) or web (World English Bible) — each sealed under its own Merkle root. Book names are forgiving: john, 1co, psalm, song+of+songs all resolve. The WEB omits four verses its Greek sources lack (Luke 17:36, Acts 8:37, 15:34, 24:7) and numbers the Romans doxology 14:24–26, so a handful of KJV references 404 under web and vice versa.

Verse response

{
  "translation": "KJV",
  "ref": "John 3:16",
  "book": "John", "book_num": 43, "chapter": 3, "verse": 16,
  "text": "For God so loved the world, …",
  "canonical": "<exact bytes that were hashed — see spec>",
  "hash": "<sha256 of canonical, hex>",
  "leaf_index": 26136,
  "proof": [
    { "pos": "right", "hash": "<sibling hash, hex>" },
    … one per tree level …
  ],
  "merkle_root": "b582b85df0c86c09e9fd31bb4e02c7d385911ccc43db964ca6fcea6edb23f261",
  "verse_count": 31102,
  "spec": "v1"
}

Verifying a proof

Hash the canonical bytes, then fold in each proof step in order. pos says which side the sibling goes on:

h = sha256(canonical)
for step in proof:
    h = sha256(h + step.hash)  if step.pos == "right"
        sha256(step.hash + h)  otherwise        # raw 32-byte digests
assert h == merkle_root

Each translation's root is anchored in Bitcoin via OpenTimestamps (the KJV in block 956957) — GET /v1/{ver}/root returns the anchor details, and the .ots proofs are published at blockbible.net/kjv-root.txt.ots and blockbible.net/web-root.txt.ots. So a successful proof means: this exact text was part of the Bible that was sealed — no trust in this API required.