Evidence Locker API Reference

Operations

GET /api/v1/buildinfo

API alias for /buildinfo.json (same payload).

Responses:

POST /api/v1/bundles/{bundleId}/export

Trigger an async evidence bundle export

Enqueues an asynchronous export job for a specific evidence bundle. Returns 202 Accepted with the export job ID and a status polling URL. Returns 404 if the bundle ID is not registered.

Parameters:

Responses:

GET /api/v1/bundles/{bundleId}/export/{exportId}

Get export status or download exported bundle

Returns the current status of an evidence bundle export job. Returns 200 with the export manifest when complete, or 202 if the export is still in progress. Returns 404 if the export ID is not found.

Parameters:

Responses:

GET /api/v1/bundles/{bundleId}/export/{exportId}/download

Download the exported bundle

Streams the completed evidence bundle as a gzip-compressed archive. Returns 409 Conflict if the export is still in progress. Returns 404 if the export ID is not found.

Parameters:

Responses:

GET /api/v1/evidence

Get evidence home summary and quick links.

Returns an evidence home dashboard summary including quick stats for the last 24 hours/7 days/30 days (new packs, sealed bundles, failed verifications, trust alerts) and lists of latest packs and failed verifications.

Responses:

GET /api/v1/evidence/audit

Get unified evidence audit log slice.

Returns a paginated slice of the unified evidence audit log showing export, pack, and trust events. Use the limit query parameter (max 200) to control page size.

Parameters:

Responses:

POST /api/v1/evidence/capsules

Create a new (unsealed) decision capsule

Assembles an unsealed capsule manifest from SBOM/reachability/policy/VEX references and returns the content-addressed, deterministic manifest.

Responses:

GET /api/v1/evidence/capsules/{capsuleId}

Get a decision capsule by id from the EvidenceLocker capsule store

Returns the sealed/unsealed decision capsule (manifest read projection, signing status, sealed-at, verification memory, regulatory retention) from evidence_locker.decision_capsules. This is the capsule-native read the console capsule route uses instead of the AdvisoryAI evidence-pack store; an unknown id returns 404 (never 500). Response carries lastVerifiedAt / lastVerifiedBy / lastVerifiedStatus (verification memory) so an auditor can cite when/by whom the capsule was last checked. Only status ok, produced by a successful signature and content-hash verification, supports a durable PROVEN presentation after reload.

For pii_policy_version = 0, ordinary GET never returns the stored signed manifest_json bytes. manifestJson is a marked, non-canonical legacy projection and legacyPiiSuppressed=true; detected PII-shaped scalars are tomb-stoned, and malformed, empty, whitespace-only, or non-object legacy manifests fail closed to a fixed suppression projection. Raw canonical bytes remain available only through the separately authorized and audited break-glass path.

Responses:

POST /api/v1/evidence/capsules/tlpt-packs

Assemble and sign a DORA TLPT evidence pack capsule

Assembles a deterministic tlpt-evidence-pack.v1 capsule and records pack hash, signer, retention, capsule, and ledger identifiers in the audit trail.

Responses:

POST /api/v1/evidence/capsules/{capsuleId}/export

Export a capsule as a downloadable zip bundle

Produces a zip containing manifest.json, manifest.dsse.json (if sealed), assembly-inputs.json, and metadata.json.

Parameters:

Responses:

POST /api/v1/evidence/capsules/{capsuleId}/replay

Reconstruct the verdict from a sealed capsule

Reads back the sealed manifest, recomputes the content hash, and returns the reconstructed verdict and summary.

Parameters:

Responses:

POST /api/v1/evidence/capsules/{capsuleId}/seal

Seal a capsule by signing its canonical manifest

Canonicalises the capsule manifest and produces a DSSE envelope via the registered signer. Gracefully degrades to an unsigned sealed capsule when no signer is available.

Parameters:

Responses:

POST /api/v1/evidence/capsules/{capsuleId}/verify

Verify a sealed capsule’s content hash and DSSE signature

Recomputes the canonical content hash and validates the DSSE envelope (when present). Returns a structured verdict. The result is persisted as verification memory (last_verified_at / last_verified_by / last_verified_status on the capsule row, and echoed as lastVerifiedAt / lastVerifiedBy / lastVerifiedStatus in the response); GET /api/v1/evidence/capsules/{capsuleId} returns the same memory. A UI may restore PROVEN after reload only when that authoritative memory status is ok; unsigned, unsealed, invalid, failed, missing, or transport-error states remain explicitly not proven or unknown.

Parameters:

Responses:

GET /api/v1/evidence/packs

List evidence packs.

Lists all registered evidence packs for the authenticated tenant, with release ID, environment, bundle version, seal status, and creation timestamp.

Responses:

GET /api/v1/evidence/packs/{id}

Get evidence pack detail.

Returns the full detail record for a tenant-owned evidence pack including all artifact references, promotion run ID, manifest digest, release decision, and proof chain ID. Returns 404 if the pack ID is not registered for the authenticated tenant.

Parameters:

Responses:

GET /api/v1/evidence/proofs/{subjectDigest}

Get proof chain by subject digest.

Returns the proof chain record for an evidence artifact identified by its subject digest, including DSSE envelope reference, Rekor entry URL, and verification timestamp. Returns 404 if no proof chain exists for the digest.

Parameters:

Responses:

GET /api/v1/evidence/receipts/cvss/{id}

Get CVSS receipt by vulnerability id.

Returns the CVSS scoring receipt for a specific vulnerability ID, including base score, CVSS vector, scoring timestamp, and source. Returns 404 if no receipt is on file for the vulnerability.

Parameters:

Responses:

GET /api/v1/evidence/thread

List evidence threads matching a PURL

Lists all Artifact Canonical Records whose PURL matches the provided query parameter. Returns a paginated summary with per-thread attestation counts. The purl parameter is required.

Parameters:

Responses:

GET /api/v1/evidence/thread/{canonicalId}

Retrieve the evidence thread for an artifact by canonical_id

Returns the Artifact Canonical Record for an artifact identified by its canonical ID, including format, artifact digest, PURL, and associated DSSE attestations ordered by signing timestamp. Use include_attestations=false to suppress the attestation list.

Parameters:

Responses:

GET /api/v1/regulatory/artifact-ledger

Query tenant-scoped regulatory artifact ledger records

Returns EvidenceLocker-owned regulatory artifact ledger records for tenant/regime/artifact-type/year lookups. Use requireMatch=true when the caller needs fail-closed lookup semantics.

Parameters:

Responses:

GET /api/v1/runs/{runId}/verdicts

List verdict attestations for a policy run

Lists all verdict attestations associated with a specific policy run ID. Returns a paginated collection ordered by creation time. Returns 404 if the run ID is not found.

Parameters:

Responses:

POST /api/v1/verdicts

Store a verdict attestation

Persists a verdict attestation record, including the policy run ID, policy ID, finding ID, decision, and DSSE envelope. Returns the stored verdict ID and creation timestamp. Requires write authorization.

Responses:

GET /api/v1/verdicts/{verdictId}

Retrieve a verdict attestation by ID

Returns the full verdict attestation record for the given verdict ID, including policy metadata, finding reference, decision, and the DSSE envelope. Returns 404 if the verdict ID is not found.

Parameters:

Responses:

GET /api/v1/verdicts/{verdictId}/envelope

Download DSSE envelope for verdict

Returns the raw DSSE envelope JSON for a specific verdict attestation. Used to retrieve the full envelope for offline verification or replay. Returns 404 if the verdict ID is not found.

Parameters:

Responses:

POST /api/v1/verdicts/{verdictId}/verify

Verify verdict attestation signature

Verifies the DSSE envelope signature of a verdict attestation, confirming the signing key ID and signature integrity. Returns a structured result with isValid flag and per-step diagnostics. Returns 404 if the verdict ID is not found.

Parameters:

Responses:

GET /buildinfo.json

Image build provenance (module, gitSha, gitCommitTime, imageBuiltAt, branch) for drift detection.

Responses:

POST /evidence

Ingest producer gate artifact evidence and compute deterministic evidence score.

Responses:

POST /evidence/hold/{caseId}

Create a legal hold for the specified case identifier.

Parameters:

Responses:

POST /evidence/qa/assurance-cases/{caseId}/readback-import

QA-only case-bound readback/import proof for evidence-pack-golden-assurance-001; does not claim legal compliance, regulator submission, or live external verification.

Parameters:

Responses:

GET /evidence/score

Get deterministic evidence score by artifact identifier.

Parameters:

Responses:

POST /evidence/snapshot

Create a new evidence snapshot for the tenant.

Responses:

POST /evidence/verify

Responses:

GET /evidence/{bundleId}

Parameters:

Responses:

GET /evidence/{bundleId}/chain

Walk the supersede chain for an evidence bundle, oldest-first.

Parameters:

Responses:

GET /evidence/{bundleId}/download

Parameters:

Responses:

GET /evidence/{bundleId}/portable

Download a sealed, portable evidence bundle for sealed or air-gapped distribution.

Parameters:

Responses: