Offlinekit API Reference

Field	Value
Source spec	`offlinekit/openapi/v1.json`
OpenAPI version	`3.1.1`
API version	`1.0.0`
Operations	76
Path filter	All paths

Operations

`GET /api/offlinekit/v1/audit-bundles`

List audit bundles

Returns audit bundles, optionally filtered by subject or status.

Property	Value
Operation ID	`ListAuditBundles`
Tags	`Audit Bundles`
Auth	Not declared
Request body	-

Parameters:

Name	In	Required
`continuationToken`	`query`	no
`limit`	`query`	no
`status`	`query`	no
`subjectName`	`query`	no

Responses:

Status	Description	Content types
`200`	OK	`application/json`

`POST /api/offlinekit/v1/audit-bundles`

Create an immutable audit bundle

Creates a new audit bundle containing vulnerability reports, VEX decisions, policy evaluations, and attestations for a subject artifact.

Property	Value
Operation ID	`CreateAuditBundle`
Tags	`Audit Bundles`
Auth	Not declared
Request body	-

Responses:

Status	Description	Content types
`202`	Accepted	`application/json`
`400`	Bad Request	`application/json`

`GET /api/offlinekit/v1/audit-bundles/{bundleId}`

Get audit bundle status

Returns the status and details of a specific audit bundle.

Property	Value
Operation ID	`GetAuditBundle`
Tags	`Audit Bundles`
Auth	Not declared
Request body	-

Parameters:

Name	In	Required	Description
`bundleId`	`path`	yes

Responses:

Status	Description	Content types
`200`	OK	`application/json`
`404`	Not Found	-

`GET /api/offlinekit/v1/audit-bundles/{bundleId}/download`

Download audit bundle

Downloads the completed audit bundle as a ZIP file with integrity verification.

Property	Value
Operation ID	`DownloadAuditBundle`
Tags	`Audit Bundles`
Auth	Not declared
Request body	-

Parameters:

Name	In	Required	Description
`bundleId`	`path`	yes

Responses:

Status	Description	Content types
`200`	OK	-
`404`	Not Found	-
`409`	Conflict	-
`503`	Service Unavailable	`application/json`

`GET /api/offlinekit/v1/audit-bundles/{bundleId}/index`

Get audit bundle index

Returns the index manifest of a completed audit bundle.

Property	Value
Operation ID	`GetAuditBundleIndex`
Tags	`Audit Bundles`
Auth	Not declared
Request body	-

Parameters:

Name	In	Required	Description
`bundleId`	`path`	yes

Responses:

Status	Description	Content types
`200`	OK	`application/json`
`404`	Not Found	-

`GET /api/offlinekit/v1/exports/assurance/profiles`

List framework-aware Assurance export profiles.

Property	Value
Operation ID	`ListAssuranceExportProfiles`
Tags	`Assurance Exports`
Auth	Not declared
Request body	-

Parameters:

Name	In	Required	Description
`frameworkId`	`query`	no

Responses:

Status	Description	Content types
`200`	OK	-

`GET /api/offlinekit/v1/exports/assurance/profiles/{profileId}`

Get a framework-aware Assurance export profile.

Property	Value
Operation ID	`GetAssuranceExportProfile`
Tags	`Assurance Exports`
Auth	Not declared
Request body	-

Parameters:

Name	In	Required	Description
`profileId`	`path`	yes

Responses:

Status	Description	Content types
`200`	OK	-

`GET /api/offlinekit/v1/exports/assurance/profiles/{profileId}/readiness`

Get fail-closed readiness for an Assurance export profile.

Property	Value
Operation ID	`GetAssuranceExportReadiness`
Tags	`Assurance Exports`
Auth	Not declared
Request body	-

Parameters:

Name	In	Required	Description
`profileId`	`path`	yes

Responses:

Status	Description	Content types
`200`	OK	-

`POST /api/offlinekit/v1/exports/assurance/profiles/{profileId}/runs`

Produce a signed, deterministic Assurance bundle. Fail-closed on blocked readiness or missing source contracts.

Property	Value
Operation ID	`ProduceAssuranceExportBundle`
Tags	`Assurance Exports`
Auth	Not declared
Request body	`application/json`

Parameters:

Name	In	Required	Description
`profileId`	`path`	yes

Responses:

Status	Description	Content types
`200`	OK	-

`GET /api/offlinekit/v1/exports/assurance/profiles/{profileId}/runs/{runId}`

Read an Assurance export produce run.

Property	Value
Operation ID	`GetAssuranceExportRun`
Tags	`Assurance Exports`
Auth	Not declared
Request body	-

Parameters:

Name	In	Required	Description
`profileId`	`path`	yes
`runId`	`path`	yes

Responses:

Status	Description	Content types
`200`	OK	-

`GET /api/offlinekit/v1/exports/assurance/runs/{runId}/bundle`

Download a produced Assurance bundle.

Property	Value
Operation ID	`DownloadAssuranceExportBundle`
Tags	`Assurance Exports`
Auth	Not declared
Request body	-

Parameters:

Name	In	Required	Description
`runId`	`path`	yes

Responses:

Status	Description	Content types
`200`	OK	-

`GET /api/offlinekit/v1/exports/attestations/{attestationId}`

Get attestation by ID

Returns the DSSE attestation envelope for the specified attestation ID.

Property	Value
Operation ID	`GetAttestationById`
Tags	`Attestations`
Auth	Not declared
Request body	-

Parameters:

Name	In	Required	Description
`X-Tenant-Id`	`header`	no
`attestationId`	`path`	yes

Responses:

Status	Description	Content types
`200`	OK	`application/json`
`404`	Not Found	-

`GET /api/offlinekit/v1/exports/exceptions`

List exception reports

Lists all exception report jobs for the current tenant.

Property	Value
Operation ID	-
Tags	`Exception Reports`
Auth	Not declared
Request body	-

Parameters:

Name	In	Required	Description
`limit`	`query`	no

Responses:

Status	Description	Content types
`200`	OK	-

`POST /api/offlinekit/v1/exports/exceptions`

Create exception report

Starts async generation of an audit-compliant exception report.

Property	Value
Operation ID	-
Tags	`Exception Reports`
Auth	Not declared
Request body	`application/json`

Responses:

Status	Description	Content types
`200`	OK	-

`GET /api/offlinekit/v1/exports/exceptions/{jobId}`

Get report status

Gets the status of an exception report generation job.

Property	Value
Operation ID	-
Tags	`Exception Reports`
Auth	Not declared
Request body	-

Parameters:

Name	In	Required	Description
`jobId`	`path`	yes

Responses:

Status	Description	Content types
`200`	OK	-

`GET /api/offlinekit/v1/exports/exceptions/{jobId}/download`

Download report

Downloads the completed exception report.

Property	Value
Operation ID	-
Tags	`Exception Reports`
Auth	Not declared
Request body	-

Parameters:

Name	In	Required	Description
`jobId`	`path`	yes

Responses:

Status	Description	Content types
`200`	OK	-

`GET /api/offlinekit/v1/exports/nis2/soa/profile`

Discover the active NIS2 Statement of Applicability export profile.

Property	Value
Operation ID	`GetNis2SoaExportProfile`
Tags	`NIS2 SoA Exports`
Auth	Not declared
Request body	-

Responses:

Status	Description	Content types
`200`	OK	-

`POST /api/offlinekit/v1/exports/nis2/soa/runs`

Create a signed NIS2 Statement of Applicability export run.

Property	Value
Operation ID	`StartNis2SoaExportRun`
Tags	`NIS2 SoA Exports`
Auth	Not declared
Request body	`application/json`

Responses:

Status	Description	Content types
`200`	OK	-

`GET /api/offlinekit/v1/exports/nis2/soa/runs/{runId}`

Read a NIS2 Statement of Applicability export run.

Property	Value
Operation ID	`GetNis2SoaExportRun`
Tags	`NIS2 SoA Exports`
Auth	Not declared
Request body	-

Parameters:

Name	In	Required	Description
`runId`	`path`	yes

Responses:

Status	Description	Content types
`200`	OK	-

`GET /api/offlinekit/v1/exports/nis2/soa/runs/{runId}/bundle`

Download the signed NIS2 Statement of Applicability bundle.

Property	Value
Operation ID	`DownloadNis2SoaExportBundle`
Tags	`NIS2 SoA Exports`
Auth	Not declared
Request body	-

Parameters:

Name	In	Required	Description
`runId`	`path`	yes

Responses:

Status	Description	Content types
`200`	OK	-

`GET /api/offlinekit/v1/exports/profiles`

List export profiles

Lists export profiles for the current tenant with optional filtering.

Property	Value
Operation ID	`ListExportProfiles`
Tags	`Exports`
Auth	Not declared
Request body	-

Parameters:

Name	In	Required
`kind`	`query`	no
`limit`	`query`	yes
`offset`	`query`	yes
`search`	`query`	no
`status`	`query`	no

Responses:

Status	Description	Content types
`200`	OK	`application/json`
`400`	Bad Request	`application/json`

`POST /api/offlinekit/v1/exports/profiles`

Create export profile

Creates a new export profile.

Property	Value
Operation ID	`CreateExportProfile`
Tags	`Exports`
Auth	Not declared
Request body	`application/json`

Responses:

Status	Description	Content types
`201`	Created	`application/json`
`400`	Bad Request	`application/json`
`409`	Conflict	`application/json`

`GET /api/offlinekit/v1/exports/profiles/{profileId}`

Get export profile

Gets a specific export profile by ID.

Property	Value
Operation ID	`GetExportProfile`
Tags	`Exports`
Auth	Not declared
Request body	-

Parameters:

Name	In	Required	Description
`profileId`	`path`	yes

Responses:

Status	Description	Content types
`200`	OK	`application/json`
`400`	Bad Request	`application/json`
`404`	Not Found	-

`PUT /api/offlinekit/v1/exports/profiles/{profileId}`

Update export profile

Updates an existing export profile.

Property	Value
Operation ID	`UpdateExportProfile`
Tags	`Exports`
Auth	Not declared
Request body	`application/json`

Parameters:

Name	In	Required	Description
`profileId`	`path`	yes

Responses:

Status	Description	Content types
`200`	OK	`application/json`
`400`	Bad Request	`application/json`
`404`	Not Found	-
`409`	Conflict	`application/json`

`DELETE /api/offlinekit/v1/exports/profiles/{profileId}`

Archive export profile

Archives (soft deletes) an export profile.

Property	Value
Operation ID	`ArchiveExportProfile`
Tags	`Exports`
Auth	Not declared
Request body	-

Parameters:

Name	In	Required	Description
`profileId`	`path`	yes

Responses:

Status	Description	Content types
`204`	No Content	-
`400`	Bad Request	`application/json`
`404`	Not Found	-

`POST /api/offlinekit/v1/exports/profiles/{profileId}/runs`

Start export run

Starts a new export run from a profile.

Property	Value
Operation ID	`StartExportRun`
Tags	`Exports`
Auth	Not declared
Request body	`application/json`

Parameters:

Name	In	Required	Description
`profileId`	`path`	yes

Responses:

Status	Description	Content types
`202`	Accepted	`application/json`
`400`	Bad Request	`application/json`
`404`	Not Found	-

`GET /api/offlinekit/v1/exports/runs`

List export runs

Lists export runs for the current tenant with optional filtering.

Property	Value
Operation ID	`ListExportRuns`
Tags	`Exports`
Auth	Not declared
Request body	-

Parameters:

Name	In	Required
`correlationId`	`query`	no
`createdAfter`	`query`	no
`createdBefore`	`query`	no
`limit`	`query`	yes
`offset`	`query`	yes
`profileId`	`query`	no
`status`	`query`	no
`trigger`	`query`	no

Responses:

Status	Description	Content types
`200`	OK	`application/json`
`400`	Bad Request	`application/json`

`GET /api/offlinekit/v1/exports/runs/{runId}`

Get export run

Gets a specific export run by ID.

Property	Value
Operation ID	`GetExportRun`
Tags	`Exports`
Auth	Not declared
Request body	-

Parameters:

Name	In	Required	Description
`runId`	`path`	yes

Responses:

Status	Description	Content types
`200`	OK	`application/json`
`400`	Bad Request	`application/json`
`404`	Not Found	-

`GET /api/offlinekit/v1/exports/runs/{runId}/artifacts`

List export artifacts

Lists artifacts produced by an export run.

Property	Value
Operation ID	`ListExportArtifacts`
Tags	`Exports`
Auth	Not declared
Request body	-

Parameters:

Name	In	Required	Description
`runId`	`path`	yes

Responses:

Status	Description	Content types
`200`	OK	`application/json`
`400`	Bad Request	`application/json`
`404`	Not Found	-

`GET /api/offlinekit/v1/exports/runs/{runId}/artifacts/{artifactId}`

Get export artifact

Gets metadata for a specific export artifact.

Property	Value
Operation ID	`GetExportArtifact`
Tags	`Exports`
Auth	Not declared
Request body	-

Parameters:

Name	In	Required	Description
`artifactId`	`path`	yes
`runId`	`path`	yes

Responses:

Status	Description	Content types
`200`	OK	`application/json`
`400`	Bad Request	`application/json`
`404`	Not Found	-

`GET /api/offlinekit/v1/exports/runs/{runId}/artifacts/{artifactId}/download`

Download export artifact

Downloads an export artifact file.

Property	Value
Operation ID	`DownloadExportArtifact`
Tags	`Exports`
Auth	Not declared
Request body	-

Parameters:

Name	In	Required	Description
`artifactId`	`path`	yes
`runId`	`path`	yes

Responses:

Status	Description	Content types
`400`	Bad Request	`application/json`
`404`	Not Found	-

`POST /api/offlinekit/v1/exports/runs/{runId}/cancel`

Cancel export run

Cancels a queued or running export run.

Property	Value
Operation ID	`CancelExportRun`
Tags	`Exports`
Auth	Not declared
Request body	-

Parameters:

Name	In	Required	Description
`runId`	`path`	yes

Responses:

Status	Description	Content types
`200`	OK	`application/json`
`400`	Bad Request	`application/json`
`404`	Not Found	-

`GET /api/offlinekit/v1/exports/runs/{runId}/carrier`

Get export run carrier descriptor

Describes the OfflineKit carrier a completed run wrote: bundle, manifest, DSSE envelopes and their download routes.

Property	Value
Operation ID	`GetExportRunCarrier`
Tags	`Exports`
Auth	Not declared
Request body	-

Parameters:

Name	In	Required	Description
`runId`	`path`	yes

Responses:

Status	Description	Content types
`200`	OK	`application/json`
`400`	Bad Request	`application/json`
`404`	Not Found	`application/problem+json`

`GET /api/offlinekit/v1/exports/runs/{runId}/events`

Stream export run events

Streams real-time events for an export run via Server-Sent Events.

Property	Value
Operation ID	`StreamExportRunEvents`
Tags	`Exports`
Auth	Not declared
Request body	-

Parameters:

Name	In	Required	Description
`runId`	`path`	yes

Responses:

Status	Description	Content types
`200`	OK	-

`POST /api/offlinekit/v1/exports/runs/{runId}/verify`

Verify export run

Verifies an export run’s manifest, signatures, and content hashes.

Property	Value
Operation ID	`VerifyExportRun`
Tags	`Exports`
Auth	Not declared
Request body	`application/json`

Parameters:

Name	In	Required	Description
`runId`	`path`	yes

Responses:

Status	Description	Content types
`200`	OK	`application/json`
`400`	Bad Request	`application/json`
`404`	Not Found	-

`GET /api/offlinekit/v1/exports/runs/{runId}/verify/attestation`

Get attestation status

Gets the attestation status for an export run.

Property	Value
Operation ID	`GetExportAttestationStatus`
Tags	`Exports`
Auth	Not declared
Request body	-

Parameters:

Name	In	Required	Description
`runId`	`path`	yes

Responses:

Status	Description	Content types
`200`	OK	`application/json`
`400`	Bad Request	`application/json`
`404`	Not Found	-

`GET /api/offlinekit/v1/exports/runs/{runId}/verify/manifest`

Get export run manifest

Gets the manifest for an export run.

Property	Value
Operation ID	`GetExportRunManifest`
Tags	`Exports`
Auth	Not declared
Request body	-

Parameters:

Name	In	Required	Description
`runId`	`path`	yes

Responses:

Status	Description	Content types
`200`	OK	`application/json`
`400`	Bad Request	`application/json`
`404`	Not Found	-

`POST /api/offlinekit/v1/exports/runs/{runId}/verify/stream`

Stream verification progress

Streams verification progress events via Server-Sent Events.

Property	Value
Operation ID	`StreamExportVerification`
Tags	`Exports`
Auth	Not declared
Request body	`application/json`

Parameters:

Name	In	Required	Description
`runId`	`path`	yes

Responses:

Status	Description	Content types
`200`	OK	`application/json`

`GET /api/offlinekit/v1/exports/simulations`

List available simulations for export

Returns simulations that can be exported, optionally filtered by tenant.

Property	Value
Operation ID	`GetAvailableSimulations`
Tags	`Simulation Exports`
Auth	Not declared
Request body	-

Parameters:

Name	In	Required	Description
`limit`	`query`	no
`tenantId`	`query`	no

Responses:

Status	Description	Content types
`200`	OK	`application/json`

`POST /api/offlinekit/v1/exports/simulations`

Export a simulation report

Exports a simulation report with scored data and explainability snapshots.

Property	Value
Operation ID	`ExportSimulation`
Tags	`Simulation Exports`
Auth	Not declared
Request body	`application/json`

Responses:

Status	Description	Content types
`202`	Accepted	`application/json`
`400`	Bad Request	`application/json`
`404`	Not Found	-

`GET /api/offlinekit/v1/exports/simulations/{exportId}`

Get exported simulation document

Returns the exported simulation document in JSON format.

Property	Value
Operation ID	`GetSimulationExportDocument`
Tags	`Simulation Exports`
Auth	Not declared
Request body	-

Parameters:

Name	In	Required	Description
`exportId`	`path`	yes

Responses:

Status	Description	Content types
`200`	OK	`application/json`
`404`	Not Found	-

`GET /api/offlinekit/v1/exports/simulations/{simulationId}/csv`

Get simulation export as CSV

Returns the simulation finding scores in CSV format.

Property	Value
Operation ID	`GetSimulationCsvExport`
Tags	`Simulation Exports`
Auth	Not declared
Request body	-

Parameters:

Name	In	Required	Description
`simulationId`	`path`	yes

Responses:

Status	Description	Content types
`200`	OK	-
`404`	Not Found	-

`GET /api/offlinekit/v1/exports/simulations/{simulationId}/stream`

Stream simulation export as NDJSON

Streams the simulation export in NDJSON format for large datasets.

Property	Value
Operation ID	`StreamSimulationExport`
Tags	`Simulation Exports`
Auth	Not declared
Request body	-

Parameters:

Name	In	Required
`simulationId`	`path`	yes
`includeDistribution`	`query`	no
`includeExplainability`	`query`	no
`includeScoredData`	`query`	no

Responses:

Status	Description	Content types
`200`	OK	-
`404`	Not Found	-

`GET /api/offlinekit/v1/exports/{id}/attestation`

Get attestation for an export run

Returns the DSSE attestation envelope for the specified export run.

Property	Value
Operation ID	`GetExportAttestation`
Tags	`Attestations`
Auth	Not declared
Request body	-

Parameters:

Name	In	Required	Description
`X-Tenant-Id`	`header`	no
`id`	`path`	yes

Responses:

Status	Description	Content types
`200`	OK	`application/json`
`404`	Not Found	-

`POST /api/offlinekit/v1/exports/{id}/attestation/verify`

Verify attestation signature

Verifies the cryptographic signature of the export attestation.

Property	Value
Operation ID	`VerifyExportAttestation`
Tags	`Attestations`
Auth	Not declared
Request body	-

Parameters:

Name	In	Required	Description
`X-Tenant-Id`	`header`	no
`id`	`path`	yes

Responses:

Status	Description	Content types
`200`	OK	`application/json`
`404`	Not Found	-

`POST /api/offlinekit/v1/import`

Property	Value
Operation ID	`offlinekit.import`
Tags	`OfflineKit`
Auth	Not declared
Request body	-

Responses:

Status	Description	Content types
`202`	Accepted	`application/json`
`400`	Bad Request	`application/json`
`413`	Payload Too Large	`application/json`
`422`	Unprocessable Entity	`application/json`

`POST /api/offlinekit/v1/imports/{importId}/parts/{domain}/activate`

Property	Value
Operation ID	`offlinekit.parts.reactivate`
Tags	`OfflineKit`
Auth	Not declared
Request body	-

Parameters:

Name	In	Required	Description
`domain`	`path`	yes
`importId`	`path`	yes

Responses:

Status	Description	Content types
`200`	OK	`application/json`
`404`	Not Found	`application/json`
`409`	Conflict	`application/json`

`GET /api/offlinekit/v1/incidents`

Get active incidents

Returns all currently active incidents.

Property	Value
Operation ID	`GetActiveIncidents`
Tags	`Incident Management`
Auth	Not declared
Request body	-

Responses:

Status	Description	Content types
`200`	OK	`application/json`

`POST /api/offlinekit/v1/incidents`

Activate a new incident

Activates a new incident and emits events to timeline and notifier.

Property	Value
Operation ID	`ActivateIncident`
Tags	`Incident Management`
Auth	Not declared
Request body	`application/json`

Responses:

Status	Description	Content types
`201`	Created	`application/json`
`400`	Bad Request	-

`GET /api/offlinekit/v1/incidents/recent`

Get recent incidents

Returns recent incidents including resolved ones.

Property	Value
Operation ID	`GetRecentIncidents`
Tags	`Incident Management`
Auth	Not declared
Request body	-

Parameters:

Name	In	Required	Description
`includeResolved`	`query`	no
`limit`	`query`	no

Responses:

Status	Description	Content types
`200`	OK	`application/json`

`GET /api/offlinekit/v1/incidents/status`

Get incident mode status

Returns the current incident mode status including all active incidents.

Property	Value
Operation ID	`GetIncidentModeStatus`
Tags	`Incident Management`
Auth	Not declared
Request body	-

Responses:

Status	Description	Content types
`200`	OK	`application/json`

`GET /api/offlinekit/v1/incidents/{id}`

Get incident by ID

Returns the specified incident.

Property	Value
Operation ID	`GetIncident`
Tags	`Incident Management`
Auth	Not declared
Request body	-

Parameters:

Name	In	Required	Description
`id`	`path`	yes

Responses:

Status	Description	Content types
`200`	OK	`application/json`
`404`	Not Found	-

`PATCH /api/offlinekit/v1/incidents/{id}`

Update an incident

Updates an existing incident status or severity.

Property	Value
Operation ID	`UpdateIncident`
Tags	`Incident Management`
Auth	Not declared
Request body	`application/json`

Parameters:

Name	In	Required	Description
`id`	`path`	yes

Responses:

Status	Description	Content types
`200`	OK	`application/json`
`400`	Bad Request	-
`404`	Not Found	-

`POST /api/offlinekit/v1/incidents/{id}/resolve`

Resolve an incident

Resolves an incident and emits resolution event.

Property	Value
Operation ID	`ResolveIncident`
Tags	`Incident Management`
Auth	Not declared
Request body	`application/json`

Parameters:

Name	In	Required	Description
`id`	`path`	yes

Responses:

Status	Description	Content types
`200`	OK	`application/json`
`400`	Bad Request	-
`404`	Not Found	-

`POST /api/offlinekit/v1/lineage-evidence-packs`

Generate a lineage evidence pack

Creates a signed evidence pack containing SBOMs, VEX documents, policy verdicts, and attestations for the specified artifact. Returns a download URL for the ZIP archive.

Property	Value
Operation ID	`ExportLineageEvidencePack`
Tags	`Lineage Export`
Auth	Not declared
Request body	`application/json`

Responses:

Status	Description	Content types
`200`	OK	`application/json`
`400`	Bad Request	`application/json`
`404`	Not Found	`application/json`

`GET /api/offlinekit/v1/lineage-evidence-packs/{packId}`

Get evidence pack metadata

Returns metadata for a previously generated evidence pack.

Property	Value
Operation ID	`GetLineageEvidencePack`
Tags	`Lineage Export`
Auth	Not declared
Request body	-

Parameters:

Name	In	Required	Description
`packId`	`path`	yes

Responses:

Status	Description	Content types
`200`	OK	`application/json`
`404`	Not Found	`application/json`

`GET /api/offlinekit/v1/lineage-evidence-packs/{packId}/download`

Download evidence pack as ZIP

Downloads the evidence pack as a ZIP archive.

Property	Value
Operation ID	`DownloadLineageEvidencePack`
Tags	`Lineage Export`
Auth	Not declared
Request body	-

Parameters:

Name	In	Required	Description
`packId`	`path`	yes

Responses:

Status	Description	Content types
`200`	OK	-
`404`	Not Found	`application/json`

`POST /api/offlinekit/v1/lineage-evidence-packs/{packId}/sign`

Sign an evidence pack

Signs an existing evidence pack with a DSSE envelope over the manifest.

Property	Value
Operation ID	`SignLineageEvidencePack`
Tags	`Lineage Export`
Auth	Not declared
Request body	`application/json`

Parameters:

Name	In	Required	Description
`packId`	`path`	yes

Responses:

Status	Description	Content types
`200`	OK	`application/json`
`400`	Bad Request	`application/json`
`404`	Not Found	`application/json`

`POST /api/offlinekit/v1/lineage-evidence-packs/{packId}/verify`

Verify evidence pack signature

Verifies the signature and merkle root of an evidence pack.

Property	Value
Operation ID	`VerifyLineageEvidencePack`
Tags	`Lineage Export`
Auth	Not declared
Request body	-

Parameters:

Name	In	Required	Description
`packId`	`path`	yes

Responses:

Status	Description	Content types
`200`	OK	`application/json`
`404`	Not Found	`application/json`

`GET /api/offlinekit/v1/manifest`

Property	Value
Operation ID	`offlinekit.manifest`
Tags	`OfflineKit`
Auth	Not declared
Request body	-

Responses:

Status	Description	Content types
`200`	OK	-
`204`	No Content	-

`POST /api/offlinekit/v1/promotions/attestations`

Create promotion attestation assembly

Creates a promotion attestation assembly bundling SBOM/VEX digests, Rekor proofs, and DSSE envelopes.

Property	Value
Operation ID	`CreatePromotionAttestation`
Tags	`Promotion Attestations`
Auth	Not declared
Request body	`application/json`

Parameters:

Name	In	Required	Description
`X-Tenant-Id`	`header`	no

Responses:

Status	Description	Content types
`201`	Created	`application/json`
`400`	Bad Request	-

`GET /api/offlinekit/v1/promotions/attestations/{assemblyId}`

Get promotion attestation assembly

Returns the promotion attestation assembly for the specified ID.

Property	Value
Operation ID	`GetPromotionAssembly`
Tags	`Promotion Attestations`
Auth	Not declared
Request body	-

Parameters:

Name	In	Required	Description
`X-Tenant-Id`	`header`	no
`assemblyId`	`path`	yes

Responses:

Status	Description	Content types
`200`	OK	`application/json`
`404`	Not Found	-

`GET /api/offlinekit/v1/promotions/attestations/{assemblyId}/bundle`

Export promotion bundle for Offline Kit

Exports the promotion attestation assembly as a portable bundle for Offline Kit delivery.

Property	Value
Operation ID	`ExportPromotionBundle`
Tags	`Promotion Attestations`
Auth	Not declared
Request body	-

Parameters:

Name	In	Required	Description
`X-Tenant-Id`	`header`	no
`assemblyId`	`path`	yes

Responses:

Status	Description	Content types
`200`	OK	-
`404`	Not Found	-

`POST /api/offlinekit/v1/promotions/attestations/{assemblyId}/verify`

Verify promotion attestation assembly

Verifies the cryptographic signatures of the promotion attestation assembly.

Property	Value
Operation ID	`VerifyPromotionAssembly`
Tags	`Promotion Attestations`
Auth	Not declared
Request body	-

Parameters:

Name	In	Required	Description
`X-Tenant-Id`	`header`	no
`assemblyId`	`path`	yes

Responses:

Status	Description	Content types
`200`	OK	`application/json`
`404`	Not Found	-

`GET /api/offlinekit/v1/promotions/{promotionId}/attestations`

Get attestation assemblies for a promotion

Returns all attestation assemblies for the specified promotion.

Property	Value
Operation ID	`GetAssembliesForPromotion`
Tags	`Promotion Attestations`
Auth	Not declared
Request body	-

Parameters:

Name	In	Required	Description
`X-Tenant-Id`	`header`	no
`promotionId`	`path`	yes

Responses:

Status	Description	Content types
`200`	OK	`application/json`
`404`	Not Found	-

`GET /api/offlinekit/v1/risk-bundles/jobs`

Get recent risk bundle jobs

Returns recent risk bundle jobs, optionally filtered by tenant.

Property	Value
Operation ID	`GetRecentRiskBundleJobs`
Tags	`Risk Bundles`
Auth	Not declared
Request body	-

Parameters:

Name	In	Required	Description
`limit`	`query`	no
`tenantId`	`query`	no

Responses:

Status	Description	Content types
`200`	OK	`application/json`

`POST /api/offlinekit/v1/risk-bundles/jobs`

Submit a risk bundle job

Submits a new risk bundle generation job with selected providers.

Property	Value
Operation ID	`SubmitRiskBundleJob`
Tags	`Risk Bundles`
Auth	Not declared
Request body	`application/json`

Responses:

Status	Description	Content types
`202`	Accepted	`application/json`
`400`	Bad Request	`application/json`

`GET /api/offlinekit/v1/risk-bundles/jobs/{jobId}`

Get risk bundle job status

Returns the status of a specific risk bundle job.

Property	Value
Operation ID	`GetRiskBundleJobStatus`
Tags	`Risk Bundles`
Auth	Not declared
Request body	-

Parameters:

Name	In	Required	Description
`jobId`	`path`	yes

Responses:

Status	Description	Content types
`200`	OK	`application/json`
`404`	Not Found	-

`POST /api/offlinekit/v1/risk-bundles/jobs/{jobId}/cancel`

Cancel a risk bundle job

Cancels a pending or running risk bundle job.

Property	Value
Operation ID	`CancelRiskBundleJob`
Tags	`Risk Bundles`
Auth	Not declared
Request body	-

Parameters:

Name	In	Required	Description
`jobId`	`path`	yes

Responses:

Status	Description	Content types
`204`	No Content	-
`404`	Not Found	-
`409`	Conflict	-

`GET /api/offlinekit/v1/risk-bundles/providers`

Get available risk bundle providers

Returns available providers for risk bundle generation, including mandatory and optional providers.

Property	Value
Operation ID	`GetRiskBundleProviders`
Tags	`Risk Bundles`
Auth	Not declared
Request body	-

Responses:

Status	Description	Content types
`200`	OK	`application/json`

`GET /api/offlinekit/v1/status`

Property	Value
Operation ID	`offlinekit.status`
Tags	`OfflineKit`
Auth	Not declared
Request body	-

Responses:

Status	Description	Content types
`200`	OK	`application/json`
`204`	No Content	-

`POST /api/offlinekit/v1/validate`

Property	Value
Operation ID	`offlinekit.validate`
Tags	`OfflineKit`
Auth	Not declared
Request body	-

Responses:

Status	Description	Content types
`200`	OK	`application/json`
`400`	Bad Request	`application/json`

`GET /doctor/offlinekit/checks`

Property	Value
Operation ID	-
Tags	`StellaOps.OfflineKit.WebService`
Auth	Not declared
Request body	-

Responses:

Status	Description	Content types
`200`	OK	-

`GET /health/ready`

Property	Value
Operation ID	-
Tags	`StellaOps.OfflineKit.WebService`
Auth	Not declared
Request body	-

Responses:

Status	Description	Content types
`200`	OK	-

`POST /internal/plugins/probe`

Property	Value
Operation ID	`OfflineKitExportAdapterPluginProbe`
Tags	`StellaOps.OfflineKit.WebService`
Auth	Not declared
Request body	`application/json`

Responses:

Status	Description	Content types
`200`	OK	-

`GET /internal/plugins/status`

Property	Value
Operation ID	`OfflineKitExportAdapterPluginStatus`
Tags	`StellaOps.OfflineKit.WebService`
Auth	Not declared
Request body	-

Responses:

Status	Description	Content types
`200`	OK	-