Source-cache availability.

Why expose a cache URL?

Source portals can be temporarily unavailable or move an archive to a new URL. A populated cache_url gives readers another address for that particular snapshot while the object remains available.

A DOGE-related policy change or another agency-system change is one possible access risk. This example does not mean a disruption has occurred, and it does not establish that a cached copy exists.

A cache URL is not evidence that the source is current, complete, or continuously monitored. It is also not a promise that every source or snapshot has been mirrored. Check the fields returned for the record you are using.

No universal 90-day retention policy

No platform-wide cache-retention promise applies; a 90-day retention window is not a platform-wide policy or promise. When populated, cache_cached_at and cache_retention_expires describe the cache record returned by /verify/[snapshot_id]. A null cache_url means that endpoint has no mirror address to offer for that snapshot.

Treat a populated expiry timestamp as descriptive metadata, not an SLA: an object may be unavailable because it expired, access policy changed, or the mirror was not created. Preserve required evidence in your own controlled storage when your retention policy demands it.

SHA-256 hash-match flow

Start with a record at /verify/[snapshot_id]. Continue only if it returns a populated content_hash and at least one download URL. The possible paths are:

1. Upstream path — when populated, fetch source_archive_url + shasum -a 256 + compare with content_hash.
2. Cache path — when populated, fetch cache_url + shasum -a 256 + compare to content_hash.

# Choose a snapshot id that exists in the public index.
RECORD=$(curl -s -H 'Accept: application/json' https://fonteum.com/verify/123)
EXPECTED=$(printf '%s' "$RECORD" | jq -r '.content_hash // empty')
URL=$(printf '%s' "$RECORD" | jq -r '.source_archive_url // .cache_url // empty')

# Stop when either field is absent; this record is not re-hashable from that URL.
[ -n "$EXPECTED" ] && [ -n "$URL" ] || exit 1

ACTUAL=$(curl -sL "$URL" | shasum -a 256 | awk '{print $1}')
[ "$ACTUAL" = "$EXPECTED" ] && echo "MATCH" || echo "MISMATCH"

A match means the downloaded bytes produce the recorded digest. It does not validate parsed rows, establish current source freshness, or supply a row-level signature.

Freshness is source-specific

Cache timestamps describe the alternate object, not the age of the loaded source data. The /freshness page reports source and load observations where they are available. As checked against production on July 12, 2026, the newest loaded NPPES system date was June 10, 2026; PECOS source date was June 18, 2026; OIG LEIE source date was May 8, 2026; supported Care Compare tables reported May 7, 2026; and PBJ reported June 30, 2025.

Those dates use source-specific fields and are not a shared daily, weekly, or monthly cadence. Check the named source observation before using a record; the existence of a cache URL does not make an older table current.

Operational limits

A populated cache_url is a best-effort alternate address, not durable-storage or availability assurance. Backend, access policy, and retention can vary by deployment and record.

If your workflow requires a fixed retention period, preserve the archive and its observed metadata in storage you control. Continue to follow the upstream publisher’s terms and treat a byte match as a digest comparison, not a statement about row completeness or current source status.

• /freshness — observed source/load dates and per-source limitations.
• /trust/integrity — public index for snapshot records that expose integrity metadata.
• /methodology/changelog — methodology version-bump log.
• /docs/source-coverage — source registry and source-specific coverage notes.