Evidence API Reference

Operations

GET /anchors

Responses:

POST /anchors

Responses:

GET /anchors/{anchorId}

Parameters:

Responses:

DELETE /anchors/{anchorId}

Parameters:

Responses:

PATCH /anchors/{anchorId}

Parameters:

Responses:

POST /anchors/{anchorId}/revoke-key

Parameters:

Responses:

GET /api/evidence/v1/attestations

Lists attestation entries inside the authenticated tenant with optional filters and a continuation token. Missing tenant claims fail closed. Requires attest:read or attest:create scope.

Responses:

GET /api/evidence/v1/attestations/{uuid}

Retrieves an attestation entry by UUID, including inclusion proof, checkpoint, artifact metadata, and optional mirror status. Equivalent to the Rekor entry endpoint but accessed by attestor UUID alias. Requires attestor:read scope.

Parameters:

Responses:

POST /api/evidence/v1/attestations:export

Exports exact retained attestation envelopes inside the authenticated tenant by UUID or filters. Missing tenant claims fail closed. Metadata-only entries explicitly identify unavailable archive bytes. Requires attest:read or attest:create scope.

Responses:

POST /api/evidence/v1/attestations:export-build

Exports supported build, invocation, configuration-source, and timestamp fields as an unsigned SPDX 3.0.1 Build Profile document. Signing, DSSE, builder, and material mappings return 501 until their live integration is implemented. Requires attest:create scope.

Responses:

POST /api/evidence/v1/attestations:import

Imports a portable bundle only inside the authenticated tenant; a foreign-tenant entry refuses the entire package before writes. Reported-CI provenance and Policy release-set verdicts require verified producer admission and cannot use this import path. Returns imported/skipped counts. Requires attest:create scope.

Responses:

POST /api/evidence/v1/attestations:sign

Signs an attestation payload using the configured key; recording is a separate submission. SLSA v1 binds the authenticated producer separately from reported lineage. Policy release-set statements require complete evaluated inputs, the authenticated Policy producer and the existing verdict authority roster. Requires attest:create scope.

Responses:

POST /api/evidence/v1/attestor/links

Creates and signs an in-toto link metadata object for a named step, including materials, products, command, environment, and return value. Returns the signed DSSE envelope with optional Rekor entry. Requires attestor:write scope.

Responses:

POST /api/evidence/v1/bundles/{bundleId}/export

Trigger an async evidence bundle export

Enqueues an asynchronous export job for a specific evidence bundle. Returns 202 Accepted with the export job ID and a status polling URL. Returns 404 if the bundle ID is not registered.

Parameters:

Responses:

GET /api/evidence/v1/bundles/{bundleId}/export/{exportId}

Get export status or download exported bundle

Returns the current status of an evidence bundle export job. Returns 200 with the export manifest when complete, or 202 if the export is still in progress. Returns 404 if the export ID is not found.

Parameters:

Responses:

GET /api/evidence/v1/bundles/{bundleId}/export/{exportId}/download

Download the exported bundle

Streams the completed evidence bundle as a gzip-compressed archive. Returns 409 Conflict if the export is still in progress. Returns 404 if the export ID is not found.

Parameters:

Responses:

GET /api/evidence/v1/evidence

Get evidence home summary and quick links.

Returns an evidence home dashboard summary including quick stats for the last 24 hours/7 days/30 days (new packs, sealed bundles, failed verifications, trust alerts) and lists of latest packs and failed verifications.

Responses:

GET /api/evidence/v1/evidence/by-release/{releaseId}/portable

Resolve a release id to its sealed decision bundle and download the portable, offline-verifiable audit pack.

Parameters:

Responses:

POST /api/evidence/v1/evidence/capsules

Create a new (unsealed) decision capsule

Assembles an unsealed capsule manifest from SBOM/reachability/policy/VEX references and returns the content-addressed, deterministic manifest.

Responses:

GET /api/evidence/v1/evidence/capsules/signing-keys/jwks

Publish the capsule-seal verification key(s) (JWKS) for fully-offline DSSE verification.

Returns the public JSON Web Key Set for the EvidenceLocker capsule-seal signing key(s). An air-gapped operator can verify a sealed decision capsule’s DSSE signature offline against these keys without contacting the stack. During a signing-root rotation the set DUAL-PUBLISHES the retiring and active keys (ADR-028 D3); archived keys retained for immutable / transparency-anchored material remain published verify-only (D2). No private key material is exposed.

Responses:

POST /api/evidence/v1/evidence/capsules/tlpt-packs

Assemble and sign a DORA TLPT evidence pack capsule

Assembles a deterministic tlpt-evidence-pack.v1 capsule and records pack hash, signer, retention, capsule, and ledger identifiers in the audit trail.

Responses:

GET /api/evidence/v1/evidence/capsules/{capsuleId}

Get a decision capsule by id from the EvidenceLocker capsule store

Returns the sealed/unsealed decision capsule (manifest, signing status, sealed-at, verification memory, retention) from evidence_locker.decision_capsules. Returns 404 (never 500) for an unknown id. This is the capsule-native read the console capsule route must use instead of the AdvisoryAI evidence-pack store.

Parameters:

Responses:

POST /api/evidence/v1/evidence/capsules/{capsuleId}/export

Export a capsule as a downloadable zip bundle

Produces a zip containing manifest.json, manifest.dsse.json (if sealed), assembly-inputs.json, and metadata.json.

Parameters:

Responses:

POST /api/evidence/v1/evidence/capsules/{capsuleId}/replay

Reconstruct the verdict from a sealed capsule

Reads back the sealed manifest, recomputes the content hash, and returns the reconstructed verdict and summary.

Parameters:

Responses:

POST /api/evidence/v1/evidence/capsules/{capsuleId}/seal

Seal a capsule by signing its canonical manifest

Canonicalises the capsule manifest and produces a DSSE envelope via the registered signer. Gracefully degrades to an unsigned sealed capsule when no signer is available.

Parameters:

Responses:

POST /api/evidence/v1/evidence/capsules/{capsuleId}/verify

Verify a sealed capsule’s content hash and DSSE signature

Recomputes the canonical content hash and validates the DSSE envelope (when present). Returns a structured verdict.

Parameters:

Responses:

POST /api/evidence/v1/evidence/hold/{caseId}

Create a legal hold for the specified case identifier.

Parameters:

Responses:

POST /api/evidence/v1/evidence/legacy-capsule-erasure-refusals/{actorRef}

Evaluate immutable legacy capsules after mutable actor erasure.

Parameters:

Responses:

GET /api/evidence/v1/evidence/packs

List evidence packs.

Lists all registered evidence packs for the authenticated tenant, with release ID, environment, bundle version, seal status, and creation timestamp.

Responses:

GET /api/evidence/v1/evidence/packs/{id}

Get evidence pack detail.

Returns the full detail record for a tenant-owned evidence pack including all artifact references, promotion run ID, manifest digest, release decision, and proof chain ID. Returns 404 if the pack ID is not registered for the authenticated tenant.

Parameters:

Responses:

POST /api/evidence/v1/evidence/qa/assurance-cases/{caseId}/readback-import

QA-only case-bound readback/import proof for evidence-pack-golden-assurance-001; does not claim legal compliance, regulator submission, or live external verification.

Parameters:

Responses:

GET /api/evidence/v1/evidence/score

Get deterministic evidence score by artifact identifier.

Parameters:

Responses:

POST /api/evidence/v1/evidence/snapshot

Create a new evidence snapshot for the tenant.

Seal the supplied material digests and metadata as a new evidence bundle (201). With an Idempotency-Key header (letters, digits, ‘.’, ‘_’, ‘-’, ‘:’; at most 200 characters) the request is bound to that key in the caller’s tenant: a retry with the same key and request returns the first bundle, root hash and stored signature (200, replayed: true) without sealing another bundle; the same key with a different request is refused (409 idempotency_key_conflict) and the first bundle is unchanged. Keys of another tenant are never visible. Without the header every request seals a new bundle.

Parameters:

Responses:

GET /api/evidence/v1/evidence/thread

List evidence threads matching a PURL

Lists all Artifact Canonical Records whose PURL matches the provided query parameter. Returns a paginated summary with per-thread attestation counts. The purl parameter is required.

Parameters:

Responses:

GET /api/evidence/v1/evidence/thread/{canonicalId}

Retrieve the evidence thread for an artifact by canonical_id

Returns the Artifact Canonical Record for an artifact identified by its canonical ID, including format, artifact digest, PURL, and associated DSSE attestations ordered by signing timestamp. Use include_attestations=false to suppress the attestation list.

Parameters:

Responses:

POST /api/evidence/v1/evidence/verify

Responses:

GET /api/evidence/v1/evidence/{bundleId}

Parameters:

Responses:

GET /api/evidence/v1/evidence/{bundleId}/chain

Walk the supersede chain for an evidence bundle, oldest-first.

Parameters:

Responses:

GET /api/evidence/v1/evidence/{bundleId}/download

Parameters:

Responses:

GET /api/evidence/v1/evidence/{bundleId}/portable

Download a sealed, portable evidence bundle for sealed or air-gapped distribution.

Parameters:

Responses:

GET /api/evidence/v1/proofs/id/{proofId}

Parameters:

Responses:

GET /api/evidence/v1/proofs/id/{proofId}/verify

Parameters:

Responses:

GET /api/evidence/v1/proofs/{subjectDigest}

Parameters:

Responses:

GET /api/evidence/v1/proofs/{subjectDigest}/chain

Parameters:

Responses:

GET /api/evidence/v1/regulatory/artifact-ledger

Query tenant-scoped regulatory artifact ledger records

Returns EvidenceLocker-owned regulatory artifact ledger records for tenant/regime/artifact-type/year lookups. Use requireMatch=true when the caller needs fail-closed lookup semantics.

Parameters:

Responses:

POST /api/evidence/v1/rekor/entries

Submits an attestation entry to the configured transparency log under the authenticated tenant. SLSA provenance and Policy release-set statements require configured signature verification and exportable archive bytes before success. Returns UUID, log index and inclusion proof. Requires attest:create scope.

Responses:

POST /api/evidence/v1/rekor/entries/proof-backfill

Re-derive and persist oriented inclusion proofs for existing included entries so pre-orientation-fix entries verify without ?refresh=true. Requires attestor:write scope.

Parameters:

Responses:

GET /api/evidence/v1/rekor/entries/{uuid}

Retrieves a Rekor transparency log entry by UUID, including inclusion proof, checkpoint, and artifact metadata. Set refresh=true to bypass cache and fetch the latest state from Rekor. Requires attestor:read scope.

Parameters:

Responses:

POST /api/evidence/v1/rekor/verify

Verifies an attestation against the Rekor transparency log, checking inclusion proof, checkpoint consistency, and signature validity. Returns a structured verification result with per-check diagnostics. Requires attestor:verify scope.

Responses:

POST /api/evidence/v1/rekor/verify:bulk

Enqueues a bulk attestation verification job for processing multiple entries asynchronously. Returns 202 Accepted with the job ID and a polling URL. Queue depth is enforced by quota configuration. Requires attestor:write scope.

Responses:

GET /api/evidence/v1/rekor/verify:bulk/{jobId}

Returns the current status and results of a bulk attestation verification job by job ID. The job is only visible to the principal that submitted it. Returns 404 for unknown or unauthorized job IDs. Requires attestor:write scope.

Parameters:

Responses:

GET /api/evidence/v1/runs/{runId}/verdicts

List verdict attestations for a policy run

Lists all verdict attestations associated with a specific policy run ID. Returns a paginated collection ordered by creation time. Returns 404 if the run ID is not found.

Parameters:

Responses:

GET /api/evidence/v1/timestamp-assurance/evidence/{bundleId}

One capsule’s stored-timestamp facts and its local evidentiary classification, for the caller’s tenant. Requires evidence:read.

Parameters:

Responses:

GET /api/evidence/v1/timestamp-assurance/providers

Configured timestamp providers: ids, endpoint hosts, requirement and whether a credential reference is configured — never the credential. Requires ops.health.

Responses:

POST /api/evidence/v1/timestamp-assurance/runs

Evaluates the five tenant-scoped Timestamp Assurance checks over the caller’s tenant now and records the run durably; idempotent on idempotencyKey. Requires evidence:create.

Responses:

GET /api/evidence/v1/timestamp-assurance/runs/{runId}

One durable Timestamp Assurance run of the caller’s tenant. Requires evidence:read.

Parameters:

Responses:

GET /api/evidence/v1/timestamp-assurance/status

Latest five tenant-scoped Timestamp Assurance results for the caller’s tenant plus a bounded installation posture. Requires evidence:read.

Responses:

GET /api/evidence/v1/transparency/exchange/batches

Lists manual schedule/import and connected-sync batch status metadata without returning package bytes. Requires attestor:read scope.

Parameters:

Responses:

GET /api/evidence/v1/transparency/exchange/batches/{batchId}

Gets manual schedule/import or connected-sync batch status metadata by batch id. Requires attestor:read scope.

Parameters:

Responses:

POST /api/evidence/v1/transparency/exchange/imports:apply

Validates and applies a returned external transparency import file, attaching mirror receipts only to matching local entries. Requires attestor:write scope.

Responses:

POST /api/evidence/v1/transparency/exchange/imports:validate

Validates a returned external transparency import file before sealed-site apply. Requires attestor:write scope.

Responses:

POST /api/evidence/v1/transparency/exchange/relay-imports

Validates a schedule file and produces a deterministic signed import file containing external mirror receipts. Requires attestor:write scope.

Responses:

POST /api/evidence/v1/transparency/exchange/schedules

Creates a deterministic manual schedule file for sealed-site external transparency mirror exchange. Requires attestor:write scope.

Responses:

GET /api/evidence/v1/transparency/external-sync/reports

Lists connected-window external transparency sync reports for CLI/UI readback. Requires attestor:read scope.

Parameters:

Responses:

GET /api/evidence/v1/transparency/external-sync/reports/{batchId}

Gets one connected-window external transparency sync report by batch id. Requires attestor:read scope.

Parameters:

Responses:

POST /api/evidence/v1/transparency/external-sync:run

Runs a bounded connected-window sync from Stella local transparency receipts to configured external Rekor-compatible mirror targets. The worker remains separately disabled unless explicitly enabled. Requires attestor:write scope.

Responses:

GET /api/evidence/v1/transparency/local

Returns the installation-wide state of the Stella local transparency log: enabled, origin, log URL, whether checkpoints are signed, tree size and last checkpoint time. The additive externalSync block reports whether external sync is enabled and the caller tenant’s enabled external mirror target count; it never changes the local state. A store failure answers 503, never a disabled log. Requires attestor:read scope.

Responses:

GET /api/evidence/v1/transparency/targets

Lists operator-approved external transparency mirror targets with per-target status. Requires attestor:read scope.

Parameters:

Responses:

POST /api/evidence/v1/transparency/targets

Creates or updates an operator-approved external transparency target. The API stores only endpoint metadata and secret references, never raw credentials. Requires attestor:write scope.

Responses:

GET /api/evidence/v1/transparency/targets/{targetId}

Gets one external transparency mirror target with status counters and last error metadata. Requires attestor:read scope.

Parameters:

Responses:

POST /api/evidence/v1/transparency/targets/{targetId}:disable

Disables an existing external transparency target. Existing local transparency receipts remain authoritative. Requires attestor:write scope.

Parameters:

Responses:

POST /api/evidence/v1/transparency/targets/{targetId}:enable

Enables an existing external transparency target for connected sync or manual exchange selection. Requires attestor:write scope.

Parameters:

Responses:

POST /api/evidence/v1/verdicts

Store a verdict attestation

Persists a verdict attestation record, including the policy run ID, policy ID, finding ID, decision, and DSSE envelope. Returns the stored verdict ID and creation timestamp. Requires write authorization.

Responses:

GET /api/evidence/v1/verdicts/{verdictId}

Retrieve a verdict attestation by ID

Returns the full verdict attestation record for the given verdict ID, including policy metadata, finding reference, decision, and the DSSE envelope. Returns 404 if the verdict ID is not found.

Parameters:

Responses:

GET /api/evidence/v1/verdicts/{verdictId}/envelope

Download DSSE envelope for verdict

Returns the raw DSSE envelope JSON for a specific verdict attestation. Used to retrieve the full envelope for offline verification or replay. Returns 404 if the verdict ID is not found.

Parameters:

Responses:

POST /api/evidence/v1/verdicts/{verdictId}/verify

Verify verdict attestation signature

Verifies the DSSE envelope signature of a verdict attestation, confirming the signing key ID and signature integrity. Returns a structured result with isValid flag and per-step diagnostics. Returns 404 if the verdict ID is not found.

Parameters:

Responses:

GET /api/evidence/v1/watchlist

List watchlist entries

Returns all watchlist entries for the tenant, optionally including global entries.

Parameters:

Responses:

POST /api/evidence/v1/watchlist

Create watchlist entry

Creates a new watchlist entry for monitoring identity appearances.

Responses:

GET /api/evidence/v1/watchlist/{id}

Get watchlist entry

Returns a single watchlist entry by ID.

Parameters:

Responses:

PUT /api/evidence/v1/watchlist/{id}

Update watchlist entry

Updates an existing watchlist entry.

Parameters:

Responses:

DELETE /api/evidence/v1/watchlist/{id}

Delete watchlist entry

Deletes a watchlist entry.

Parameters:

Responses:

POST /api/evidence/v1/watchlist/{id}/test

Test watchlist pattern

Tests if a sample identity matches the watchlist entry pattern.

Parameters:

Responses:

GET /api/v1/attestor/predicates

List all registered predicate types

Returns a paginated list of registered in-toto predicate type schemas from the registry, with optional filters by category and active status. Used to discover supported predicate URIs for attestation creation.

Parameters:

Responses:

GET /api/v1/attestor/predicates/{uri}

Get predicate type schema by URI

Retrieves the full schema definition for a predicate type identified by its URI. The URI must be URL-encoded when passed as a path segment. Returns 404 if the predicate type is not registered.

Parameters:

Responses:

GET /doctor/evidence/checks

Responses:

GET /health/ready

Responses:

POST /internal/api/v1/attestations/verdict

Responses:

GET /proofs/{entry}/receipt

Parameters:

Responses:

GET /proofs/{entry}/spine

Parameters:

Responses:

POST /proofs/{entry}/spine

Parameters:

Responses:

GET /proofs/{entry}/vex

Parameters:

Responses:

GET /verify/envelope/{envelopeHash}

Parameters:

Responses:

GET /verify/rekor/{envelopeHash}

Parameters:

Responses:

POST /verify/{proofBundleId}

Parameters:

Responses: