Evydence API - Rendered OpenAPI Docs

Runtime secrets, tenant data, raw evidence payloads, private keys, bearer tokens, and customer package contents are not embedded in this generated page. Admin-scoped routes appear only when they are part of the committed public contract.

Error responses use RFC 9457-style Problem Details. The registered Problem schema currently requires: none.

Operations

Filter operations

GET /v1/admin/instance

Instance admin snapshot

Returns instance-level diagnostic counts. Requires the explicit instance:admin scope; tenant admin and ordinary wildcard tenant keys are insufficient.

Operation ID: instanceAdminSnapshot
Tags: evydence
Auth: BearerAuth
Scopes: instance:admin
Idempotency: not required
Request: none
Responses: 200 application/json: InstanceAdminSnapshotEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

GET /v1/api-keys

List API keys

Lists tenant-scoped API key metadata without key hashes or one-time secrets.

Operation ID: listAPIKeys
Tags: evydence
Auth: BearerAuth
Scopes: admin
Idempotency: not required
Request: none
Responses: 200 application/json: APIKeyListEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/api-keys

Create API key

Creates a tenant-scoped API key and returns the secret exactly once. Stored records expose only non-secret key metadata.

Operation ID: createAPIKey
Tags: evydence
Auth: BearerAuth
Scopes: admin
Idempotency: Idempotency-Key
Request: application/json: CreateAPIKeyRequest
Responses: 201 application/json: APIKeyCreateEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/api-security-scans

Upload API security scan

Uploads SAST, DAST, secret, license, or API security scan metadata and raw JSON payload evidence without exposing raw payload bytes in responses.

Operation ID: uploadAPISecurityScan
Tags: evydence
Auth: BearerAuth
Scopes: security:write
Idempotency: Idempotency-Key
Request: application/json: UploadSecurityScanRequest
Responses: 201 application/json: SecurityScanEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/approvals

Create approval record

Creates an immutable approval record for a release, waiver, package, or review subject.

Operation ID: createApproval
Tags: evydence
Auth: BearerAuth
Scopes: release:write
Idempotency: Idempotency-Key
Request: application/json: CreateApprovalRequest
Responses: 201 application/json: ApprovalRecordEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/artifact-signatures

Create artifact signature

Records detached artifact signature evidence and optional raw signature payload metadata.

Operation ID: createArtifactSignature
Tags: evydence
Auth: BearerAuth
Scopes: evidence:write
Idempotency: Idempotency-Key
Request: application/json: CreateArtifactSignatureRequest
Responses: 201 application/json: ArtifactSignatureEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

GET /v1/artifact-signatures/{id}

Get artifact signature

Returns tenant-scoped artifact signature metadata by id.

Operation ID: getArtifactSignature
Tags: evydence
Auth: BearerAuth
Scopes: evidence:read
Idempotency: not required
Request: none
Responses: 200 application/json: ArtifactSignatureEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/artifact-signatures/{id}/verify-cosign

Verify cosign-style artifact signature

Records deterministic cosign-style verification metadata for an artifact signature without implying online transparency trust.

Operation ID: verifyCosignSignature
Tags: evydence
Auth: BearerAuth
Scopes: verify:read
Idempotency: Idempotency-Key
Request: application/json: VerifyCosignSignatureRequest
Responses: 200 application/json: CosignVerificationEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/artifacts

Register artifact

Registers an artifact digest for release evidence and later build/attestation matching.

Operation ID: registerArtifact
Tags: evydence
Auth: BearerAuth
Scopes: evidence:write
Idempotency: Idempotency-Key
Request: application/json: RegisterArtifactRequest
Responses: 201 application/json: ArtifactEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

GET /v1/artifacts/{id}

Get artifact

Returns a tenant-scoped artifact by id.

Operation ID: getArtifact
Tags: evydence
Auth: BearerAuth
Scopes: evidence:read
Idempotency: not required
Request: none
Responses: 200 application/json: ArtifactEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

GET /v1/audit-chain/verify

Verify audit chain

Verifies the tenant audit chain continuity and returns deterministic verification checks.

Operation ID: verifyAuditChain
Tags: evydence
Auth: BearerAuth
Scopes: verify:read
Idempotency: not required
Request: none
Responses: 200 application/json: VerificationResultEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

GET /v1/audit-log

List tenant audit log

Lists tenant-scoped append-only audit-chain entries in reverse chronological order.

Operation ID: listAuditLog
Tags: evydence
Auth: BearerAuth
Scopes: admin
Idempotency: not required
Request: none
Responses: 200 application/json: AuditChainEntryListEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/backup-manifests

Generate backup manifest

Generates a tenant-scoped backup manifest after an operator backup completes. The manifest excludes raw payload bytes and private key material.

Operation ID: generateBackupManifest
Tags: evydence
Auth: BearerAuth
Scopes: admin
Idempotency: Idempotency-Key
Request: application/json: EmptyObject
Responses: 201 application/json: BackupManifestEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

GET /v1/backup-manifests/{id}/verify

Verify backup manifest

Verifies a tenant-scoped backup manifest and returns deterministic manifest verification checks.

Operation ID: verifyBackupManifest
Tags: evydence
Auth: BearerAuth
Scopes: verify:read
Idempotency: not required
Request: none
Responses: 200 application/json: VerificationResultEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/build-attestations/{id}/verify-signature

Verify build attestation signature

Verifies a build attestation signature against configured tenant DSSE trust roots.

Operation ID: verifyBuildAttestationSignature
Tags: evydence
Auth: BearerAuth
Scopes: verify:read
Idempotency: Idempotency-Key
Request: application/json: EmptyObject
Responses: 200 application/json: VerificationResultEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/builds

Create build run

Records an immutable CI build run. Collector identity is derived from the authenticated key when present.

Operation ID: createBuild
Tags: evydence
Auth: BearerAuth
Scopes: build:write
Idempotency: Idempotency-Key
Request: application/json: CreateBuildRequest
Responses: 201 application/json: BuildRunEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

GET /v1/builds/{id}

Get build run

Returns a tenant-scoped build run by id.

Operation ID: getBuild
Tags: evydence
Auth: BearerAuth
Scopes: build:read
Idempotency: not required
Request: none
Responses: 200 application/json: BuildRunEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/builds/{id}/attestations

Upload build attestation

Uploads a DSSE/in-toto build attestation for a tenant-scoped build and stores raw bytes in object storage.

Operation ID: uploadBuildAttestation
Tags: evydence
Auth: BearerAuth
Scopes: build:write
Idempotency: Idempotency-Key
Request: application/json: DSSEEnvelope
Responses: 201 application/json: BuildAttestationEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

GET /v1/collectors

List collectors

Lists tenant-scoped collector metadata without API key hashes or one-time secrets.

Operation ID: listCollectors
Tags: evydence
Auth: BearerAuth
Scopes: collector:read
Idempotency: not required
Request: none
Responses: 200 application/json: CollectorListEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/collectors

Create collector

Creates a tenant-scoped collector identity, binds a scoped API key, and returns the collector key secret exactly once.

Operation ID: createCollector
Tags: evydence
Auth: BearerAuth
Scopes: collector:admin
Idempotency: Idempotency-Key
Request: application/json: CreateCollectorRequest
Responses: 201 application/json: CollectorCreateEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/collectors/github/source-snapshots

Upload GitHub source snapshot

Uploads a strict GitHub source snapshot, hashes commit messages, and stores repository, commit, branch, and pull-request evidence records.

Operation ID: uploadGitHubSourceSnapshot
Tags: evydence
Auth: BearerAuth
Scopes: source:write
Idempotency: Idempotency-Key
Request: application/json: SourceSnapshotRequest
Responses: 201 application/json: SourceSnapshotEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/collectors/gitlab/source-snapshots

Upload GitLab source snapshot

Uploads a strict GitLab source snapshot, hashes commit messages, and stores repository, commit, branch, and pull-request evidence records.

Operation ID: uploadGitLabSourceSnapshot
Tags: evydence
Auth: BearerAuth
Scopes: source:write
Idempotency: Idempotency-Key
Request: application/json: SourceSnapshotRequest
Responses: 201 application/json: SourceSnapshotEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

GET /v1/collectors/{id}/health

Collector health report

Returns collector supply-chain health from recorded tenant evidence, assumptions, and limitations.

Operation ID: collectorHealthReport
Tags: evydence
Auth: BearerAuth
Scopes: collector:read
Idempotency: not required
Request: none
Responses: 200 application/json: CollectorHealthReportEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/collectors/{id}/releases

Record collector release evidence

Records collector release supply-chain evidence for a tenant-scoped collector.

Operation ID: recordCollectorRelease
Tags: evydence
Auth: BearerAuth
Scopes: collector:admin
Idempotency: Idempotency-Key
Request: application/json: RecordCollectorReleaseRequest
Responses: 201 application/json: CollectorReleaseEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

GET /v1/commercial-collectors

List commercial collector definitions

Lists tenant-scoped commercial collector definitions.

Operation ID: listCommercialCollectors
Tags: evydence
Auth: BearerAuth
Scopes: collector:read
Idempotency: not required
Request: none
Responses: 200 application/json: CommercialCollectorDefinitionListEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/commercial-collectors

Create commercial collector definition

Creates tenant-scoped commercial collector metadata without installing external code.

Operation ID: createCommercialCollector
Tags: evydence
Auth: BearerAuth
Scopes: collector:admin
Idempotency: Idempotency-Key
Request: application/json: CreateCommercialCollectorRequest
Responses: 201 application/json: CommercialCollectorDefinitionEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/container-images

Register container image

Registers OCI/container image metadata and digest evidence linked to an optional artifact.

Operation ID: registerContainerImage
Tags: evydence
Auth: BearerAuth
Scopes: evidence:write
Idempotency: Idempotency-Key
Request: application/json: RegisterContainerImageRequest
Responses: 201 application/json: ContainerImageEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

GET /v1/control-evidence

List control evidence

Lists tenant-scoped control evidence links with optional control, product, and release filters.

Operation ID: listControlEvidence
Tags: evydence
Auth: BearerAuth
Scopes: controls:read
Idempotency: not required
Request: none
Responses: 200 application/json: ControlEvidenceListEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

GET /v1/control-framework-template-packs

List control framework template packs

Lists built-in control framework template packs available for explicit tenant installation.

Operation ID: listControlFrameworkTemplatePacks
Tags: evydence
Auth: BearerAuth
Scopes: controls:read
Idempotency: not required
Request: none
Responses: 200 application/json: ControlFrameworkTemplatePackListEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/control-framework-template-packs/{slug}/install

Install control framework template pack

Installs a named control framework template pack into the tenant as ordinary framework/control records.

Operation ID: installControlFrameworkTemplatePack
Tags: evydence
Auth: BearerAuth
Scopes: controls:admin
Idempotency: Idempotency-Key
Request: application/json: EmptyObject
Responses: 201 application/json: ControlFrameworkEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

GET /v1/control-frameworks

List control frameworks

Lists tenant-scoped control frameworks.

Operation ID: listControlFrameworks
Tags: evydence
Auth: BearerAuth
Scopes: controls:read
Idempotency: not required
Request: none
Responses: 200 application/json: ControlFrameworkListEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/control-frameworks

Create control framework

Creates a tenant-scoped versioned control framework.

Operation ID: createControlFramework
Tags: evydence
Auth: BearerAuth
Scopes: controls:admin
Idempotency: Idempotency-Key
Request: application/json: CreateControlFrameworkRequest
Responses: 201 application/json: ControlFrameworkEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/controls

Create security control

Creates a framework-owned security control with deterministic evidence requirements.

Operation ID: createSecurityControl
Tags: evydence
Auth: BearerAuth
Scopes: controls:admin
Idempotency: Idempotency-Key
Request: application/json: CreateSecurityControlRequest
Responses: 201 application/json: SecurityControlEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

GET /v1/controls/{id}

Get security control

Returns a tenant-scoped security control by id.

Operation ID: getSecurityControl
Tags: evydence
Auth: BearerAuth
Scopes: controls:read
Idempotency: not required
Request: none
Responses: 200 application/json: SecurityControlEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/controls/{id}/evidence

Link control evidence

Creates an append-only link between a security control and tenant-scoped evidence or related release resource.

Operation ID: linkControlEvidence
Tags: evydence
Auth: BearerAuth
Scopes: controls:write
Idempotency: Idempotency-Key
Request: application/json: LinkControlEvidenceRequest
Responses: 201 application/json: ControlEvidenceEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/custom-policies

Create custom policy

Creates a deterministic custom policy definition for tenant-managed release checks.

Operation ID: createCustomPolicy
Tags: evydence
Auth: BearerAuth
Scopes: policy:write
Idempotency: Idempotency-Key
Request: application/json: CreateCustomPolicyRequest
Responses: 201 application/json: CustomPolicyEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/custom-policies/{id}/evaluate

Evaluate custom policy

Evaluates a tenant custom policy against a release and records the input hash.

Operation ID: evaluateCustomPolicy
Tags: evydence
Auth: BearerAuth
Scopes: policy:read
Idempotency: Idempotency-Key
Request: application/json: EvaluatePolicyRequest
Responses: 201 application/json: CustomPolicyEvaluationEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/customer-packages

Create customer security package

Creates a scoped customer security package manifest using an explicit redaction profile.

Operation ID: createCustomerPackage
Tags: evydence
Auth: BearerAuth
Scopes: package:write
Idempotency: Idempotency-Key
Request: application/json: CreateCustomerPackageRequest
Responses: 201 application/json: CustomerSecurityPackageEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

GET /v1/customer-packages/{id}

Get customer security package

Returns a tenant-scoped customer security package manifest by id.

Operation ID: getCustomerPackage
Tags: evydence
Auth: BearerAuth
Scopes: package:read
Idempotency: not required
Request: none
Responses: 200 application/json: CustomerSecurityPackageEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

GET /v1/customer-packages/{id}/download

Download customer security package ZIP

Downloads a scoped customer security package ZIP. The archive contains redacted manifest metadata and verification guidance, not raw tenant evidence payload bytes.

Operation ID: downloadCustomerPackage
Tags: evydence
Auth: BearerAuth
Scopes: package:read
Idempotency: not required
Request: none
Responses: 200 application/zip: string; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

GET /v1/customer-portal/access

List customer portal access records

Lists tenant-scoped external reviewer access records without token hashes or token secrets.

Operation ID: listCustomerPortalAccess
Tags: evydence
Auth: BearerAuth
Scopes: package:read
Idempotency: not required
Request: none
Responses: 200 application/json: CustomerPortalAccessListEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/customer-portal/access

Create customer portal access

Creates a named, expiring external reviewer access record for a customer package and returns the portal token once.

Operation ID: createCustomerPortalAccess
Tags: evydence
Auth: BearerAuth
Scopes: package:write
Idempotency: Idempotency-Key
Request: application/json: CreateCustomerPortalAccessRequest
Responses: 201 application/json: CustomerPortalAccessCreateEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/customer-portal/access/{id}/revoke

Revoke customer portal access

Revokes a tenant-scoped external reviewer access record; revocation is append-only and the original token cannot be used afterwards.

Operation ID: revokeCustomerPortalAccess
Tags: evydence
Auth: BearerAuth
Scopes: package:write
Idempotency: Idempotency-Key
Request: application/json: EmptyObject
Responses: 200 application/json: CustomerPortalAccessEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/customer-portal/package

Access customer portal package

Public token exchange endpoint for a scoped customer package. It intentionally uses no bearer authentication and accepts only the issued portal token in the JSON body.

Operation ID: accessCustomerPortalPackage
Tags: evydence
Auth: BearerAuth
Scopes: none
Idempotency: Idempotency-Key
Request: application/json: CustomerPortalPackageRequest
Responses: 200 application/json: CustomerSecurityPackageEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/customer-portal/package/download

Download customer portal package ZIP

Public token exchange endpoint for downloading a scoped customer package ZIP. It intentionally uses no bearer authentication and accepts only the issued portal token in the JSON body.

Operation ID: downloadCustomerPortalPackage
Tags: evydence
Auth: BearerAuth
Scopes: none
Idempotency: Idempotency-Key
Request: application/json: CustomerPortalPackageRequest
Responses: 200 application/zip: string; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

GET /v1/customer-portal/package/view

Customer portal package review form

Public HTML form for reviewing or downloading a scoped customer package with a portal token. It does not accept tokens in URLs and does not use bearer authentication.

Operation ID: customerPortalPackageViewForm
Tags: evydence
Auth: BearerAuth
Scopes: none
Idempotency: not required
Request: none
Responses: 200 text/html: string; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/customer-portal/package/view

Customer portal package review page

Public HTML package review endpoint backed by the customer portal token exchange. Tokens are accepted only as form body fields.

Operation ID: customerPortalPackageView
Tags: evydence
Auth: BearerAuth
Scopes: none
Idempotency: Idempotency-Key
Request: application/x-www-form-urlencoded: CustomerPortalPackageRequest
Responses: 200 text/html: string; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/customer-portal/package/view/download

Download customer portal package ZIP from review form

Public HTML-form package ZIP download endpoint backed by the customer portal token exchange. Tokens are accepted only as form body fields.

Operation ID: downloadCustomerPortalPackageView
Tags: evydence
Auth: BearerAuth
Scopes: none
Idempotency: Idempotency-Key
Request: application/x-www-form-urlencoded: CustomerPortalPackageRequest
Responses: 200 application/zip: string; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

GET /v1/deployments

List deployments

Lists tenant-scoped deployment events by optional release and environment filters.

Operation ID: listDeployments
Tags: evydence
Auth: BearerAuth
Scopes: deployment:read
Idempotency: not required
Request: none
Responses: 200 application/json: DeploymentEventListEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/deployments

Record deployment

Records append-only deployment evidence for a release/environment/artifact set.

Operation ID: recordDeployment
Tags: evydence
Auth: BearerAuth
Scopes: deployment:write
Idempotency: Idempotency-Key
Request: application/json: RecordDeploymentRequest
Responses: 201 application/json: DeploymentEventEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

GET /v1/deployments/{id}

Get deployment

Returns a tenant-scoped deployment event by id.

Operation ID: getDeployment
Tags: evydence
Auth: BearerAuth
Scopes: deployment:read
Idempotency: not required
Request: none
Responses: 200 application/json: DeploymentEventEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/dsse-trust-roots

Create DSSE trust root

Creates a tenant-scoped DSSE trust root using public verification key material only.

Operation ID: createDSSETrustRoot
Tags: evydence
Auth: BearerAuth
Scopes: keys:admin
Idempotency: Idempotency-Key
Request: application/json: CreateDSSETrustRootRequest
Responses: 201 application/json: DSSETrustRootEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

GET /v1/environments

List deployment environments

Lists tenant-scoped deployment environments, optionally filtered by product.

Operation ID: listDeploymentEnvironments
Tags: evydence
Auth: BearerAuth
Scopes: deployment:read
Idempotency: not required
Request: none
Responses: 200 application/json: DeploymentEnvironmentListEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/environments

Create deployment environment

Creates a tenant-scoped deployment environment for release deployment evidence.

Operation ID: createDeploymentEnvironment
Tags: evydence
Auth: BearerAuth
Scopes: deployment:write
Idempotency: Idempotency-Key
Request: application/json: CreateDeploymentEnvironmentRequest
Responses: 201 application/json: DeploymentEnvironmentEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

GET /v1/evidence

List evidence

Lists tenant-scoped evidence by optional release and evidence type filters.

Operation ID: listEvidence
Tags: evydence
Auth: BearerAuth
Scopes: evidence:read
Idempotency: not required
Request: none
Responses: 200 application/json: EvidenceItemListEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/evidence

Create evidence

Creates immutable evidence metadata and optional raw payload evidence. Evidence core fields are append-only after creation.

Operation ID: createEvidence
Tags: evydence
Auth: BearerAuth
Scopes: evidence:write
Idempotency: Idempotency-Key
Request: application/json: CreateEvidenceRequest
Responses: 201 application/json: EvidenceItemEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/evidence-bundles

Export evidence bundle

Exports a portable evidence bundle manifest with hashes, signatures, and verification text.

Operation ID: exportEvidenceBundle
Tags: evydence
Auth: BearerAuth
Scopes: bundle:read
Idempotency: Idempotency-Key
Request: application/json: ExportEvidenceBundleRequest
Responses: 201 application/json: EvidenceBundleEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/evidence-bundles/import

Import evidence bundle

Imports a portable evidence bundle manifest and records deterministic import metadata.

Operation ID: importEvidenceBundle
Tags: evydence
Auth: BearerAuth
Scopes: bundle:write
Idempotency: Idempotency-Key
Request: application/json: EvidenceBundle
Responses: 201 application/json: EvidenceBundleImportEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/evidence-graph-snapshots

Create evidence graph snapshot

Creates a deterministic product/release evidence adjacency snapshot from stored tenant-scoped evidence records.

Operation ID: createGraphSnapshot
Tags: evydence
Auth: BearerAuth
Scopes: evidence:read
Idempotency: Idempotency-Key
Request: application/json: CreateGraphSnapshotRequest
Responses: 201 application/json: EvidenceGraphSnapshotEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/evidence-summaries

Create evidence-backed summary

Creates an evidence-backed summary with citations, assumptions, and limitations.

Operation ID: createEvidenceSummary
Tags: evydence
Auth: BearerAuth
Scopes: report:read
Idempotency: Idempotency-Key
Request: application/json: CreateEvidenceSummaryRequest
Responses: 201 application/json: EvidenceSummaryEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

GET /v1/evidence/search

Search evidence

Searches tenant-scoped evidence with deterministic filters and cursor-style pagination.

Operation ID: searchEvidence
Tags: evydence
Auth: BearerAuth
Scopes: evidence:read
Idempotency: not required
Request: none
Responses: 200 application/json: EvidenceSearchEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

GET /v1/evidence/{id}

Get evidence

Returns a tenant-scoped immutable evidence item by id.

Operation ID: getEvidence
Tags: evydence
Auth: BearerAuth
Scopes: evidence:read
Idempotency: not required
Request: none
Responses: 200 application/json: EvidenceItemEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

GET /v1/evidence/{id}/lifecycle-events

List evidence lifecycle events

Lists append-only lifecycle events for a tenant-scoped evidence item.

Operation ID: listEvidenceLifecycleEvents
Tags: evydence
Auth: BearerAuth
Scopes: evidence:read
Idempotency: not required
Request: none
Responses: 200 application/json: EvidenceLifecycleEventListEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/evidence/{id}/lifecycle-events

Record evidence lifecycle event

Appends an evidence lifecycle event such as amendment, redaction marker, tombstone, or retention marker.

Operation ID: recordEvidenceLifecycleEvent
Tags: evydence
Auth: BearerAuth
Scopes: evidence:write
Idempotency: Idempotency-Key
Request: application/json: RecordEvidenceLifecycleEventRequest
Responses: 201 application/json: EvidenceLifecycleEventEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/evidence/{id}/link

Link evidence

Creates an append-only relationship from evidence to another tenant-scoped subject.

Operation ID: linkEvidence
Tags: evydence
Auth: BearerAuth
Scopes: evidence:write
Idempotency: Idempotency-Key
Request: application/json: LinkEvidenceRequest
Responses: 201 application/json: EvidenceItemEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/evidence/{id}/supersede

Supersede evidence

Supersedes immutable evidence by linking it to replacement evidence and appending lifecycle metadata.

Operation ID: supersedeEvidence
Tags: evydence
Auth: BearerAuth
Scopes: evidence:write
Idempotency: Idempotency-Key
Request: application/json: SupersedeEvidenceRequest
Responses: 201 application/json: EvidenceItemEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

GET /v1/exceptions

List exceptions

Lists tenant-scoped exceptions, optionally filtered by release.

Operation ID: listExceptions
Tags: evydence
Auth: BearerAuth
Scopes: verify:read
Idempotency: not required
Request: none
Responses: 200 application/json: ExceptionListEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/exceptions

Create exception

Creates a scoped, expiring release/finding/control exception that is inactive until approved.

Operation ID: createException
Tags: evydence
Auth: BearerAuth
Scopes: release:write
Idempotency: Idempotency-Key
Request: application/json: CreateExceptionRequest
Responses: 201 application/json: ExceptionEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/exceptions/{id}/approve

Approve exception

Approves an unexpired exception as an audited append-only transition.

Operation ID: approveException
Tags: evydence
Auth: BearerAuth
Scopes: release:write
Idempotency: Idempotency-Key
Request: application/json: EmptyObject
Responses: 200 application/json: ExceptionEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

GET /v1/health

Health

Returns low-detail liveness status without touching tenant evidence or secret material.

Operation ID: health
Tags: evydence
Auth: BearerAuth
Scopes: none
Idempotency: not required
Request: none
Responses: 200 application/json: HealthStatusEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/incident-webhooks/{receiver_id}

Receive signed incident webhook event

Public signed webhook endpoint for incident timeline events. It verifies Ed25519 signature, event id replay, and timestamp before parsing payload fields.

Operation ID: receiveIncidentWebhook
Tags: evydence
Auth: BearerAuth
Scopes: none
Idempotency: not required
Request: application/json: SignedIncidentWebhookPayload
Responses: 201 application/json: IncidentWebhookDeliveryEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/incidents

Create incident

Creates an append-only incident record linked to tenant-scoped product and optional release evidence.

Operation ID: createIncident
Tags: evydence
Auth: BearerAuth
Scopes: incident:write
Idempotency: Idempotency-Key
Request: application/json: CreateIncidentRequest
Responses: 201 application/json: IncidentEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/incidents/{id}/timeline

Record incident timeline event

Appends an incident timeline event and optional evidence reference.

Operation ID: recordIncidentTimeline
Tags: evydence
Auth: BearerAuth
Scopes: incident:write
Idempotency: Idempotency-Key
Request: application/json: RecordIncidentTimelineRequest
Responses: 201 application/json: IncidentTimelineEventEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/incidents/{id}/webhook-receivers

Create signed incident webhook receiver

Creates an incident-scoped webhook receiver with an Ed25519 public key. The matching private key stays with the external incident tool.

Operation ID: createIncidentWebhookReceiver
Tags: evydence
Auth: BearerAuth
Scopes: incident:write
Idempotency: Idempotency-Key
Request: application/json: CreateIncidentWebhookReceiverRequest
Responses: 201 application/json: IncidentWebhookReceiverEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/legal-holds

Create legal hold

Creates an append-only legal-hold marker for a tenant-scoped retention subject.

Operation ID: createLegalHold
Tags: evydence
Auth: BearerAuth
Scopes: admin
Idempotency: Idempotency-Key
Request: application/json: CreateLegalHoldRequest
Responses: 201 application/json: LegalHoldEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

GET /v1/marketplace-collectors

List marketplace collector records

Lists tenant-scoped marketplace collector package metadata.

Operation ID: listMarketplaceCollectors
Tags: evydence
Auth: BearerAuth
Scopes: collector:read
Idempotency: not required
Request: none
Responses: 200 application/json: MarketplaceCollectorListEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/marketplace-collectors

Create marketplace collector record

Creates tenant-scoped marketplace collector package metadata and evidence references.

Operation ID: createMarketplaceCollector
Tags: evydence
Auth: BearerAuth
Scopes: collector:admin
Idempotency: Idempotency-Key
Request: application/json: CreateMarketplaceCollectorRequest
Responses: 201 application/json: MarketplaceCollectorEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

GET /v1/marketplace-collectors/{id}/health

Marketplace collector health report

Returns marketplace collector package health from recorded signature, SBOM, and scan evidence.

Operation ID: marketplaceCollectorHealth
Tags: evydence
Auth: BearerAuth
Scopes: collector:read
Idempotency: not required
Request: none
Responses: 200 application/json: MarketplaceCollectorHealthReportEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/merkle-batches

Create Merkle checkpoint batch

Creates a Merkle batch over tenant audit-chain entries for checkpoint export or transparency anchoring.

Operation ID: createMerkleBatch
Tags: evydence
Auth: BearerAuth
Scopes: keys:admin
Idempotency: Idempotency-Key
Request: application/json: CreateMerkleBatchRequest
Responses: 201 application/json: MerkleBatchEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

GET /v1/merkle-batches/{id}/verify

Verify Merkle checkpoint batch

Verifies a tenant-scoped Merkle batch root and leaf set against stored audit-chain entries.

Operation ID: verifyMerkleBatch
Tags: evydence
Auth: BearerAuth
Scopes: verify:read
Idempotency: not required
Request: none
Responses: 200 application/json: VerificationResultEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

GET /v1/metrics

Safe tenant metrics

Returns safe tenant-scoped resource metrics for admin actors. A Prometheus text response is also available when requested with Accept: text/plain.

Operation ID: metrics
Tags: evydence
Auth: BearerAuth
Scopes: admin
Idempotency: not required
Request: none
Responses: 200 application/json: MetricsSnapshotEnvelope, text/plain: string; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/object-retention-policies

Create object retention policy record

Creates an object retention policy record for storage immutability verification.

Operation ID: createObjectRetentionPolicy
Tags: evydence
Auth: BearerAuth
Scopes: admin
Idempotency: Idempotency-Key
Request: application/json: CreateObjectRetentionPolicyRequest
Responses: 201 application/json: ObjectRetentionPolicyEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/object-retention-policies/{id}/verify

Verify object retention policy record

Records verification metadata for a tenant object retention policy.

Operation ID: verifyObjectRetentionPolicy
Tags: evydence
Auth: BearerAuth
Scopes: verify:read
Idempotency: Idempotency-Key
Request: application/json: EmptyObject
Responses: 200 application/json: ObjectRetentionPolicyEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/openapi-contracts

Upload OpenAPI contract

Uploads an OpenAPI 3.1 contract, stores raw bytes as evidence, and records normalized operation metadata.

Operation ID: uploadOpenAPIContract
Tags: evydence
Auth: BearerAuth
Scopes: evidence:write
Idempotency: Idempotency-Key
Request: application/json: UploadOpenAPIContractRequest
Responses: 201 application/json: OpenAPIContractEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

GET /v1/openapi-contracts/{id}

Get OpenAPI contract

Returns a tenant-scoped OpenAPI contract metadata record by id.

Operation ID: getOpenAPIContract
Tags: evydence
Auth: BearerAuth
Scopes: evidence:read
Idempotency: not required
Request: none
Responses: 200 application/json: OpenAPIContractEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/openapi-diffs

Create OpenAPI contract diff

Creates a deterministic OpenAPI contract diff for release contract checks.

Operation ID: createOpenAPIDiff
Tags: evydence
Auth: BearerAuth
Scopes: evidence:read
Idempotency: Idempotency-Key
Request: application/json: CreateOpenAPIDiffRequest
Responses: 201 application/json: ContractDiffEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

GET /v1/openapi.json

OpenAPI

Returns the generated OpenAPI 3.1 document served by this process.

Operation ID: openapi
Tags: evydence
Auth: BearerAuth
Scopes: none
Idempotency: not required
Request: none
Responses: 200 application/json: OpenAPIDocument; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/organizations

Create organization

Creates a tenant-scoped organization record for human identity grouping.

Operation ID: createOrganization
Tags: evydence
Auth: BearerAuth
Scopes: identity:admin
Idempotency: Idempotency-Key
Request: application/json: CreateOrganizationRequest
Responses: 201 application/json: OrganizationEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/policies/evaluate

Evaluate release policy

Evaluates built-in deterministic release policy checks for a release.

Operation ID: evaluatePolicy
Tags: evydence
Auth: BearerAuth
Scopes: verify:read
Idempotency: Idempotency-Key
Request: application/json: EvaluatePolicyRequest
Responses: 201 application/json: PolicyEvaluationEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

GET /v1/products

List products

Lists tenant-scoped products visible to the authenticated actor.

Operation ID: listProducts
Tags: evydence
Auth: BearerAuth
Scopes: product:read
Idempotency: not required
Request: none
Responses: 200 application/json: ProductListEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/products

Create product

Creates a tenant-scoped product. Product slugs must be unique per tenant.

Operation ID: createProduct
Tags: evydence
Auth: BearerAuth
Scopes: product:write
Idempotency: Idempotency-Key
Request: application/json: CreateProductRequest
Responses: 201 application/json: ProductEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

GET /v1/products/{id}

Get product

Returns a tenant-scoped product by id.

Operation ID: getProduct
Tags: evydence
Auth: BearerAuth
Scopes: product:read
Idempotency: not required
Request: none
Responses: 200 application/json: ProductEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/projects

Create project

Creates a tenant-scoped project under a product.

Operation ID: createProject
Tags: evydence
Auth: BearerAuth
Scopes: project:write
Idempotency: Idempotency-Key
Request: application/json: CreateProjectRequest
Responses: 201 application/json: ProjectEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

GET /v1/projects/{id}

Get project

Returns a tenant-scoped project by id.

Operation ID: getProject
Tags: evydence
Auth: BearerAuth
Scopes: project:read
Idempotency: not required
Request: none
Responses: 200 application/json: ProjectEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/provider-verifications

Verify stored provider identity metadata

Verifies stored provider identity metadata and, when supplied, locally verifies OIDC ID-token or SAML assertion issuer, audience, subject, time bounds, and signature against configured tenant trust material.

Operation ID: verifyProviderIdentity
Tags: evydence
Auth: BearerAuth
Scopes: identity:admin
Idempotency: Idempotency-Key
Request: application/json: VerifyProviderIdentityRequest
Responses: 201 application/json: ProviderVerificationEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/public-transparency-log-entries

Publish public transparency log entry record

Records publication metadata for a checkpoint submitted to a configured public transparency log.

Operation ID: publishPublicTransparencyLogEntry
Tags: evydence
Auth: BearerAuth
Scopes: keys:admin
Idempotency: Idempotency-Key
Request: application/json: PublishPublicTransparencyLogEntryRequest
Responses: 201 application/json: PublicTransparencyLogEntryEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/public-transparency-log-entries/{id}/fetch-proof

Fetch and verify public transparency log inclusion proof

Fetches public transparency inclusion proof material from the configured log endpoint or transparency proof gateway and verifies it locally. Endpoint trust and provider semantics remain deployment responsibilities.

Operation ID: fetchPublicTransparencyLogEntryProof
Tags: evydence
Auth: BearerAuth
Scopes: keys:admin
Idempotency: Idempotency-Key
Request: application/json: EmptyObject
Responses: 200 application/json: PublicTransparencyLogEntryEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/public-transparency-log-entries/{id}/verify

Verify public transparency log inclusion proof

Verifies operator-supplied RFC6962-style public transparency inclusion proof material for a published entry.

Operation ID: verifyPublicTransparencyLogEntry
Tags: evydence
Auth: BearerAuth
Scopes: keys:admin
Idempotency: Idempotency-Key
Request: application/json: VerifyPublicTransparencyLogEntryRequest
Responses: 200 application/json: PublicTransparencyLogEntryEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/public-transparency-logs

Create public transparency log record

Creates tenant metadata for an optional public transparency log trust root.

Operation ID: createPublicTransparencyLog
Tags: evydence
Auth: BearerAuth
Scopes: keys:admin
Idempotency: Idempotency-Key
Request: application/json: CreatePublicTransparencyLogRequest
Responses: 201 application/json: PublicTransparencyLogEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

GET /v1/questionnaire-answer-library

List questionnaire answer library entries

Lists tenant-scoped questionnaire answer library entries with optional question, product, and release filters.

Operation ID: listQuestionnaireAnswerLibrary
Tags: evydence
Auth: BearerAuth
Scopes: package:read
Idempotency: not required
Request: none
Responses: 200 application/json: QuestionnaireAnswerLibraryEntryListEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/questionnaire-answer-library

Create questionnaire answer library entry

Creates a tenant-scoped reusable questionnaire answer draft linked to optional evidence, product, release, or control scope.

Operation ID: createQuestionnaireAnswerLibraryEntry
Tags: evydence
Auth: BearerAuth
Scopes: package:write
Idempotency: Idempotency-Key
Request: application/json: CreateQuestionnaireAnswerLibraryEntryRequest
Responses: 201 application/json: QuestionnaireAnswerLibraryEntryEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/questionnaire-drafts

Create evidence-backed questionnaire draft

Creates an evidence-backed questionnaire draft with limitations.

Operation ID: createQuestionnaireDraft
Tags: evydence
Auth: BearerAuth
Scopes: package:read
Idempotency: Idempotency-Key
Request: application/json: CreateQuestionnaireDraftRequest
Responses: 201 application/json: QuestionnaireDraftEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/questionnaire-packages

Create questionnaire package

Creates a questionnaire response package from a template and scoped evidence package.

Operation ID: createQuestionnairePackage
Tags: evydence
Auth: BearerAuth
Scopes: package:write
Idempotency: Idempotency-Key
Request: application/json: CreateQuestionnairePackageRequest
Responses: 201 application/json: QuestionnairePackageEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/questionnaire-templates

Create questionnaire template

Creates a tenant questionnaire template with explicit evidence/control mapping fields.

Operation ID: createQuestionnaireTemplate
Tags: evydence
Auth: BearerAuth
Scopes: package:write
Idempotency: Idempotency-Key
Request: application/json: CreateQuestionnaireTemplateRequest
Responses: 201 application/json: QuestionnaireTemplateEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

GET /v1/ready

Readiness

Returns low-detail process readiness without tenant evidence or secret material.

Operation ID: ready
Tags: evydence
Auth: BearerAuth
Scopes: none
Idempotency: not required
Request: none
Responses: 200 application/json: ReadinessStatusEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/redaction-profiles

Create redaction profile

Creates an explicit redaction profile for customer and report package generation.

Operation ID: createRedactionProfile
Tags: evydence
Auth: BearerAuth
Scopes: package:write
Idempotency: Idempotency-Key
Request: application/json: CreateRedactionProfileRequest
Responses: 201 application/json: RedactionProfileEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/release-bundles

Create release bundle

Creates an immutable signed release bundle for a release.

Operation ID: createReleaseBundle
Tags: evydence
Auth: BearerAuth
Scopes: bundle:write
Idempotency: Idempotency-Key
Request: application/json: CreateReleaseBundleRequest
Responses: 201 application/json: ReleaseBundleEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

GET /v1/release-bundles/{id}

Get release bundle

Returns a tenant-scoped immutable release bundle by id.

Operation ID: getReleaseBundle
Tags: evydence
Auth: BearerAuth
Scopes: bundle:read
Idempotency: not required
Request: none
Responses: 200 application/json: ReleaseBundleEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

GET /v1/release-bundles/{id}/manifest

Get release bundle manifest

Returns the deterministic release bundle manifest by bundle id.

Operation ID: getReleaseBundleManifest
Tags: evydence
Auth: BearerAuth
Scopes: bundle:read
Idempotency: not required
Request: none
Responses: 200 application/json: ReleaseBundleManifestEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

GET /v1/release-bundles/{id}/verify

Verify release bundle

Verifies a tenant-scoped release bundle and returns a deterministic verification result.

Operation ID: verifyReleaseBundle
Tags: evydence
Auth: BearerAuth
Scopes: verify:read
Idempotency: not required
Request: none
Responses: 200 application/json: VerificationResultEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

GET /v1/release-candidates

List release candidates

Lists tenant-scoped release candidates, optionally filtered by release.

Operation ID: listReleaseCandidates
Tags: evydence
Auth: BearerAuth
Scopes: release:read
Idempotency: not required
Request: none
Responses: 200 application/json: ReleaseCandidateListEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/release-candidates

Create release candidate

Creates an immutable release-candidate snapshot of selected release evidence references.

Operation ID: createReleaseCandidate
Tags: evydence
Auth: BearerAuth
Scopes: release:write
Idempotency: Idempotency-Key
Request: application/json: CreateReleaseCandidateRequest
Responses: 201 application/json: ReleaseCandidateEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

GET /v1/release-candidates/{id}

Get release candidate

Returns a tenant-scoped release candidate by id.

Operation ID: getReleaseCandidate
Tags: evydence
Auth: BearerAuth
Scopes: release:read
Idempotency: not required
Request: none
Responses: 200 application/json: ReleaseCandidateEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/release-candidates/{id}/promote

Promote release candidate

Records a release-candidate lifecycle transition without mutating the original snapshot.

Operation ID: promoteReleaseCandidate
Tags: evydence
Auth: BearerAuth
Scopes: release:write
Idempotency: Idempotency-Key
Request: application/json: ReleaseCandidateTransitionRequest
Responses: 200 application/json: ReleaseCandidateEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/release-candidates/{id}/reject

Reject release candidate

Records a release-candidate lifecycle transition without mutating the original snapshot.

Operation ID: rejectReleaseCandidate
Tags: evydence
Auth: BearerAuth
Scopes: release:write
Idempotency: Idempotency-Key
Request: application/json: ReleaseCandidateTransitionRequest
Responses: 200 application/json: ReleaseCandidateEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/releases

Create release

Creates an append-only release record under a product and optional project.

Operation ID: createRelease
Tags: evydence
Auth: BearerAuth
Scopes: release:write
Idempotency: Idempotency-Key
Request: application/json: CreateReleaseRequest
Responses: 201 application/json: ReleaseEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

GET /v1/releases/{id}

Get release

Returns a tenant-scoped release by id.

Operation ID: getRelease
Tags: evydence
Auth: BearerAuth
Scopes: release:read
Idempotency: not required
Request: none
Responses: 200 application/json: ReleaseEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/releases/{id}/approve

Approve release

Approves a release as an append-only transition.

Operation ID: approveRelease
Tags: evydence
Auth: BearerAuth
Scopes: release:write
Idempotency: Idempotency-Key
Request: application/json: EmptyObject
Responses: 200 application/json: ReleaseEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/releases/{id}/evidence-flow/start

Start release evidence flow

Returns a high-level release evidence workflow plan, current evidence counts, required scopes, assumptions, and limitations. This read-only convenience operation does not create evidence.

Operation ID: startReleaseEvidenceFlow
Tags: evydence
Auth: BearerAuth
Scopes: release:read
Idempotency: Idempotency-Key
Request: none
Responses: 200 application/json: ReleaseEvidenceFlowEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/releases/{id}/freeze

Freeze release

Freezes a release as an append-only transition.

Operation ID: freezeRelease
Tags: evydence
Auth: BearerAuth
Scopes: release:write
Idempotency: Idempotency-Key
Request: application/json: EmptyObject
Responses: 200 application/json: ReleaseEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

GET /v1/releases/{id}/security-summary

Release security summary

Returns a tenant-scoped release security summary for review surfaces without raw evidence payload bytes.

Operation ID: releaseSecuritySummary
Tags: evydence
Auth: BearerAuth
Scopes: report:read
Idempotency: not required
Request: none
Responses: 200 application/json: ReleaseSecuritySummaryEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/remediation-tasks

Create remediation task

Creates an incident or release remediation task linked to optional evidence.

Operation ID: createRemediationTask
Tags: evydence
Auth: BearerAuth
Scopes: incident:write
Idempotency: Idempotency-Key
Request: application/json: CreateRemediationTaskRequest
Responses: 201 application/json: RemediationTaskEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/report-templates

Create report template

Creates a tenant-defined deterministic report template with an explicit allowed-field list.

Operation ID: createReportTemplate
Tags: evydence
Auth: BearerAuth
Scopes: report:read
Idempotency: Idempotency-Key
Request: application/json: CreateReportTemplateRequest
Responses: 201 application/json: CustomReportTemplateEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/report-templates/{id}/render

Render report template

Renders a tenant report template for a scoped subject using allowed fields only.

Operation ID: renderReportTemplate
Tags: evydence
Auth: BearerAuth
Scopes: report:read
Idempotency: Idempotency-Key
Request: application/json: RenderReportTemplateRequest
Responses: 201 application/json: RenderedCustomReportEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/reports/anomaly

Generate deterministic anomaly report

Creates a deterministic anomaly report over existing tenant evidence and metrics with assumptions and limitations.

Operation ID: generateAnomalyReport
Tags: evydence
Auth: BearerAuth
Scopes: report:read
Idempotency: Idempotency-Key
Request: application/json: CreateAnomalyReportRequest
Responses: 201 application/json: AnomalyReportEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

GET /v1/reports/control-coverage

Control coverage report

Returns deterministic control coverage with linked evidence, missing evidence, assumptions, and limitations.

Operation ID: controlCoverageReport
Tags: evydence
Auth: BearerAuth
Scopes: report:read
Idempotency: not required
Request: none
Responses: 200 application/json: ReadinessReportEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

GET /v1/reports/cra-readiness

CRA readiness report

Returns a CRA-oriented readiness report without legal compliance or certification conclusions.

Operation ID: craReadinessReport
Tags: evydence
Auth: BearerAuth
Scopes: report:read
Idempotency: not required
Request: none
Responses: 200 application/json: ReadinessReportEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

GET /v1/reports/cra-readiness-html

CRA readiness HTML package

Creates a deterministic CRA-readiness HTML package without legal compliance or certification conclusions.

Operation ID: craReadinessHTMLPackage
Tags: evydence
Auth: BearerAuth
Scopes: report:read
Idempotency: not required
Request: none
Responses: 200 application/json: HTMLReportPackageEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

GET /v1/reports/cra-vulnerability-handling

CRA vulnerability handling report

Returns a CRA-oriented vulnerability handling evidence report without legal compliance, certification, scanner-authority, or release-security conclusions.

Operation ID: craVulnerabilityHandlingReport
Tags: evydence
Auth: BearerAuth
Scopes: report:read
Idempotency: not required
Request: none
Responses: 200 application/json: CRAVulnerabilityHandlingReportEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

GET /v1/reports/custody-review

Signing custody review report

Returns tenant signing-provider and object-lock verification metadata for deployment custody review. It is evidence metadata only, not legal compliance proof, certification, HSM custody proof, or a secure-deployment guarantee.

Operation ID: signingCustodyReviewReport
Tags: evydence
Auth: BearerAuth
Scopes: keys:admin
Idempotency: not required
Request: none
Responses: 200 application/json: SigningCustodyReviewReportEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

GET /v1/reports/incident-package

Incident package report

Returns a deterministic incident package report with timeline, remediation tasks, linked evidence, assumptions, and limitations.

Operation ID: incidentReport
Tags: evydence
Auth: BearerAuth
Scopes: incident:read
Idempotency: not required
Request: none
Responses: 200 application/json: IncidentReportEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

GET /v1/reports/missing-evidence

Missing evidence report

Returns a deterministic missing-evidence report for a release with assumptions and limitations.

Operation ID: missingEvidenceReport
Tags: evydence
Auth: BearerAuth
Scopes: verify:read
Idempotency: not required
Request: none
Responses: 200 application/json: MissingEvidenceReportEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/reports/pdf

Create reproducible PDF report package

Creates a deterministic PDF report package record and payload metadata.

Operation ID: createPDFReportPackage
Tags: evydence
Auth: BearerAuth
Scopes: report:read
Idempotency: Idempotency-Key
Request: application/json: CreatePDFReportPackageRequest
Responses: 201 application/json: PDFReportPackageEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

GET /v1/reports/release-readiness

Release readiness report

Returns a deterministic release-readiness report with gaps, assumptions, and limitations.

Operation ID: releaseReadinessReport
Tags: evydence
Auth: BearerAuth
Scopes: verify:read
Idempotency: not required
Request: none
Responses: 200 application/json: ReadinessReportEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

GET /v1/reports/retention

Retention report

Returns a retention report for tenant-scoped holds and overrides with storage verification limitations.

Operation ID: retentionReport
Tags: evydence
Auth: BearerAuth
Scopes: admin
Idempotency: not required
Request: none
Responses: 200 application/json: RetentionReportEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

GET /v1/reports/security-review-package

Security review package report

Returns a redaction-aware security-review package report with assumptions and limitations.

Operation ID: securityReviewPackageReport
Tags: evydence
Auth: BearerAuth
Scopes: package:read
Idempotency: not required
Request: none
Responses: 200 application/json: SecurityReviewPackageReportEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

GET /v1/reports/security-update-evidence

Security update evidence report

Returns a security update evidence report for release-scoped fixed decisions, incidents, remediation tasks, and linked evidence without legal or security conclusions.

Operation ID: securityUpdateEvidenceReport
Tags: evydence
Auth: BearerAuth
Scopes: report:read
Idempotency: not required
Request: none
Responses: 200 application/json: SecurityUpdateEvidenceReportEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

GET /v1/reports/vulnerability-decision-summary

Customer-safe vulnerability decision summary

Returns customer-safe active vulnerability decision summaries for a release with assumptions and limitations. Raw payloads and internal notes are excluded.

Operation ID: vulnerabilityDecisionSummaryReport
Tags: evydence
Auth: BearerAuth
Scopes: report:read
Idempotency: not required
Request: none
Responses: 200 application/json: VulnerabilityDecisionSummaryReportEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

GET /v1/reports/vulnerability-posture

Vulnerability posture report

Returns a vulnerability posture report derived from stored scan, decision, VEX, exception, and workflow records.

Operation ID: vulnerabilityPostureReport
Tags: evydence
Auth: BearerAuth
Scopes: security:read
Idempotency: not required
Request: none
Responses: 200 application/json: VulnerabilityPostureReportEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/retention-overrides

Create retention override

Creates an append-only retention override for a tenant-scoped retention subject.

Operation ID: createRetentionOverride
Tags: evydence
Auth: BearerAuth
Scopes: admin
Idempotency: Idempotency-Key
Request: application/json: CreateRetentionOverrideRequest
Responses: 201 application/json: RetentionOverrideEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

GET /v1/role-bindings

List role bindings

Lists tenant-scoped role bindings visible to the identity administrator.

Operation ID: listRoleBindings
Tags: evydence
Auth: BearerAuth
Scopes: identity:admin
Idempotency: not required
Request: none
Responses: 200 application/json: RoleBindingListEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/role-bindings

Create role binding

Creates a tenant-scoped role binding for a user or collector subject.

Operation ID: createRoleBinding
Tags: evydence
Auth: BearerAuth
Scopes: identity:admin
Idempotency: Idempotency-Key
Request: application/json: CreateRoleBindingRequest
Responses: 201 application/json: RoleBindingEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/saas/profiles

Create SaaS edition profile

Creates a SaaS edition profile record for future hosted deployment planning; it is not a production readiness claim.

Operation ID: createSaaSEditionProfile
Tags: evydence
Auth: BearerAuth
Scopes: instance:admin
Idempotency: Idempotency-Key
Request: application/json: CreateSaaSEditionProfileRequest
Responses: 201 application/json: SaaSEditionProfileEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

GET /v1/sbom-components

List SBOM components

Lists tenant-scoped SBOM components by SBOM, release, artifact, name/version/PURL query, or exact PURL.

Operation ID: listSBOMComponents
Tags: evydence
Auth: BearerAuth
Scopes: evidence:read
Idempotency: not required
Request: none
Responses: 200 application/json: SBOMComponentRecordListEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/sbom-diffs

Create SBOM diff

Creates a deterministic SBOM diff between two tenant-scoped SBOM records.

Operation ID: createSBOMDiff
Tags: evydence
Auth: BearerAuth
Scopes: evidence:read
Idempotency: Idempotency-Key
Request: application/json: CreateSBOMDiffRequest
Responses: 201 application/json: SBOMDiffEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/sboms

Upload CycloneDX SBOM

Uploads a CycloneDX SBOM payload, stores raw bytes in object storage, and records normalized SBOM metadata.

Operation ID: uploadSBOM
Tags: evydence
Auth: BearerAuth
Scopes: evidence:write
Idempotency: Idempotency-Key
Request: application/json: EvidenceUploadRequest
Responses: 201 application/json: SBOMEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/sboms/spdx

Upload SPDX SBOM

Uploads an SPDX JSON SBOM payload, stores raw bytes as evidence, and records normalized SBOM metadata.

Operation ID: uploadSPDXSBOM
Tags: evydence
Auth: BearerAuth
Scopes: evidence:write
Idempotency: Idempotency-Key
Request: application/json: UploadSPDXSBOMRequest
Responses: 201 application/json: SBOMEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

GET /v1/sboms/{id}

Get SBOM

Returns a tenant-scoped SBOM metadata record by id.

Operation ID: getSBOM
Tags: evydence
Auth: BearerAuth
Scopes: evidence:read
Idempotency: not required
Request: none
Responses: 200 application/json: SBOMEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/security-documents

Upload manual security document

Uploads sensitive manual security evidence such as threat model, security review, or penetration-test report metadata and raw payload reference.

Operation ID: uploadManualSecurityDocument
Tags: evydence
Auth: BearerAuth
Scopes: security:write
Idempotency: Idempotency-Key
Request: application/json: UploadManualSecurityDocumentRequest
Responses: 201 application/json: ManualSecurityDocumentEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/security-scans

Upload security scan

Uploads SAST, DAST, secret, license, or API security scan metadata and raw JSON payload evidence without exposing raw payload bytes in responses.

Operation ID: uploadSecurityScan
Tags: evydence
Auth: BearerAuth
Scopes: security:write
Idempotency: Idempotency-Key
Request: application/json: UploadSecurityScanRequest
Responses: 201 application/json: SecurityScanEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

GET /v1/signing-keys

List signing keys

Lists tenant signing public-key metadata without private key material.

Operation ID: listSigningKeys
Tags: evydence
Auth: BearerAuth
Scopes: verify:read
Idempotency: not required
Request: none
Responses: 200 application/json: SigningKeyListEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/signing-keys/rotate

Rotate signing key

Rotates the active tenant signing key and returns public-key metadata only.

Operation ID: rotateSigningKey
Tags: evydence
Auth: BearerAuth
Scopes: keys:admin
Idempotency: Idempotency-Key
Request: application/json: SigningKeyTransitionRequest
Responses: 201 application/json: SigningKeyEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/signing-keys/{id}/revoke

Revoke signing key

Revokes a tenant signing key as an audited lifecycle transition.

Operation ID: revokeSigningKey
Tags: evydence
Auth: BearerAuth
Scopes: keys:admin
Idempotency: Idempotency-Key
Request: application/json: SigningKeyTransitionRequest
Responses: 200 application/json: SigningKeyEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/signing-operations

Create signing provider operation receipt

Records an external signing operation receipt and checks payload/signature metadata without logging secrets. When the API is configured with a signing executor, external_signature may be omitted and the executor signs the payload hash.

Operation ID: createSigningOperation
Tags: evydence
Auth: BearerAuth
Scopes: keys:admin
Idempotency: Idempotency-Key
Request: application/json: CreateSigningOperationRequest
Responses: 201 application/json: SigningOperationEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/signing-providers

Create signing provider record

Creates signing provider metadata for external signing operations. Production private key material must not be supplied.

Operation ID: createSigningProvider
Tags: evydence
Auth: BearerAuth
Scopes: keys:admin
Idempotency: Idempotency-Key
Request: application/json: CreateSigningProviderRequest
Responses: 201 application/json: SigningProviderEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/source/branches

Record source branch

Records or updates source branch metadata and protected-branch snapshot hash.

Operation ID: upsertSourceBranch
Tags: evydence
Auth: BearerAuth
Scopes: source:write
Idempotency: Idempotency-Key
Request: application/json: UpsertSourceBranchRequest
Responses: 201 application/json: SourceBranchEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/source/commits

Record source commit

Records immutable source commit metadata and stores only a hash of the commit message.

Operation ID: recordSourceCommit
Tags: evydence
Auth: BearerAuth
Scopes: source:write
Idempotency: Idempotency-Key
Request: application/json: RecordSourceCommitRequest
Responses: 201 application/json: SourceCommitEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/source/pull-requests

Record pull request

Records pull-request review metadata linked to source repository evidence.

Operation ID: recordPullRequest
Tags: evydence
Auth: BearerAuth
Scopes: source:write
Idempotency: Idempotency-Key
Request: application/json: RecordPullRequestRequest
Responses: 201 application/json: PullRequestEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

GET /v1/source/repositories

List source repositories

Lists tenant-scoped source repositories, optionally filtered by project.

Operation ID: listSourceRepositories
Tags: evydence
Auth: BearerAuth
Scopes: source:read
Idempotency: not required
Request: none
Responses: 200 application/json: SourceRepositoryListEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/source/repositories

Create source repository

Creates a tenant-scoped source repository record.

Operation ID: createSourceRepository
Tags: evydence
Auth: BearerAuth
Scopes: source:write
Idempotency: Idempotency-Key
Request: application/json: CreateSourceRepositoryRequest
Responses: 201 application/json: SourceRepositoryEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/sso/identity-links

Link SSO identity

Links a verified provider subject to a tenant-scoped human user.

Operation ID: linkSSOIdentity
Tags: evydence
Auth: BearerAuth
Scopes: identity:admin
Idempotency: Idempotency-Key
Request: application/json: LinkSSOIdentityRequest
Responses: 201 application/json: UserIdentityLinkEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/sso/logout

Logout SSO session

Revokes the currently authenticated SSO session without requiring identity administrator privileges. API keys and collector keys cannot use this route.

Operation ID: logoutSSOSession
Tags: evydence
Auth: BearerAuth
Scopes: none
Idempotency: Idempotency-Key
Request: application/json: EmptyObject
Responses: 200 application/json: SSOSessionEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/sso/providers

Create SSO provider

Records tenant SSO provider metadata. Optional static JWKS public keys and SAML signing certificates can be supplied for local token/assertion verification without live provider calls.

Operation ID: createSSOProvider
Tags: evydence
Auth: BearerAuth
Scopes: identity:admin
Idempotency: Idempotency-Key
Request: application/json: CreateSSOProviderRequest
Responses: 201 application/json: SSOProviderEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/sso/providers/{id}/discover-oidc

Refresh SSO provider OIDC trust material

Fetches the OIDC discovery document and public JWKS for the tenant provider issuer, then stores refreshed public trust material. This does not authenticate users, store provider secrets, or synchronize groups.

Operation ID: refreshSSOProviderOIDCTrustMaterial
Tags: evydence
Auth: BearerAuth
Scopes: identity:admin
Idempotency: Idempotency-Key
Request: application/json: EmptyObject
Responses: 200 application/json: SSOProviderEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/sso/providers/{id}/trust-material

Update SSO provider trust material

Rotates tenant SSO provider public trust material for local OIDC ID-token or SAML assertion verification without storing provider secrets.

Operation ID: updateSSOProviderTrustMaterial
Tags: evydence
Auth: BearerAuth
Scopes: identity:admin
Idempotency: Idempotency-Key
Request: application/json: UpdateSSOProviderTrustMaterialRequest
Responses: 200 application/json: SSOProviderEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/sso/session-exchanges

Exchange SSO credential

Exchanges a locally verified OIDC ID token or SAML assertion for an SSO session and HttpOnly browser cookie using configured tenant trust material and verified identity links. No live provider API or group synchronization call is made.

Operation ID: exchangeSSOCredential
Tags: evydence
Auth: BearerAuth
Scopes: none
Idempotency: not required
Request: application/json: ExchangeSSOCredentialRequest
Responses: 201 application/json: SSOCredentialExchangeEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/sso/sessions

Create SSO session

Creates an admin-managed human SSO session record and returns a one-time bearer secret.

Operation ID: createSSOSession
Tags: evydence
Auth: BearerAuth
Scopes: identity:admin
Idempotency: Idempotency-Key
Request: application/json: CreateSSOSessionRequest
Responses: 201 application/json: SSOSessionCreateEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/sso/sessions/{id}/revoke

Revoke SSO session

Revokes a tenant-scoped SSO session as an audited lifecycle transition.

Operation ID: revokeSSOSession
Tags: evydence
Auth: BearerAuth
Scopes: identity:admin
Idempotency: Idempotency-Key
Request: application/json: EmptyObject
Responses: 200 application/json: SSOSessionEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/transparency-checkpoints

Record external transparency checkpoint

Records an external transparency or timestamp checkpoint reference for a Merkle batch.

Operation ID: createTransparencyCheckpoint
Tags: evydence
Auth: BearerAuth
Scopes: keys:admin
Idempotency: Idempotency-Key
Request: application/json: CreateTransparencyCheckpointRequest
Responses: 201 application/json: TransparencyCheckpointEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/users

Create user

Creates a tenant-scoped human user metadata record. Authentication is still controlled by API keys or configured SSO/session flows.

Operation ID: createUser
Tags: evydence
Auth: BearerAuth
Scopes: identity:admin
Idempotency: Idempotency-Key
Request: application/json: CreateUserRequest
Responses: 201 application/json: HumanUserEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/users/{id}/deactivate

Deactivate user

Deactivates a tenant-scoped human user as an audited lifecycle transition.

Operation ID: deactivateUser
Tags: evydence
Auth: BearerAuth
Scopes: identity:admin
Idempotency: Idempotency-Key
Request: application/json: EmptyObject
Responses: 200 application/json: HumanUserEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/verify

Verify subject

Verifies a supported tenant-scoped subject such as evidence, audit chain, release bundle, artifact signature, or related verification target.

Operation ID: verify
Tags: evydence
Auth: BearerAuth
Scopes: verify:read
Idempotency: Idempotency-Key
Request: application/json: VerifySubjectRequest
Responses: 200 application/json: VerificationResultEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

GET /v1/version

Version

Returns the API process version string.

Operation ID: version
Tags: evydence
Auth: BearerAuth
Scopes: none
Idempotency: not required
Request: none
Responses: 200 application/json: VersionInfoEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/vex

Upload OpenVEX document

Uploads VEX payload bytes, stores raw evidence in object storage, and records normalized VEX metadata and decisions where applicable.

Operation ID: uploadVEX
Tags: evydence
Auth: BearerAuth
Scopes: evidence:write
Idempotency: Idempotency-Key
Request: application/json: EvidenceUploadRequest
Responses: 201 application/json: VEXDocumentEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/vex/cyclonedx

Upload CycloneDX VEX document

Uploads VEX payload bytes, stores raw evidence in object storage, and records normalized VEX metadata and decisions where applicable.

Operation ID: uploadCycloneDXVEX
Tags: evydence
Auth: BearerAuth
Scopes: evidence:write
Idempotency: Idempotency-Key
Request: application/json: EvidenceUploadRequest
Responses: 201 application/json: VEXDocumentEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/vex/cyclonedx/preview

Preview CycloneDX VEX import

Validates a CycloneDX VEX payload and returns advisory mapping counts without storing raw payloads, creating evidence, creating decisions, or enqueueing parser jobs.

Operation ID: previewCycloneDXVEXImport
Tags: evydence
Auth: BearerAuth
Scopes: evidence:read
Idempotency: not required
Request: application/json: EvidenceUploadRequest
Responses: 200 application/json: VEXImportPreviewEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/vex/preview

Preview OpenVEX import

Validates an OpenVEX payload and returns advisory mapping counts without storing raw payloads, creating evidence, creating decisions, or enqueueing parser jobs.

Operation ID: previewVEXImport
Tags: evydence
Auth: BearerAuth
Scopes: evidence:read
Idempotency: not required
Request: application/json: EvidenceUploadRequest
Responses: 200 application/json: VEXImportPreviewEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

GET /v1/vex/{id}

Get VEX document

Returns a tenant-scoped VEX document metadata record by id.

Operation ID: getVEX
Tags: evydence
Auth: BearerAuth
Scopes: evidence:read
Idempotency: not required
Request: none
Responses: 200 application/json: VEXDocumentEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

GET /v1/vex/{id}/import-report

Get VEX import report

Returns the persisted parser report for a tenant-scoped VEX import, including counts, warnings, and mapping failures without raw payload bytes.

Operation ID: getVEXImportReport
Tags: evydence
Auth: BearerAuth
Scopes: evidence:read
Idempotency: not required
Request: none
Responses: 200 application/json: VEXImportReportEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

GET /v1/vulnerability-decisions

List vulnerability decisions

Lists append-only vulnerability decisions over time with tenant-scoped product, release, vulnerability, component, status, and active filters.

Operation ID: listVulnerabilityDecisions
Tags: evydence
Auth: BearerAuth
Scopes: evidence:read
Idempotency: not required
Request: none
Responses: 200 application/json: VulnerabilityDecisionListEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/vulnerability-findings/{id}/decisions

Create vulnerability decision

Creates an append-only vulnerability decision for a tenant-scoped scan finding.

Operation ID: createVulnerabilityDecision
Tags: evydence
Auth: BearerAuth
Scopes: evidence:write
Idempotency: Idempotency-Key
Request: application/json: CreateVulnerabilityDecisionRequest
Responses: 201 application/json: VulnerabilityDecisionEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/vulnerability-findings/{id}/workflow

Record vulnerability workflow event

Records an append-only vulnerability workflow event for a tenant-scoped finding.

Operation ID: recordVulnerabilityWorkflow
Tags: evydence
Auth: BearerAuth
Scopes: security:write
Idempotency: Idempotency-Key
Request: application/json: RecordVulnerabilityWorkflowRequest
Responses: 201 application/json: VulnerabilityWorkflowRecordEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/vulnerability-scans

Upload vulnerability scan

Uploads a generic vulnerability scan JSON payload and records normalized findings.

Operation ID: uploadVulnerabilityScan
Tags: evydence
Auth: BearerAuth
Scopes: evidence:write
Idempotency: Idempotency-Key
Request: application/json: UploadVulnerabilityScanRequest
Responses: 201 application/json: VulnerabilityScanEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

GET /v1/vulnerability-scans/{id}

Get vulnerability scan

Returns a tenant-scoped vulnerability scan by id.

Operation ID: getVulnerabilityScan
Tags: evydence
Auth: BearerAuth
Scopes: evidence:read
Idempotency: not required
Request: none
Responses: 200 application/json: VulnerabilityScanEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/waivers

Create waiver

Creates a first-class scoped waiver for controls or policies. Approval is a separate audited transition.

Operation ID: createWaiver
Tags: evydence
Auth: BearerAuth
Scopes: policy:write
Idempotency: Idempotency-Key
Request: application/json: CreateWaiverRequest
Responses: 201 application/json: WaiverEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

POST /v1/waivers/{id}/approve

Approve waiver

Approves an unexpired waiver as an audited transition.

Operation ID: approveWaiver
Tags: evydence
Auth: BearerAuth
Scopes: policy:write
Idempotency: Idempotency-Key
Request: application/json: EmptyObject
Responses: 200 application/json: WaiverEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem

Schemas

Name	Shape	Required fields
`APIKey`	object	id, tenant_id, name, prefix, scopes, created_at
`APIKeyCreateEnvelope`	object	data, meta
`APIKeyCreateResponse`	object	api_key, secret
`APIKeyListEnvelope`	object	data, meta
`AnomalyReport`	object	id, tenant_id, subject_type, subject_id, result, assumptions, limitations, schema_version, created_at
`AnomalyReportEnvelope`	object	data, meta
`AnomalySignal`	object	name, severity, detail
`ApprovalRecord`	object	id, tenant_id, subject_type, subject_id, decision, reason, approver_id, schema_version, created_at
`ApprovalRecordEnvelope`	object	data, meta
`Artifact`	object	id, tenant_id, name, digest, schema_version, created_at
`ArtifactEnvelope`	object	data, meta
`ArtifactSignature`	object	id, tenant_id, artifact_id, subject_digest, algorithm, signature, verification_status, schema_version, created_at
`ArtifactSignatureEnvelope`	object	data, meta
`AuditChainEntry`	object	id, tenant_id, sequence, entry_type, subject_type, subject_id, actor_type, actor_id, occurred_at, canonical_entry_hash, previous_entry_hash, entry_hash, schema_version
`AuditChainEntryListEnvelope`	object	data, meta
`BackupManifest`	object	id, tenant_id, state_hash, resource_counts, consistency_checks, limitations, schema_version, created_at
`BackupManifestEnvelope`	object	data, meta
`BuildAttestation`	object	id, tenant_id, build_id, evidence_id, payload_hash, payload_size, payload_type, predicate_type, subject_digests, signature_count, verification_status, schema_version, created_at
`BuildAttestationEnvelope`	object	data, meta
`BuildRun`	object	id, tenant_id, project_id, release_id, provider, commit_sha, status, schema_version, created_at
`BuildRunEnvelope`	object	data, meta
`CRAVulnerabilityHandlingReport`	object	report_type, template_version, product_id, release_id, summary, assumptions, limitations, generated_at
`CRAVulnerabilityHandlingReportEnvelope`	object	data, meta
`Collector`	object	id, tenant_id, name, type, version, api_key_id, status, allowed_scopes, schema_version, created_at
`CollectorCreateEnvelope`	object	data, meta
`CollectorCreateResponse`	object	collector, api_key, secret
`CollectorHealthReport`	object	report_type, collector_id, collector_status, supply_chain_status, checks, assumptions, limitations, generated_at
`CollectorHealthReportEnvelope`	object	data, meta
`CollectorListEnvelope`	object	data, meta
`CollectorRelease`	object	id, tenant_id, collector_id, version, artifact_digest, pinned, verification_status, health_status, schema_version, created_at
`CollectorReleaseEnvelope`	object	data, meta
`CommercialCollectorDefinition`	object	id, tenant_id, name, provider, version, manifest_hash, allowed_scopes, status, schema_version, created_at
`CommercialCollectorDefinitionEnvelope`	object	data, meta
`CommercialCollectorDefinitionListEnvelope`	object	data, meta
`ContainerImage`	object	id, tenant_id, repository, digest, schema_version, created_at
`ContainerImageEnvelope`	object	data, meta
`ContractDiff`	object	id, tenant_id, base_contract_id, target_contract_id, product_id, result, schema_version, created_at
`ContractDiffEnvelope`	object	data, meta
`ControlEvidence`	object	id, tenant_id, control_id, evidence_type, subject_type, subject_id, confidence, schema_version, created_at
`ControlEvidenceEnvelope`	object	data, meta
`ControlEvidenceListEnvelope`	object	data, meta
`ControlEvidenceRequirement`	object	type, required
`ControlFramework`	object	id, tenant_id, name, slug, version, status, schema_version, created_at
`ControlFrameworkEnvelope`	object	data, meta
`ControlFrameworkListEnvelope`	object	data, meta
`ControlFrameworkTemplatePack`	object	id, name, slug, version, controls, schema_version
`ControlFrameworkTemplatePackListEnvelope`	object	data, meta
`CosignVerification`	object	id, tenant_id, artifact_signature_id, subject_digest, result, checks, schema_version, created_at
`CosignVerificationEnvelope`	object	data, meta
`CreateAPIKeyRequest`	object	name, scopes
`CreateAnomalyReportRequest`	object	subject_type, subject_id
`CreateApprovalRequest`	object	subject_type, subject_id, decision, reason
`CreateArtifactSignatureRequest`	object	artifact_id, algorithm, signature
`CreateBuildRequest`	object	project_id, release_id, provider, commit_sha, status, started_at
`CreateCollectorRequest`	object	name, type, version
`CreateCommercialCollectorRequest`	object	name, provider, version, manifest_hash
`CreateControlFrameworkRequest`	object	name, version
`CreateCustomPolicyRequest`	object	name, version, rules
`CreateCustomerPackageRequest`	object	product_id, redaction_profile_id, title, expires_at
`CreateCustomerPortalAccessRequest`	object	package_id, customer_name, expires_at
`CreateDSSETrustRootRequest`	object	name, key_id, algorithm, public_key
`CreateDeploymentEnvironmentRequest`	object	product_id, name, kind
`CreateEvidenceRequest`	object	type, title, payload_hash
`CreateEvidenceSummaryRequest`	object	subject_type, subject_id, evidence_ids
`CreateExceptionRequest`	object	release_id, reason, owner, expires_at
`CreateGraphSnapshotRequest`	object	none
`CreateIncidentRequest`	object	product_id, title, severity
`CreateIncidentWebhookReceiverRequest`	object	name, provider, public_key
`CreateLegalHoldRequest`	object	scope_type, scope_id, reason, owner
`CreateMarketplaceCollectorRequest`	object	name, provider, version, publisher, manifest_hash
`CreateMerkleBatchRequest`	object	none
`CreateObjectRetentionPolicyRequest`	object	name, mode, retention_days
`CreateOpenAPIDiffRequest`	object	base_contract_id, target_contract_id, release_id
`CreateOrganizationRequest`	object	name, slug
`CreatePDFReportPackageRequest`	object	report_type, title
`CreateProductRequest`	object	name, slug
`CreateProjectRequest`	object	product_id, name, slug
`CreatePublicTransparencyLogRequest`	object	name, endpoint, public_key
`CreateQuestionnaireAnswerLibraryEntryRequest`	object	answer
`CreateQuestionnaireDraftRequest`	object	template_id
`CreateQuestionnairePackageRequest`	object	template_id
`CreateQuestionnaireTemplateRequest`	object	name, version, questions
`CreateRedactionProfileRequest`	object	none
`CreateReleaseBundleRequest`	object	release_id
`CreateReleaseCandidateRequest`	object	release_id, name
`CreateReleaseRequest`	object	product_id, version
`CreateRemediationTaskRequest`	object	title, owner
`CreateReportTemplateRequest`	object	name, version, report_type, allowed_fields, template
`CreateRetentionOverrideRequest`	object	scope_type, scope_id, retention_until, reason, owner
`CreateRoleBindingRequest`	object	subject_type, subject_id, role
`CreateSBOMDiffRequest`	object	base_sbom_id, target_sbom_id
`CreateSSOProviderRequest`	object	name, type, issuer, client_id
`CreateSSOSessionRequest`	object	user_id, provider_id, expires_at
`CreateSaaSEditionProfileRequest`	object	name, region, admin_tenant_id, isolation_model
`CreateSecurityControlRequest`	object	framework_id, code, title, objective
`CreateSigningOperationRequest`	object	provider_id, subject_type, subject_id, payload_hash
`CreateSigningProviderRequest`	object	name, type, key_ref
`CreateSourceRepositoryRequest`	object	provider, full_name
`CreateTransparencyCheckpointRequest`	object	batch_id, provider
`CreateUserRequest`	object	email, display_name
`CreateVulnerabilityDecisionRequest`	object	status, justification
`CreateWaiverRequest`	object	scope_type, scope_id, owner, risk, reason, expires_at
`CustomPolicy`	object	id, tenant_id, name, version, rules, schema_version, created_at
`CustomPolicyEnvelope`	object	data, meta
`CustomPolicyEvaluation`	object	id, tenant_id, policy_id, release_id, result, checks, input_hash, schema_version, created_at
`CustomPolicyEvaluationEnvelope`	object	data, meta
`CustomReportTemplate`	object	id, tenant_id, name, version, report_type, allowed_fields, template, schema_version, created_at
`CustomReportTemplateEnvelope`	object	data, meta
`CustomerPortalAccess`	object	id, tenant_id, package_id, customer_name, prefix, expires_at, access_count, failed_access_count, schema_version, created_at
`CustomerPortalAccessCreateEnvelope`	object	data, meta
`CustomerPortalAccessCreateResponse`	object	access, secret
`CustomerPortalAccessEnvelope`	object	data, meta
`CustomerPortalAccessListEnvelope`	object	data, meta
`CustomerPortalPackageRequest`	object	token
`CustomerSecurityPackage`	object	id, tenant_id, product_id, redaction_profile_id, title, state, manifest, manifest_hash, expires_at, access_count, schema_version, created_at
`CustomerSecurityPackageEnvelope`	object	data, meta
`DSSEEnvelope`	object	payloadType, payload, signatures
`DSSETrustRoot`	object	id, tenant_id, name, key_id, algorithm, public_key, status, schema_version, created_at
`DSSETrustRootEnvelope`	object	data, meta
`DataEnvelope`	object	data, meta
`DependencyChange`	object	id, tenant_id, sbom_diff_id, change_type, component, schema_version, created_at
`DeploymentEnvironment`	object	id, tenant_id, product_id, name, kind, schema_version, created_at
`DeploymentEnvironmentEnvelope`	object	data, meta
`DeploymentEnvironmentListEnvelope`	object	data, meta
`DeploymentEvent`	object	id, tenant_id, environment_id, release_id, status, started_at, schema_version, created_at
`DeploymentEventEnvelope`	object	data, meta
`DeploymentEventListEnvelope`	object	data, meta
`EmptyObject`	object	none
`EvaluatePolicyRequest`	object	release_id
`EvidenceBundle`	object	id, tenant_id, evidence_ids, manifest, manifest_hash, verification_text, schema_version, created_at
`EvidenceBundleEnvelope`	object	data, meta
`EvidenceBundleImport`	object	id, tenant_id, bundle_hash, result, imported_count, schema_version, created_at
`EvidenceBundleImportEnvelope`	object	data, meta
`EvidenceCitation`	object	evidence_id, type, title, canonical_hash
`EvidenceGraphEdge`	object	from, to, relationship
`EvidenceGraphNode`	object	id, type, label
`EvidenceGraphSnapshot`	object	id, tenant_id, nodes, edges, graph_hash, limitations, schema_version, created_at
`EvidenceGraphSnapshotEnvelope`	object	data, meta
`EvidenceItem`	object	id, tenant_id, type, title, source_system, observed_at, evidence_version, schema_version, payload_hash, canonical_hash, canonicalization, trust_level, verification_status, chain_entry_id, created_at
`EvidenceItemEnvelope`	object	data, meta
`EvidenceItemListEnvelope`	object	data, meta
`EvidenceLifecycleEvent`	object	id, tenant_id, evidence_id, action, reason, actor_id, schema_version, created_at
`EvidenceLifecycleEventEnvelope`	object	data, meta
`EvidenceLifecycleEventListEnvelope`	object	data, meta
`EvidenceNotice`	object	code, message
`EvidenceRef`	object	type, id
`EvidenceSearchEnvelope`	object	data, meta
`EvidenceSearchResponse`	object	items
`EvidenceSummary`	object	id, tenant_id, subject_type, subject_id, evidence_ids, summary, citations, assumptions, limitations, schema_version, created_at
`EvidenceSummaryEnvelope`	object	data, meta
`EvidenceUploadRequest`	object	release_id, payload
`Exception`	object	id, tenant_id, release_id, reason, owner, expires_at, approved, created_at
`ExceptionEnvelope`	object	data, meta
`ExceptionListEnvelope`	object	data, meta
`ExchangeSSOCredentialRequest`	object	provider_id, subject
`ExportEvidenceBundleRequest`	object	none
`HTMLReportPackage`	object	id, tenant_id, report_type, product_id, html, hash, schema_version, created_at
`HTMLReportPackageEnvelope`	object	data, meta
`HealthStatus`	object	status
`HealthStatusEnvelope`	object	data, meta
`HumanUser`	object	id, tenant_id, email, display_name, status, schema_version, created_at
`HumanUserEnvelope`	object	data, meta
`Incident`	object	id, tenant_id, product_id, title, severity, status, opened_at, schema_version, created_at
`IncidentEnvelope`	object	data, meta
`IncidentReport`	object	report_type, template_version, incident_id, result, timeline, tasks, assumptions, limitations, generated_at
`IncidentReportEnvelope`	object	data, meta
`IncidentTimelineEvent`	object	id, tenant_id, incident_id, event_type, summary, occurred_at, schema_version, created_at
`IncidentTimelineEventEnvelope`	object	data, meta
`IncidentWebhookDelivery`	object	webhook_event, timeline_event
`IncidentWebhookDeliveryEnvelope`	object	data, meta
`IncidentWebhookEvent`	object	id, tenant_id, receiver_id, incident_id, provider, event_id, payload_hash, signature_hash, result, schema_version, created_at
`IncidentWebhookReceiver`	object	id, tenant_id, incident_id, name, provider, public_key, status, schema_version, created_at
`IncidentWebhookReceiverEnvelope`	object	data, meta
`InstanceAdminSnapshot`	object	report_type, tenant_count, resource_counts, limitations, generated_at
`InstanceAdminSnapshotEnvelope`	object	data, meta
`LegalHold`	object	id, tenant_id, scope_type, scope_id, reason, owner, schema_version, created_at
`LegalHoldEnvelope`	object	data, meta
`LinkControlEvidenceRequest`	object	evidence_type, subject_type, subject_id, confidence
`LinkEvidenceRequest`	object	target_type, target_id
`LinkSSOIdentityRequest`	object	user_id, provider_id, subject, email, verified
`ManualSecurityDocument`	object	id, tenant_id, document_type, title, sensitivity, evidence_id, payload_hash, schema_version, created_at
`ManualSecurityDocumentEnvelope`	object	data, meta
`MarketplaceCollector`	object	id, tenant_id, name, provider, version, publisher, manifest_hash, state, schema_version, created_at
`MarketplaceCollectorEnvelope`	object	data, meta
`MarketplaceCollectorHealthReport`	object	report_type, collector_id, name, provider, version, supply_chain_status, checks, collector, assumptions, limitations, generated_at
`MarketplaceCollectorHealthReportEnvelope`	object	data, meta
`MarketplaceCollectorListEnvelope`	object	data, meta
`MerkleBatch`	object	id, tenant_id, from_sequence, to_sequence, entry_count, leaf_hashes, root_hash, schema_version, created_at
`MerkleBatchEnvelope`	object	data, meta
`MetricsSnapshot`	object	tenant_id, resource_counts, customer_portal_failed_access_count, customer_portal_revoked_access_count
`MetricsSnapshotEnvelope`	object	data, meta
`MissingEvidenceReport`	object	report_type, template_version, release_id, result, missing, assumptions, limitations
`MissingEvidenceReportEnvelope`	object	data, meta
`ObjectRetentionPolicy`	object	id, tenant_id, name, object_prefix, mode, retention_days, status, schema_version, created_at
`ObjectRetentionPolicyEnvelope`	object	data, meta
`OpenAPIContract`	object	id, tenant_id, product_id, version, hash, path_count, evidence_id, created_at
`OpenAPIContractEnvelope`	object	data, meta
`OpenAPIDocument`	object	openapi, info, paths
`OpenAPIOperationRecord`	object	path, method
`Organization`	object	id, tenant_id, name, slug, status, schema_version, created_at
`OrganizationEnvelope`	object	data, meta
`PDFReportPackage`	object	id, tenant_id, report_type, title, payload_hash, payload_size, limitations, schema_version, created_at
`PDFReportPackageEnvelope`	object	data, meta
`PolicyCheck`	object	name, result, severity, explanation
`PolicyEvaluation`	object	id, tenant_id, release_id, result, policy_set, checks, created_at
`PolicyEvaluationEnvelope`	object	data, meta
`PolicyRule`	object	name, severity, required
`Problem`	object	none
`Product`	object	id, tenant_id, name, slug, schema_version, created_at
`ProductEnvelope`	object	data, meta
`ProductListEnvelope`	object	data, meta
`Project`	object	id, tenant_id, product_id, name, slug, schema_version, created_at
`ProjectEnvelope`	object	data, meta
`ProviderVerification`	object	id, tenant_id, provider_type, provider_id, subject, result, checks, limitations, schema_version, created_at
`ProviderVerificationEnvelope`	object	data, meta
`PublicTransparencyLog`	object	id, tenant_id, name, endpoint, public_key, state, schema_version, created_at
`PublicTransparencyLogEntry`	object	id, tenant_id, log_id, checkpoint_id, merkle_batch_id, external_id, entry_hash, state, schema_version, created_at
`PublicTransparencyLogEntryEnvelope`	object	data, meta
`PublicTransparencyLogEnvelope`	object	data, meta
`PublishPublicTransparencyLogEntryRequest`	object	log_id, checkpoint_id, external_id
`PullRequest`	object	id, tenant_id, repository_id, provider, provider_id, state, schema_version, created_at
`PullRequestEnvelope`	object	data, meta
`QuestionnaireAnswerLibraryEntry`	object	id, tenant_id, answer, schema_version, created_at
`QuestionnaireAnswerLibraryEntryEnvelope`	object	data, meta
`QuestionnaireAnswerLibraryEntryListEnvelope`	object	data, meta
`QuestionnaireDraft`	object	id, tenant_id, template_id, responses, manifest_hash, limitations, schema_version, created_at
`QuestionnaireDraftEnvelope`	object	data, meta
`QuestionnairePackage`	object	id, tenant_id, template_id, responses, manifest_hash, schema_version, created_at
`QuestionnairePackageEnvelope`	object	data, meta
`QuestionnaireQuestion`	object	id, prompt
`QuestionnaireResponse`	object	question_id, answer
`QuestionnaireTemplate`	object	id, tenant_id, name, version, questions, schema_version, created_at
`QuestionnaireTemplateEnvelope`	object	data, meta
`ReadinessReport`	object	report_type, template_version, result, assumptions, limitations, generated_at
`ReadinessReportEnvelope`	object	data, meta
`ReadinessStatus`	object	status, checks
`ReadinessStatusEnvelope`	object	data, meta
`RecordCollectorReleaseRequest`	object	version, artifact_digest
`RecordDeploymentRequest`	object	environment_id, release_id, status, started_at
`RecordEvidenceLifecycleEventRequest`	object	action, reason
`RecordIncidentTimelineRequest`	object	event_type, summary
`RecordPullRequestRequest`	object	repository_id, provider, provider_id, title, state
`RecordSourceCommitRequest`	object	repository_id, sha, committed_at
`RecordVulnerabilityWorkflowRequest`	object	action, reason
`RedactionProfile`	object	id, tenant_id, name, schema_version, created_at
`RedactionProfileEnvelope`	object	data, meta
`RegisterArtifactRequest`	object	name, digest
`RegisterContainerImageRequest`	object	repository, digest
`Release`	object	id, tenant_id, product_id, version, status, schema_version, created_at
`ReleaseBundle`	object	id, tenant_id, release_id, state, manifest, manifest_hash, signature_refs, created_at
`ReleaseBundleEnvelope`	object	data, meta
`ReleaseBundleManifest`	object	manifest_version, bundle_id, tenant_id, release, evidence_ids, chain_checkpoint, generated_at, generator
`ReleaseBundleManifestEnvelope`	object	data, meta
`ReleaseBundleVerification`	object	result
`ReleaseBundleVerificationEnvelope`	object	data, meta
`ReleaseCandidate`	object	id, tenant_id, release_id, name, state, snapshot_hash, schema_version, created_at
`ReleaseCandidateEnvelope`	object	data, meta
`ReleaseCandidateListEnvelope`	object	data, meta
`ReleaseCandidateTransitionRequest`	object	none
`ReleaseEnvelope`	object	data, meta
`ReleaseEvidenceFlow`	object	release_id, product_id, status, counts, steps, assumptions, limitations, schema_version, generated_at
`ReleaseEvidenceFlowEnvelope`	object	data, meta
`ReleaseEvidenceFlowStep`	object	id, title, status, required, method, path, required_scopes, idempotency_required, description
`ReleaseSecurityApprovalSummary`	object	total, approved
`ReleaseSecurityExceptionSummary`	object	total, approved_unexpired, unapproved, expired
`ReleaseSecurityMissingDecision`	object	finding_id, scan_id, vulnerability, severity, state
`ReleaseSecurityProductSummary`	object	id, name, slug
`ReleaseSecurityReleaseSummary`	object	id, version, state
`ReleaseSecuritySummary`	object	product, release, artifact_count, sbom_status, vulnerability_scan_status, open_findings_by_severity, decisions_by_status, approval_summary, exception_summary, readiness_status, package_status, counts, assumptions, limitations, schema_version, generated_at
`ReleaseSecuritySummaryEnvelope`	object	data, meta
`RemediationTask`	object	id, tenant_id, title, owner, status, schema_version, created_at
`RemediationTaskEnvelope`	object	data, meta
`RenderReportTemplateRequest`	object	subject_type, subject_id
`RenderedCustomReport`	object	id, tenant_id, template_id, subject_type, subject_id, output, hash, schema_version, created_at
`RenderedCustomReportEnvelope`	object	data, meta
`RetentionOverride`	object	id, tenant_id, scope_type, scope_id, retention_until, reason, owner, schema_version, created_at
`RetentionOverrideEnvelope`	object	data, meta
`RetentionReport`	object	report_type, legal_holds, retention_overrides, limitations, generated_at
`RetentionReportEnvelope`	object	data, meta
`RoleBinding`	object	id, tenant_id, subject_type, subject_id, role, schema_version, created_at
`RoleBindingEnvelope`	object	data, meta
`RoleBindingListEnvelope`	object	data, meta
`SBOM`	object	id, tenant_id, evidence_id, release_id, format, component_count, created_at
`SBOMComponent`	object	name
`SBOMComponentRecord`	object	sbom_id, component
`SBOMComponentRecordListEnvelope`	object	data, meta
`SBOMDiff`	object	id, tenant_id, base_sbom_id, target_sbom_id, unchanged_count, schema_version, created_at
`SBOMDiffEnvelope`	object	data, meta
`SBOMEnvelope`	object	data, meta
`SSOCredentialExchangeEnvelope`	object	data, meta
`SSOCredentialExchangeResponse`	object	verification, session, secret
`SSOProvider`	object	id, tenant_id, name, type, issuer, client_id, status, schema_version, created_at
`SSOProviderEnvelope`	object	data, meta
`SSOSession`	object	id, tenant_id, user_id, provider_id, prefix, expires_at, schema_version, created_at
`SSOSessionCreateEnvelope`	object	data, meta
`SSOSessionCreateResponse`	object	session, secret
`SSOSessionEnvelope`	object	data, meta
`SaaSEditionProfile`	object	id, tenant_id, name, region, admin_tenant_id, isolation_model, status, config_hash, limitations, schema_version, created_at
`SaaSEditionProfileEnvelope`	object	data, meta
`SecurityControl`	object	id, tenant_id, framework_id, code, title, objective, schema_version, created_at
`SecurityControlEnvelope`	object	data, meta
`SecurityReviewPackageReport`	object	report_type, template_version, package_id, product_id, evidence_ids, assumptions, limitations, generated_at
`SecurityReviewPackageReportEnvelope`	object	data, meta
`SecurityScan`	object	id, tenant_id, category, format, scanner, target_ref, evidence_id, payload_hash, finding_count, redacted, quarantined, schema_version, created_at
`SecurityScanEnvelope`	object	data, meta
`SecurityUpdateEvidenceReport`	object	report_type, template_version, product_id, release_id, summary, assumptions, limitations, generated_at
`SecurityUpdateEvidenceReportEnvelope`	object	data, meta
`SignedIncidentWebhookPayload`	object	event_type, summary
`SigningCustodyReviewReport`	object	report_type, tenant_id, checks, assumptions, limitations, generated_at
`SigningCustodyReviewReportEnvelope`	object	data, meta
`SigningKey`	object	id, tenant_id, kid, algorithm, status, public_key, created_at
`SigningKeyEnvelope`	object	data, meta
`SigningKeyListEnvelope`	object	data, meta
`SigningKeyTransitionRequest`	object	none
`SigningOperation`	object	id, tenant_id, provider_id, subject_type, subject_id, payload_hash, result, checks, schema_version, created_at
`SigningOperationEnvelope`	object	data, meta
`SigningProvider`	object	id, tenant_id, name, type, status, key_ref, encrypted, schema_version, created_at
`SigningProviderEnvelope`	object	data, meta
`SourceBranch`	object	id, tenant_id, repository_id, name, protected, schema_version, created_at
`SourceBranchEnvelope`	object	data, meta
`SourceCommit`	object	id, tenant_id, repository_id, sha, schema_version, created_at
`SourceCommitEnvelope`	object	data, meta
`SourceRepository`	object	id, tenant_id, provider, full_name, schema_version, created_at
`SourceRepositoryEnvelope`	object	data, meta
`SourceRepositoryListEnvelope`	object	data, meta
`SourceSnapshotBranchInput`	object	name
`SourceSnapshotCommitInput`	object	sha, committed_at
`SourceSnapshotEnvelope`	object	data, meta
`SourceSnapshotPullRequestInput`	object	provider_id, state
`SourceSnapshotRepositoryInput`	object	full_name
`SourceSnapshotRequest`	object	repository
`SourceSnapshotResult`	object	repository
`SubjectRef`	object	type
`SupersedeEvidenceRequest`	object	replacement_evidence_id, reason
`TransparencyCheckpoint`	object	id, tenant_id, batch_id, provider, timestamp_hash, state, schema_version, created_at
`TransparencyCheckpointEnvelope`	object	data, meta
`UpdateSSOProviderTrustMaterialRequest`	object	none
`UploadManualSecurityDocumentRequest`	object	document_type, title, sensitivity, payload
`UploadOpenAPIContractRequest`	object	product_id, release_id, version, spec
`UploadSPDXSBOMRequest`	object	release_id, payload
`UploadSecurityScanRequest`	object	category, format, scanner, target_ref, payload
`UploadVulnerabilityScanRequest`	object	scanner, target_ref, release_id, findings
`UpsertSourceBranchRequest`	object	repository_id, name
`UserIdentityLink`	object	id, tenant_id, user_id, provider_id, subject, email, verified, schema_version, created_at
`UserIdentityLinkEnvelope`	object	data, meta
`VEXDocument`	object	id, tenant_id, evidence_id, release_id, format, statement_count, schema_version, created_at
`VEXDocumentEnvelope`	object	data, meta
`VEXImportIssue`	object	code, detail
`VEXImportPreview`	object	tenant_id, release_id, format, parser_version, advisory, statement_count, status_summary, decisions_would_create, decisions_would_supersede, assumptions, limitations, schema_version, generated_at
`VEXImportPreviewEnvelope`	object	data, meta
`VEXImportReport`	object	id, tenant_id, vex_document_id, evidence_id, parser_version, status, statement_count, decisions_created, decisions_superseded, schema_version, created_at, updated_at
`VEXImportReportEnvelope`	object	data, meta
`VerificationResult`	object	id, tenant_id, subject_type, subject_id, result, checks, verified_at
`VerificationResultEnvelope`	object	data, meta
`VerifyCheck`	object	name, result
`VerifyCosignSignatureRequest`	object	none
`VerifyProviderIdentityRequest`	object	provider_type, provider_id, subject
`VerifyPublicTransparencyLogEntryRequest`	object	root_hash, leaf_index, tree_size, inclusion_proof
`VerifySubjectRequest`	object	subject_type
`VersionInfo`	object	version
`VersionInfoEnvelope`	object	data, meta
`VulnerabilityDecision`	object	id, tenant_id, finding_id, scan_id, vulnerability, status, justification, source, schema_version, created_at
`VulnerabilityDecisionCustomerSummary`	object	id, finding_id, scan_id, release_id, vulnerability, status, impact_statement, source, created_at
`VulnerabilityDecisionEnvelope`	object	data, meta
`VulnerabilityDecisionListEnvelope`	object	data, meta
`VulnerabilityDecisionSummaryReport`	object	report_type, template_version, product_id, release_id, decisions, assumptions, limitations, generated_at
`VulnerabilityDecisionSummaryReportEnvelope`	object	data, meta
`VulnerabilityPostureReport`	object	report_type, template_version, summary, open_critical, assumptions, limitations, generated_at
`VulnerabilityPostureReportEnvelope`	object	data, meta
`VulnerabilityScan`	object	id, tenant_id, release_id, scanner, target_ref, summary, findings, created_at
`VulnerabilityScanEnvelope`	object	data, meta
`VulnerabilityWorkflowRecord`	object	id, tenant_id, finding_id, action, reason, actor_id, schema_version, created_at
`VulnerabilityWorkflowRecordEnvelope`	object	data, meta
`Waiver`	object	id, tenant_id, scope_type, scope_id, owner, risk, reason, expires_at, approved, schema_version, created_at
`WaiverEnvelope`	object	data, meta