Evydence API - Rendered OpenAPI Docs

Runtime secrets, tenant data, raw evidence payloads, private keys, bearer tokens, and customer package contents are not embedded in this generated page. Admin-scoped routes appear only when they are part of the committed public contract.

Error responses use RFC 9457-style Problem Details. The registered Problem schema currently requires: type, title, status, detail, code, request_id, retryable, retry_class.

Operations

Filter operations

GET /v1/admin/instance

Instance admin snapshot

Returns instance-level diagnostic counts from one current database snapshot. Requires the explicit instance:admin scope; tenant admin and ordinary wildcard tenant keys are insufficient. The response omits tenant identifiers, evidence payloads, and credential material. PostgreSQL is required for local evaluation.

Operation ID: instanceAdminSnapshot
Tags: evydence
Auth: BearerAuth
Scopes: instance:admin
Idempotency: not required
Request: none
Responses: 200 application/json: InstanceAdminSnapshotEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

GET /v1/admin/outbox

Outbox operator diagnostics

Returns aggregate outbox backlog, running, and terminal-job counts without tenant IDs, payloads, or raw failure details. Requires the explicit instance:admin scope. PostgreSQL is required for local evaluation.

Operation ID: outboxOperatorDiagnostics
Tags: evydence
Auth: BearerAuth
Scopes: instance:admin
Idempotency: not required
Request: none
Responses: 200 application/json: OutboxDiagnosticsEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/admin/outbox/{id}/replay

Replay terminal outbox job

Requeues one dead-letter outbox job and appends an audit record. Requires the explicit instance:admin scope and an idempotency key; current instance authority is checked before completed replay. Job mutation, audit, and safe replay completion share one PostgreSQL transaction. Raw payload and failure details are never returned. PostgreSQL is required for local evaluation.

Operation ID: replayTerminalOutboxJob
Tags: evydence
Auth: BearerAuth
Scopes: instance:admin
Idempotency: Idempotency-Key
Request: application/json: EmptyObject
Responses: 200 application/json: OutboxReplayEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

GET /v1/admin/readiness

Readiness diagnostics

Returns vetted per-dependency readiness diagnostics. Requires the explicit instance:admin scope; raw dependency errors, credentials, paths, and tenant data are excluded. PostgreSQL is required for local evaluation.

Operation ID: readinessDiagnostics
Tags: evydence
Auth: BearerAuth
Scopes: instance:admin
Idempotency: not required
Request: none
Responses: 200 application/json: ReadinessDiagnosticsEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

GET /v1/api-keys

List API keys

Lists tenant-scoped API key metadata without key hashes or one-time secrets. Results use bounded keyset pagination. Cursor tokens are opaque and bound to the tenant, filters, sort, and direction.

Operation ID: listAPIKeys
Tags: evydence
Auth: BearerAuth
Scopes: admin
Idempotency: not required
Request: none
Responses: 200 application/json: APIKeyListEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/api-keys

Create API key

Creates a tenant-scoped API key atomically with audit and replay state. PostgreSQL uses a focused Identity command and current tenant-wide admin authority. Delegating instance:admin requires explicit instance authority, not a tenant wildcard. The first response returns the secret once; restart replay retains only the public key metadata, never its secret or hash. Names are not unique; scopes retain existing trimming, sorting and duplicate/blank/unknown-string behavior.

Operation ID: createAPIKey
Tags: evydence
Auth: BearerAuth
Scopes: admin
Idempotency: Idempotency-Key
Request: application/json: CreateAPIKeyRequest
Responses: 201 application/json: APIKeyCreateEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/api-security-scans

Upload API security scan

Uploads SAST, DAST, secret, license, or API security scan metadata and raw JSON payload evidence without exposing raw payload bytes in responses. In PostgreSQL mode, focused security:write commands check current tenant-owned product/release parents and human resource grants before parsing or staging; scoped human artifact grants require a current authorized evidence/build association, while tenant-wide grants and issued credentials do not need a narrower association. No request reloads the Ledger aggregate. Wrapped JSON remains limited to 64 KiB and rejects null metadata/payload, duplicate keys, and unknown envelope fields. IDs are NUL-free UTF-8 bounded at 1024 bytes. Evidence, accepted document metadata, payload metadata, finalizer job, two audit entries, and safe idempotency completion commit in one transaction. Same-key replay rechecks current grants without parsing or staging and preserves safe metadata; payload_ref is omitted on replay by the central privacy policy. Raw payload bytes are never included in responses. Failed commands roll back document effects; a response-free failed-key record can remain. Local-memory mode retains its explicit compatibility command. The generic findings/severity and SARIF version/runs/results/level parsers are reduced contracts, not complete SARIF support. Omitted format defaults to generic. Projections are bounded at 100,000 findings, 1 MiB per label, and 8 MiB combined summary labels; overflow fails validation. Secret-scan redacted/quarantined flags record policy metadata and do not prove that stored raw bytes are scrubbed or safe to distribute. Scanner findings are not authoritative.

Operation ID: uploadAPISecurityScan
Tags: evydence
Auth: BearerAuth
Scopes: security:write
Idempotency: Idempotency-Key
Request: application/json: UploadAPISecurityScanRequest
Responses: 201 application/json: SecurityScanEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/approvals

Create approval record

Creates an immutable approval record for a release, waiver, package, or review subject.

Operation ID: createApproval
Tags: evydence
Auth: BearerAuth
Scopes: release:write
Idempotency: Idempotency-Key
Request: application/json: CreateApprovalRequest
Responses: 201 application/json: ApprovalRecordEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/artifact-signatures

Create artifact signature

Records detached artifact signature evidence with recorded status; creation does not verify cryptographic trust. PostgreSQL uses native durable execution without Ledger replay. Current artifact ownership and evidence:write grants run before reservation and every replay; human sessions retain current tenant, product, project or release association policy. The common writer fence precedes tenant/artifact share locks held through the outer commit. Fresh signature metadata, optional payload lifecycle, finalization job, audit and successful replay commit in the same transaction. Completed retries preserve the original public DTO and canonical tenant/digest-bound payload reference without selecting changed artifact digest/metadata or staging again. The strict JSON object remains capped at 64 KiB; payload must be an optional non-null JSON object. Raw IDs are bounded at 1024 bytes, algorithm and signature text at 64 KiB, and media-type text at 4096 bytes before trimming; text is NUL-free UTF-8. Unknown, duplicate, case-aliased, null, malformed and over-budget input fails validation. Cookie mutations require same-origin protection; bearer credentials take precedence. Payload staging is not finalization and filesystem staging cannot be rolled back by a failed database transaction. PostgreSQL is required for local evaluation. No current cryptographic trust, artifact safety or compliance is claimed.

Operation ID: createArtifactSignature
Tags: evydence
Auth: BearerAuth
Scopes: evidence:write
Idempotency: Idempotency-Key
Request: application/json: CreateArtifactSignatureRequest
Responses: 201 application/json: ArtifactSignatureEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

GET /v1/artifact-signatures/{id}

Get artifact signature

Returns artifact signature metadata through a focused query only when the current tenant owns the signature and its artifact digest still matches. A human session additionally needs an evidence:read grant covering a current evidence or build association; issued credentials use their evidence:read scope. PostgreSQL is required for local evaluation.

Operation ID: getArtifactSignature
Tags: evydence
Auth: BearerAuth
Scopes: evidence:read
Idempotency: not required
Request: none
Responses: 200 application/json: ArtifactSignatureEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/artifact-signatures/{id}/verify-cosign

Verify cosign-style artifact signature

Cryptographically verifies a stored Sigstore/Cosign bundle against operator-configured trust material and caller-supplied keyless identity policy. The explicit offline profile requires an embedded Rekor inclusion proof and does not silently downgrade an online-required request. PostgreSQL uses native durable execution: current verify:read authority and flat tenant/signature/artifact ownership guards run before reservation and every replay; human sessions need a tenant-wide grant. The common writer fence precedes tenant, artifact and signature locks. Successful verification commits both receipts, audit and replay atomically. Completed replay returns the original receipt without reading current digests, images, payloads or trust material, or re-running verification. The API requires exact non-null policy fields within 64 KiB; signature IDs are capped at 1024 bytes and optional identity/issuer text at 4096 UTF-8 bytes before trimming. Fresh object reads retain the 4 MiB bound. Cookie mutations require same-origin protection; bearer credentials take precedence. Failed or unavailable inspection returns 422 without a success envelope or partial receipt commit. The API requires PostgreSQL, including local evaluation. A historical receipt is not proof of current trust validity, artifact safety, provenance completeness or legal compliance.

Operation ID: verifyCosignSignature
Tags: evydence
Auth: BearerAuth
Scopes: verify:read
Idempotency: Idempotency-Key
Request: application/json: VerifyCosignSignatureRequest
Responses: 200 application/json: CosignVerificationEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/artifacts

Register artifact

Registers declared artifact metadata requiring evidence:write. PostgreSQL uses native durable execution without Ledger replay/refresh. Current tenant authority and existing digest ownership/grants run on every retry without private metadata, clocks or IDs; locks join the outer record/audit/replay transaction. Natural-key reuse returns original immutable metadata without another audit. Identical request bytes replay the original result, including exact integer sizes; changed bytes conflict. Both profiles require strict non-null exact JSON within 64 KiB; raw NUL-free UTF-8 names/media types are capped at 64 KiB and digest text at 128 bytes before trimming. Size is nonnegative and defaults to zero when omitted. Fresh reuse of oversized stored metadata returns 409. Cookie writes require same-host HTTPS Origin with Bearer precedence. Local memory remains nondurable. Registration does not verify uploaded bytes, signatures or provenance.

Operation ID: registerArtifact
Tags: evydence
Auth: BearerAuth
Scopes: evidence:write
Idempotency: Idempotency-Key
Request: application/json: RegisterArtifactRequest
Responses: 201 application/json: ArtifactEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

GET /v1/artifacts/{id}

Get artifact

Returns a tenant-scoped artifact by id.

Operation ID: getArtifact
Tags: evydence
Auth: BearerAuth
Scopes: evidence:read
Idempotency: not required
Request: none
Responses: 200 application/json: ArtifactEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

GET /v1/audit-chain/verify

Verify audit chain

Recomputes tenant audit-chain entry hashes, continuity, schema versions, and referenced signatures. This local verification does not by itself prove protection from an administrator able to rewrite all history and signing material.

Operation ID: verifyAuditChain
Tags: evydence
Auth: BearerAuth
Scopes: verify:read
Idempotency: not required
Request: none
Responses: 200 application/json: VerificationResultEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

GET /v1/audit-log

List tenant audit log

Lists tenant-scoped append-only audit-chain entries in reverse chronological order. Human sessions require a tenant-wide admin grant. Results use bounded keyset pagination. Cursor tokens are opaque and bound to the tenant, filters, sort, and direction.

Operation ID: listAuditLog
Tags: evydence
Auth: BearerAuth
Scopes: admin
Idempotency: not required
Request: none
Responses: 200 application/json: AuditChainEntryListEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/backup-manifests

Generate backup manifest

Generates a tenant-scoped metadata commitment, not a restore receipt or proof that an operator backup completed. PostgreSQL emits backup-manifest.v2.0.0 with tenant-relational-state.v5 semantics, including decision supersession history, session lifecycle, non-secret OIDC/SAML request metadata, SAML SP bindings and assertion replay hashes/deadlines; login state/nonce hashes are excluded and historical commitments retain their frozen v1/v2/v3/v4 profiles. Native durable execution checks current tenant-wide admin authority before reservation and replay; human sessions need a matching tenant grant. The replay guard locks only the tenant root, not state rows, audit pages or signing material. The common writer fence precedes tenant and chain locks. Fresh generation streams the complete declared metadata profile in one committed view, bounded by 32768 rows and 8 MiB; overflow fails rather than publishing a truncated prefix. Manifest, caller audit and successful replay commit together. Completed retries return the original manifest without reading or hashing current state or rerunning audit inspection; changed request bytes conflict. The API requires an empty JSON object, reject unknown, duplicate, case-aliased, invalid UTF-8 and malformed input, and cap the body at 64 KiB. Unsafe cookie mutations require same-origin protection. The API requires PostgreSQL, including local evaluation. Credential material, HTTP replay bookkeeping and raw object payload bytes are excluded. Failed audit observations remain failed, and local checks do not prove external anchoring.

Operation ID: generateBackupManifest
Tags: evydence
Auth: BearerAuth
Scopes: admin
Idempotency: Idempotency-Key
Request: application/json: EmptyObject
Responses: 201 application/json: BackupManifestEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

GET /v1/backup-manifests/{id}/verify

Verify backup manifest

Verifies a tenant-scoped backup manifest and returns deterministic manifest verification checks.

Operation ID: verifyBackupManifest
Tags: evydence
Auth: BearerAuth
Scopes: verify:read
Idempotency: not required
Request: none
Responses: 200 application/json: VerificationResultEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/build-attestations/{id}/verify-signature

Verify build attestation signature

Offline-verifies DSSE PAE, an in-toto Statement v1/SLSA provenance v1 predicate, registered release-artifact subject digests, and immutable configured tenant-root policy. Requires verify:read and current owned attestation/evidence/build/project/release/product coordinates; human sessions need a matching tenant, product, project or release grant. PostgreSQL uses native durable execution without Ledger replay. Current flat ownership and grants run before reservation and every replay, with the common writer fence before row locks held through receipt/audit/job/replay commit. Completed retries return the original receipt without reading changed payloads, trust policies or build outputs. The required empty JSON object is capped at 64 KiB; raw NUL-free UTF-8 IDs at 1024 bytes before trimming. Malformed, missing, unknown, duplicate and non-object input fails validation. Cookie mutations require same-origin protection; bearer credentials take precedence. Fresh metadata is bounded to 4096 records and 8 MiB, and finalized payload reads to 8 MiB. Failed HTTP inspection returns 422 and rolls back business effects; unavailable trust can return a conservative not_verified receipt with 200. The API requires PostgreSQL, including local evaluation. This receipt does not prove current trust validity, provenance completeness, CI-provider runtime integrity or compliance.

Operation ID: verifyBuildAttestationSignature
Tags: evydence
Auth: BearerAuth
Scopes: verify:read
Idempotency: Idempotency-Key
Request: application/json: EmptyObject
Responses: 200 application/json: VerificationResultEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/builds

Create build run

Records an immutable CI build run requiring build:write and current tenant-owned product/project/release and output-artifact authority. PostgreSQL uses native durable execution with a read-only ownership/grant guard on every retry, without cached Ledger reads or refresh. The guard locks parents and supplied artifacts but does not reread release versions, artifact digests or historical build metadata; fresh creation still checks output digests and atomically commits build, audit and replay effects. Identical request bytes replay the original response; changed bytes under the same key conflict. Strict non-null JSON and raw input bounds apply in both profiles. Unsafe cookie mutations require same-host HTTPS Origin; Bearer takes precedence. Collector identity comes from the authenticated key. Submitted CI/OIDC metadata is unverified and cannot set oidc_verified to true. Local memory remains nondurable.

Operation ID: createBuild
Tags: evydence
Auth: BearerAuth
Scopes: build:write
Idempotency: Idempotency-Key
Request: application/json: CreateBuildRequest
Responses: 201 application/json: BuildRunEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

GET /v1/builds/{id}

Get build run

Returns a tenant-scoped build run by id.

Operation ID: getBuild
Tags: evydence
Auth: BearerAuth
Scopes: build:read
Idempotency: not required
Request: none
Responses: 200 application/json: BuildRunEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/builds/{id}/attestations

Upload build attestation

Accepts a nonempty DSSE/in-toto JSON envelope of at most 20 MiB for a tenant-scoped build; raw build IDs are limited to 1024 NUL-free UTF-8 bytes before trimming. PostgreSQL uses native durable execution with a read-only current build/parent/output-artifact ownership and grant guard on every retry, without Ledger replay or refresh. Identical bytes replay the original public response without reparsing or staging; changed bytes under the same key conflict. Fresh ingestion still verifies observed payload hash/size, output digests and subject coverage, and commits evidence, attestation, caller audits, payload records, worker jobs and replay completion together. HTTP responses omit private payload_ref storage coordinates. Structurally_valid is not signature verification; managed worker-owned projections stay accepted/pending until the worker runs. Upload concurrency limits apply; cookie writes require same-host HTTPS Origin with Bearer precedence. Local memory remains nondurable.

Operation ID: uploadBuildAttestation
Tags: evydence
Auth: BearerAuth
Scopes: build:write
Idempotency: Idempotency-Key
Request: application/json: DSSEEnvelope
Responses: 201 application/json: BuildAttestationEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

GET /v1/collectors

List collectors

Lists tenant-scoped collector metadata without API key hashes or one-time secrets. Results use bounded keyset pagination. Cursor tokens are opaque and bound to the tenant, filters, sort, and direction.

Operation ID: listCollectors
Tags: evydence
Auth: BearerAuth
Scopes: collector:read
Idempotency: not required
Request: none
Responses: 200 application/json: CollectorListEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/collectors

Create collector

Creates a tenant-scoped collector identity and scoped API key atomically with audit and replay state. PostgreSQL uses focused commands; human sessions require a current tenant-wide collector:admin grant. The secret is returned only in the first response; durable replay preserves public collector/key metadata without the secret or hash. Omitted or empty scopes default to build:write and evidence:write; read scopes require explicit opt-in.

Operation ID: createCollector
Tags: evydence
Auth: BearerAuth
Scopes: collector:admin
Idempotency: Idempotency-Key
Request: application/json: CreateCollectorRequest
Responses: 201 application/json: CollectorCreateEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/collectors/github/source-snapshots

Upload GitHub source snapshot

Records a strict GitHub source snapshot. PostgreSQL checks current project and repository ownership and commits all supplied source components and audit entries in one transaction. Repository and commit identities are reused, branches are current state, and each executed pull-request recording appends a new snapshot. Stores only the exact-byte message hash; omitted commit time defaults to server time. Optional components must be omitted rather than null. Request replay adds no effects. The provider label is submitted metadata and does not verify GitHub origin, signatures, or review authority. PostgreSQL HTTP uses native durable replay with a read-only current tenant/submitted/existing repository creation-scope guard before reservation and completed replay. The common writer fence and parent locks survive through the outer commit. The guard does not read private child metadata, call child writes or use clocks/IDs; it is not re-verification of historical children or current branch state. Raw nested input bounds are checked before trimming and before composed writes, within the 64 KiB HTTP envelope. Completed replay preserves original public JSON and request-byte fingerprints without reapplying old branches. Cookie writes require same-host HTTPS Origin; explicit bearer credentials take precedence. Local evaluation requires PostgreSQL; there is no local-memory API path.

Operation ID: uploadGitHubSourceSnapshot
Tags: evydence
Auth: BearerAuth
Scopes: source:write
Idempotency: Idempotency-Key
Request: application/json: SourceSnapshotRequest
Responses: 201 application/json: SourceSnapshotEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/collectors/gitlab/source-snapshots

Upload GitLab source snapshot

Records a strict GitLab source snapshot. PostgreSQL checks current project and repository ownership and commits all supplied source components and audit entries in one transaction. Repository and commit identities are reused, branches are current state, and each executed pull-request recording appends a new snapshot. Stores only the exact-byte message hash; omitted commit time defaults to server time. Optional components must be omitted rather than null. Request replay adds no effects. The provider label is submitted metadata and does not verify GitLab origin, signatures, or review authority. PostgreSQL HTTP uses native durable replay with a read-only current tenant/submitted/existing repository creation-scope guard before reservation and completed replay. The common writer fence and parent locks survive through the outer commit. The guard does not read private child metadata, call child writes or use clocks/IDs; it is not re-verification of historical children or current branch state. Raw nested input bounds are checked before trimming and before composed writes, within the 64 KiB HTTP envelope. Completed replay preserves original public JSON and request-byte fingerprints without reapplying old branches. Cookie writes require same-host HTTPS Origin; explicit bearer credentials take precedence. Local evaluation requires PostgreSQL; there is no local-memory API path.

Operation ID: uploadGitLabSourceSnapshot
Tags: evydence
Auth: BearerAuth
Scopes: source:write
Idempotency: Idempotency-Key
Request: application/json: SourceSnapshotRequest
Responses: 201 application/json: SourceSnapshotEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

GET /v1/collectors/{id}/health

Collector health report

Returns collector supply-chain health from recorded tenant evidence, assumptions, and limitations. Production resolves the collector and its latest and pinned releases in one tenant-scoped database snapshot; human sessions require a tenant-wide collector:read grant.

Operation ID: collectorHealthReport
Tags: evydence
Auth: BearerAuth
Scopes: collector:read
Idempotency: not required
Request: none
Responses: 200 application/json: CollectorHealthReportEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/collectors/{id}/releases

Record collector release evidence

Records collector release evidence through bounded current collector, signature/artifact, SBOM/evidence and scan/evidence reads in PostgreSQL. Human sessions require a tenant-wide collector:admin grant, checked before replay. Pins, release rows, audit and replay state commit atomically. Reference presence is not proof of runtime safety or vulnerability absence.

Operation ID: recordCollectorRelease
Tags: evydence
Auth: BearerAuth
Scopes: collector:admin
Idempotency: Idempotency-Key
Request: application/json: RecordCollectorReleaseRequest
Responses: 201 application/json: CollectorReleaseEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

GET /v1/commercial-collectors

List commercial collector definitions

Lists tenant-scoped commercial collector definitions under collector:read; human sessions require a current tenant-level grant. PostgreSQL results are keyset-paginated. Results use bounded keyset pagination. Cursor tokens are opaque and bound to the tenant, filters, sort, and direction.

Operation ID: listCommercialCollectors
Tags: evydence
Auth: BearerAuth
Scopes: collector:read
Idempotency: not required
Request: none
Responses: 200 application/json: CommercialCollectorDefinitionListEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/commercial-collectors

Create commercial collector definition

Creates tenant-scoped commercial collector metadata through focused PostgreSQL commands under a current tenant-wide collector:admin grant for human sessions. Identity is tenant/provider/name/version; duplicate creation conflicts, while same-key replay returns original metadata after current authorization. Metadata, audit and replay state commit atomically. No external code is installed and no provider trust is granted.

Operation ID: createCommercialCollector
Tags: evydence
Auth: BearerAuth
Scopes: collector:admin
Idempotency: Idempotency-Key
Request: application/json: CreateCommercialCollectorRequest
Responses: 201 application/json: CommercialCollectorDefinitionEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/container-images

Register container image

Registers declared OCI/container image metadata requiring evidence:write and current supplied/existing artifact ownership and grants. PostgreSQL uses native durable execution without Ledger replay/refresh. Every retry locks flat tenant/image/artifact coordinates through the outer transaction without private image metadata or artifact digest revalidation; fresh execution retains digest checks. Immutable tenant/repository/digest reuse adds no audit. Image, audit and successful replay commit together; identical bytes replay the original result and changed bytes conflict. Both profiles require strict non-null exact JSON within 64 KiB. Raw NUL-free UTF-8 artifact IDs are capped at 1024 bytes, repository/tag/platform at 64 KiB and digest text at 128 bytes before trimming. Indexed repository capacity overflow returns safe 400; fresh oversized stored image metadata returns 409. Cookie writes require same-host HTTPS Origin with Bearer precedence. Local memory remains nondurable. Registration does not download or verify registry images.

Operation ID: registerContainerImage
Tags: evydence
Auth: BearerAuth
Scopes: evidence:write
Idempotency: Idempotency-Key
Request: application/json: RegisterContainerImageRequest
Responses: 201 application/json: ContainerImageEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

GET /v1/control-evidence

List control evidence

Keyset-pages tenant and grant-visible control evidence links with optional control, product, and release filters. PostgreSQL validates current control, framework, scope, and subject ownership before the page limit; broken links are excluded. Results use bounded keyset pagination. Cursor tokens are opaque and bound to the tenant, filters, sort, and direction.

Operation ID: listControlEvidence
Tags: evydence
Auth: BearerAuth
Scopes: controls:read
Idempotency: not required
Request: none
Responses: 200 application/json: ControlEvidenceListEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

GET /v1/control-framework-template-packs

List control framework template packs

Lists built-in control framework template packs available for explicit tenant installation. Results use bounded keyset pagination. Cursor tokens are opaque and bound to the tenant, filters, sort, and direction.

Operation ID: listControlFrameworkTemplatePacks
Tags: evydence
Auth: BearerAuth
Scopes: controls:read
Idempotency: not required
Request: none
Responses: 200 application/json: ControlFrameworkTemplatePackListEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/control-framework-template-packs/{slug}/install

Install control framework template pack

Installs a named starter pack as ordinary framework/control records. PostgreSQL uses a focused command and native durable replay: current tenant-level controls:admin grants for human sessions and tenant existence are checked before every fresh request or replay, without reading installed framework/control metadata. Fresh installation alone checks the tenant/slug/version key and atomically appends all starter controls, one principal audit and the replay result, without a background job or Ledger clone. Same-key replay returns the original framework; changed request bytes or a different-key duplicate tenant/slug/version return 409. The raw slug is NUL-free UTF-8 and bounded at 1024 bytes before trimming and durable replay reservation; invalid slugs return 400 and unknown slugs 404. An optional body must be an empty JSON object; blank/absent bodies retain their acceptance and exact byte fingerprints. Malformed, non-object, null, or unknown-field bodies return 400. Cookie-authenticated writes require same-host HTTPS Origin; explicit bearer authentication takes precedence. PostgreSQL is required for local evaluation. Starter content organizes technical evidence, not framework compliance or control efficacy.

Operation ID: installControlFrameworkTemplatePack
Tags: evydence
Auth: BearerAuth
Scopes: controls:admin
Idempotency: Idempotency-Key
Request: application/json: EmptyObject
Responses: 201 application/json: ControlFrameworkEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

GET /v1/control-frameworks

List control frameworks

Lists tenant-scoped control frameworks. Results use bounded keyset pagination. Cursor tokens are opaque and bound to the tenant, filters, sort, and direction.

Operation ID: listControlFrameworks
Tags: evydence
Auth: BearerAuth
Scopes: controls:read
Idempotency: not required
Request: none
Responses: 200 application/json: ControlFrameworkListEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/control-frameworks

Create control framework

Creates a tenant-scoped versioned control framework. PostgreSQL binds focused Risk commands and native durable replay, without Ledger cloning or inventories. Current tenant-wide controls:admin grants for human sessions and tenant existence are checked before every fresh request or replay; duplicate versions and installed metadata are not replay authority. Record, principal audit and replay result commit together without a job. Same-key replay preserves the original response; changed bytes or different-key duplicate slug/version return 409. Raw NUL-free UTF-8 name/description fields are bounded at 64 KiB, slug/version individually at 1024 bytes before trimming, with normalized slug plus version at 1024 bytes. An omitted/blank slug is derived from the name. Strict JSON and the 64 KiB body limit apply. Cookie-authenticated writes require same-host HTTPS Origin; explicit bearer authentication takes precedence. PostgreSQL is required for local evaluation. Recording does not establish framework compliance.

Operation ID: createControlFramework
Tags: evydence
Auth: BearerAuth
Scopes: controls:admin
Idempotency: Idempotency-Key
Request: application/json: CreateControlFrameworkRequest
Responses: 201 application/json: ControlFrameworkEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/controls

Create security control

Creates a framework-owned security control through focused Risk commands and native PostgreSQL durable replay. Current tenant-wide controls:admin grants for human sessions, tenant existence and framework ownership are checked before every fresh request or replay. The shared writer fence precedes tenant/framework share locks held through record, principal audit and replay commit. Replay never reads installed metadata or duplicate control codes; different-key duplicate codes return 409. Raw NUL-free UTF-8 parent IDs/codes are bounded at 1024 bytes, titles/objectives at 64 KiB before trimming; the normalized tenant/parent/code identity is bounded at 2048 bytes. At most ten ordered evidence requirements are accepted with raw types bounded at 1024 bytes and explicit non-null required booleans; false remains valid. Applicability sorting preserves duplicates and limitations preserve nonblank order. Strict JSON and the 64 KiB body limit apply. Cookie-authenticated writes require same-host HTTPS Origin; explicit bearer authentication takes precedence. PostgreSQL is required for local evaluation. Recording does not prove control effectiveness.

Operation ID: createSecurityControl
Tags: evydence
Auth: BearerAuth
Scopes: controls:admin
Idempotency: Idempotency-Key
Request: application/json: CreateSecurityControlRequest
Responses: 201 application/json: SecurityControlEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

GET /v1/controls/{id}

Get security control

Returns a tenant-scoped security control by id.

Operation ID: getSecurityControl
Tags: evydence
Auth: BearerAuth
Scopes: controls:read
Idempotency: not required
Request: none
Responses: 200 application/json: SecurityControlEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/controls/{id}/evidence

Link control evidence

Creates an append-only control-evidence link through focused Risk commands and native PostgreSQL durable replay, without Ledger cloning or inventories. Current tenant, control/framework/subject ownership and matching controls:write grants are checked before every fresh request or replay; supplied scope labels do not confer authority. Artifact grants require a current matching evidence/build association, including the build-output digest, and parsed subjects require coherent source-evidence relationships. The shared writer fence precedes tenant/control/framework share locks held through link, principal audit and replay commit. Completed replay never reads stored duplicate notes or adds an audit; fresh natural-key reuse preserves original notes/confidence. Changed bytes under the same key conflict. Raw path/subject/scope/kind text is NUL-free UTF-8 bounded at 1024 bytes before trimming, confidence at 64 bytes, notes at 65536 bytes; the normalized indexed identity is bounded at 2048 bytes. Strict JSON and the 64 KiB body limit apply. Cookie writes require same-host HTTPS Origin; bearer authentication takes precedence. PostgreSQL is required for local evaluation. Linking does not prove control effectiveness or framework compliance.

Operation ID: linkControlEvidence
Tags: evydence
Auth: BearerAuth
Scopes: controls:write
Idempotency: Idempotency-Key
Request: application/json: LinkControlEvidenceRequest
Responses: 201 application/json: ControlEvidenceEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/custom-policies

Create custom policy

Creates an immutable tenant-wide custom policy through a focused Risk command and durable replay. Human sessions require a current tenant-wide policy:write grant. Current tenant authority is checked before every fresh request or replay; definition, principal audit and replay result commit together. Duplicate tenant/name/version definitions return 409. PostgreSQL is required for local evaluation.

Operation ID: createCustomPolicy
Tags: evydence
Auth: BearerAuth
Scopes: policy:write
Idempotency: Idempotency-Key
Request: application/json: CreateCustomPolicyRequest
Responses: 201 application/json: CustomPolicyEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/custom-policies/{id}/evaluate

Evaluate custom policy

Evaluates evidence presence for a tenant-owned custom policy and release through a focused Risk command, recording the normalized input hash. Human sessions need a current tenant/product/release policy:read grant. Replay checks current ownership/grants without reading rules or evidence and returns the original result; changed request bytes conflict. Evaluation, principal audit and replay result commit together. This does not verify payloads, freshness, control effectiveness or compliance. PostgreSQL is required for local evaluation.

Operation ID: evaluateCustomPolicy
Tags: evydence
Auth: BearerAuth
Scopes: policy:read
Idempotency: Idempotency-Key
Request: application/json: EvaluatePolicyRequest
Responses: 201 application/json: CustomPolicyEvaluationEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/customer-packages

Create customer security package

Creates a scoped customer security package manifest using an explicit redaction profile.

Operation ID: createCustomerPackage
Tags: evydence
Auth: BearerAuth
Scopes: package:write
Idempotency: Idempotency-Key
Request: application/json: CreateCustomerPackageRequest
Responses: 201 application/json: CustomerSecurityPackageEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

GET /v1/customer-packages/{id}

Get customer security package

Returns a tenant-scoped customer security package manifest by id.

Operation ID: getCustomerPackage
Tags: evydence
Auth: BearerAuth
Scopes: package:read
Idempotency: not required
Request: none
Responses: 200 application/json: CustomerSecurityPackageEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

GET /v1/customer-packages/{id}/download

Download customer security package ZIP

Downloads a scoped customer security package ZIP. The archive contains redacted manifest metadata and verification guidance, not raw tenant evidence payload bytes.

Operation ID: downloadCustomerPackage
Tags: evydence
Auth: BearerAuth
Scopes: package:read
Idempotency: not required
Request: none
Responses: 200 application/zip: string; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

GET /v1/customer-portal/access

List customer portal access records

Lists tenant-scoped external reviewer access records visible under the caller's current package, product, release, or tenant-level package:read grant. Token hashes and secrets are never returned. The handler requires its focused query port, without an aggregate inventory fallback. PostgreSQL is required for local evaluation. Results use bounded keyset pagination. Cursor tokens are opaque and bound to the tenant, filters, sort, and direction.

Operation ID: listCustomerPortalAccess
Tags: evydence
Auth: BearerAuth
Scopes: package:read
Idempotency: not required
Request: none
Responses: 200 application/json: CustomerPortalAccessListEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/customer-portal/access

Create customer portal access

Creates a named, expiring external reviewer access record for a customer package and returns the portal token once. The handler requires focused Package command/replay ports, with current ownership and human grants checked before reservation or replay. PostgreSQL is required for local evaluation.

Operation ID: createCustomerPortalAccess
Tags: evydence
Auth: BearerAuth
Scopes: package:write
Idempotency: Idempotency-Key
Request: application/json: CreateCustomerPortalAccessRequest
Responses: 201 application/json: CustomerPortalAccessCreateEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/customer-portal/access/{id}/revoke

Revoke customer portal access

Revokes a tenant-scoped external reviewer access record; revocation is append-only and the original token cannot be used afterwards. The handler requires focused Package command/replay ports, with current ownership and human grants checked before reservation or replay. PostgreSQL is required for local evaluation.

Operation ID: revokeCustomerPortalAccess
Tags: evydence
Auth: BearerAuth
Scopes: package:write
Idempotency: Idempotency-Key
Request: application/json: EmptyObject
Responses: 200 application/json: CustomerPortalAccessEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/customer-portal/package

Access customer portal package

Public token exchange endpoint for a scoped customer package. It intentionally uses no bearer authentication and accepts only the issued portal token in the JSON body. The token helper requires a focused Package service, without an aggregate fallback. NDA, counters and access audits commit together; semantic denials retain their intended audit/counter effects, while storage failures roll back. PostgreSQL is required for local evaluation.

Operation ID: accessCustomerPortalPackage
Tags: evydence
Auth: BearerAuth
Scopes: none
Idempotency: Idempotency-Key
Request: application/json: CustomerPortalPackageRequest
Responses: 200 application/json: CustomerSecurityPackageEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/customer-portal/package/download

Download customer portal package ZIP

Public token exchange endpoint for downloading a scoped customer package ZIP. It intentionally uses no bearer authentication and accepts only the issued portal token in the JSON body. The token helper requires a focused Package service, without an aggregate fallback. NDA, counters and download audits commit together before record-only ZIP rendering. PostgreSQL is required for local evaluation.

Operation ID: downloadCustomerPortalPackage
Tags: evydence
Auth: BearerAuth
Scopes: none
Idempotency: Idempotency-Key
Request: application/json: CustomerPortalPackageRequest
Responses: 200 application/zip: string; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

GET /v1/customer-portal/package/view

Customer portal package review form

Public HTML form for reviewing or downloading a scoped customer package with a portal token. It does not accept tokens in URLs and does not use bearer authentication.

Operation ID: customerPortalPackageViewForm
Tags: evydence
Auth: BearerAuth
Scopes: none
Idempotency: not required
Request: none
Responses: 200 text/html: string; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/customer-portal/package/view

Customer portal package review page

Public HTML package review endpoint backed by the customer portal token exchange. Tokens are accepted only as form body fields. The token helper requires a focused Package service, without an aggregate fallback. Escaping, restrictive CSP and no-store/no-referrer headers are retained. PostgreSQL is required for local evaluation.

Operation ID: customerPortalPackageView
Tags: evydence
Auth: BearerAuth
Scopes: none
Idempotency: Idempotency-Key
Request: application/x-www-form-urlencoded: CustomerPortalPackageRequest
Responses: 200 text/html: string; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/customer-portal/package/view/download

Download customer portal package ZIP from review form

Public HTML-form package ZIP download endpoint backed by the customer portal token exchange. Tokens are accepted only as form body fields. The token helper requires a focused Package service, without an aggregate fallback. NDA, counters and download audits commit together before record-only ZIP rendering. PostgreSQL is required for local evaluation.

Operation ID: downloadCustomerPortalPackageView
Tags: evydence
Auth: BearerAuth
Scopes: none
Idempotency: Idempotency-Key
Request: application/x-www-form-urlencoded: CustomerPortalPackageRequest
Responses: 200 application/zip: string; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

GET /v1/deployments

List deployments

Lists tenant-scoped deployment events by optional release and environment filters. Results use bounded keyset pagination. Cursor tokens are opaque and bound to the tenant, filters, sort, and direction.

Operation ID: listDeployments
Tags: evydence
Auth: BearerAuth
Scopes: deployment:read
Idempotency: not required
Request: none
Responses: 200 application/json: DeploymentEventListEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/deployments

Record deployment

Records append-only deployment metadata with immediately readable deployment/event evidence in the same transaction as both audit entries and HTTP replay state. Requires deployment:write; human sessions need a current tenant, product or release grant. PostgreSQL uses native durable execution without Ledger replay/refresh. Every retry checks current environment/release/product ownership, tenant-owned artifacts and same-environment rollback ownership without private metadata, lifecycle state, clocks or IDs. The shared writer fence precedes locks held through the outer commit; replay adds no effects and changed original bytes conflict. Raw reference IDs are bounded at 1024 bytes, status at 64 bytes before trimming; artifact lists have at most 1024 entries and retain sorted duplicates. Omitted started_at defaults to command time; supplied timestamps use UTC microsecond precision and UTC years 1 through 9999 without imposing ordering. Both profiles enforce strict exact-case non-null JSON within 64 KiB and same-host HTTPS cookie Origin with Bearer precedence. Local memory remains nondurable. This records supplied metadata and does not prove runtime security or availability.

Operation ID: recordDeployment
Tags: evydence
Auth: BearerAuth
Scopes: deployment:write
Idempotency: Idempotency-Key
Request: application/json: RecordDeploymentRequest
Responses: 201 application/json: DeploymentEventEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

GET /v1/deployments/{id}

Get deployment

Returns a tenant-scoped deployment event by id.

Operation ID: getDeployment
Tags: evydence
Auth: BearerAuth
Scopes: deployment:read
Idempotency: not required
Request: none
Responses: 200 application/json: DeploymentEventEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/dsse-trust-roots

Create DSSE trust root

Creates a tenant-scoped immutable DSSE Ed25519 trust root with an explicit SLSA predicate, builder, and required-claims policy.

Operation ID: createDSSETrustRoot
Tags: evydence
Auth: BearerAuth
Scopes: keys:admin
Idempotency: Idempotency-Key
Request: application/json: CreateDSSETrustRootRequest
Responses: 201 application/json: DSSETrustRootEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

GET /v1/environments

List deployment environments

Lists tenant-scoped deployment environments, optionally filtered by product. Results use bounded keyset pagination. Cursor tokens are opaque and bound to the tenant, filters, sort, and direction.

Operation ID: listDeploymentEnvironments
Tags: evydence
Auth: BearerAuth
Scopes: deployment:read
Idempotency: not required
Request: none
Responses: 200 application/json: DeploymentEnvironmentListEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/environments

Create deployment environment

Creates tenant-owned deployment environment metadata after deployment:write authorization. PostgreSQL uses native durable execution without Ledger replay/refresh. Current tenant/product ownership and human tenant/product grants are checked before reservation and every completed replay without name reuse, private metadata, clocks or IDs. The shared writer fence precedes ownership locks held through the outer commit. PostgreSQL serializes tenant/product/name reuse and returns the original environment without changing its kind or appending another audit entry; durable creation/reuse timestamps use UTC microsecond precision. New environment, audit and replay records commit in the same transaction; replay adds no effects and changed original bytes conflict. Raw tenant/product IDs are bounded at 1024 bytes, name/kind text at 64 KiB before trimming; the combined tenant ID, product ID and normalized name is bounded at 2304 bytes to fit the unique database key. Both profiles enforce strict exact-case non-null JSON within 64 KiB and same-host HTTPS cookie Origin with Bearer precedence. Local memory remains nondurable. This records an environment definition, not proof of an actual deployment.

Operation ID: createDeploymentEnvironment
Tags: evydence
Auth: BearerAuth
Scopes: deployment:write
Idempotency: Idempotency-Key
Request: application/json: CreateDeploymentEnvironmentRequest
Responses: 201 application/json: DeploymentEnvironmentEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

GET /v1/evidence

List evidence

Lists tenant-scoped evidence by exact optional release/type filters under evidence:read. PostgreSQL uses a focused query without Ledger relationships, tenant-wide projection refresh or cache authority. SQL candidate visibility and keyset bounds precede metadata reads; current selected parent coordinates and worker-owned provenance are validated in one repeatable-read view with unconditional rollback and no writes. Only canonical permission denials are filtered; bounded batches refill before deciding a continuation. Existing response fields, ordering and tenant/resource/filter-bound cursors remain. Selected item/provenance reads retain the 8 MiB and 4096-fact budgets, and serialized returned items have a 16 MiB page budget; oversized or malformed data fails without a partial page. PostgreSQL filter text is raw NUL-free UTF-8 capped at 1024 bytes and timestamp filters must fit UTC years 1 through 9999. Stored JSON numbers are preserved exactly for transport; historical normalized-JSON hash behavior remains unchanged. Local memory retains its explicit compatibility reader. These reads do not verify payload bytes, evidence completeness, scanner authority or compliance. Results use bounded keyset pagination. Cursor tokens are opaque and bound to the tenant, filters, sort, and direction.

Operation ID: listEvidence
Tags: evydence
Auth: BearerAuth
Scopes: evidence:read
Idempotency: not required
Request: none
Responses: 200 application/json: EvidenceItemListEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/evidence

Create evidence

Creates immutable evidence metadata requiring evidence:write. PostgreSQL uses native durable execution without Ledger cloning/replay/refresh. Every retry checks current coherent tenant-owned parents and recognized subject ownership/grants; artifact identity is replay authority, while fresh creation checks supported declared digests. The shared writer fence precedes locks held through evidence/audit/replay commit. The guard reads no historical/private metadata and generates no payload inspection, clock, ID or hash. Changed original bytes conflict and completed replay adds no effects. Both profiles enforce exact-case non-null fields/items, raw NUL-free UTF-8 IDs bounded at 1024 bytes before trimming, at most 1024 supplied subject/tag/limitation items and the existing 64 KiB body/JSON structural limits. Numeric metadata is decoded without transport rounding; the unchanged hash profile retains its documented float64 normalization limitation. Omitted observed_at defaults to command time; supplied UTC timestamps require years 1 through 9999. Cookie writes require same-host HTTPS Origin with Bearer precedence. Opaque payload references are omitted on safe replay. Internal staged-payload capabilities are not accepted by this route; recording does not upload bytes or verify provenance. Local memory remains nondurable and evidence core fields are append-only.

Operation ID: createEvidence
Tags: evydence
Auth: BearerAuth
Scopes: evidence:write
Idempotency: Idempotency-Key
Request: application/json: CreateEvidenceRequest
Responses: 201 application/json: EvidenceItemEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/evidence-bundles

Export evidence bundle

Exports a signed portable manifest of evidence references from one bounded committed snapshot under bundle:read. Explicit IDs are trimmed, sorted and deduplicated; omitted/empty IDs select only currently authorized evidence. Release filters also require current release-root authority. PostgreSQL uses native durable HTTP execution without Ledger cloning/replay/refresh. Every retry checks the requested root/references; completed replay additionally authorizes the original saved evidence IDs, not a new automatic selection. The shared writer fence precedes current tenant/selected-parent locks held through the outer replay transaction. Replay reads only ownership coordinates, not evidence payload/title metadata, the export snapshot, signing keys or providers; it allocates no bundle clocks/IDs and does not hash or sign again. A revoked signing key does not rewrite a historical bundle or turn replay into a current verification result. Fresh exports recheck selected coordinates and the signature against current signing-key lifecycle before atomically committing signature, bundle, caller audit and replay; export adds no worker job. Original request-byte identity, public DTOs/schema versions and normalized-JSON hash behavior remain unchanged. Both profiles require exact-case non-null JSON fields/items, raw NUL-free UTF-8 IDs of at most 1024 bytes, the existing 64 KiB body and JSON structural limits, and same-host HTTPS Origin for cookie mutations with Bearer precedence. Snapshot selections retain the 4096 combined evidence/proof-row and 8 MiB proof-metadata limits; unsupported saved selections fail closed. New durable times use UTC microseconds. Local memory explicitly checks the actual response selection before disclosure but remains nondurable, without database ownership transactions. Export does not prove evidence completeness, external key custody, release security or compliance.

Operation ID: exportEvidenceBundle
Tags: evydence
Auth: BearerAuth
Scopes: bundle:read
Idempotency: Idempotency-Key
Request: application/json: ExportEvidenceBundleRequest
Responses: 201 application/json: EvidenceBundleEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/evidence-bundles/import

Import evidence bundle

Validates the portable manifest hash, evidence-bundle.v1.0.0 version and normalized evidence-ID set, then records only a target-tenant import receipt and caller-attributed audit entry. Empty evidence selections are allowed; manifest IDs cannot repeat after trimming, while duplicate outer IDs retain set semantics. Source identities, timestamps and signature references are untrusted labels, not resource lookups or target authority. Human actors require current tenant-wide bundle:write permission. PostgreSQL uses native durable HTTP execution without Ledger cloning/replay/refresh; every retry rechecks target-tenant authority/existence without hashing the manifest or allocating receipt clocks/IDs. The shared writer fence precedes tenant locks held through receipt/audit/replay commit. Changed original bytes conflict; completed replay returns the original safe receipt. Both profiles enforce exact-case non-null fields/items and NUL-free UTF-8 outer labels; source IDs and reference text are bounded at 1024 raw bytes, manifest hashes at 128 bytes, outer evidence/signature lists at 1024 entries before normalization, and the encoded manifest at 64 KiB with the existing JSON structural limits. The HTTP body remains bounded at 64 KiB. Cookie writes require same-host HTTPS Origin with Bearer precedence. New durable timestamps use UTC microseconds. Existing normalized-JSON hashing, including its float64 numeric limitation, is unchanged. Local memory remains nondurable. An accepted receipt does not ingest evidence, verify signatures, establish provenance or prove security/compliance.

Operation ID: importEvidenceBundle
Tags: evydence
Auth: BearerAuth
Scopes: bundle:write
Idempotency: Idempotency-Key
Request: application/json: EvidenceBundle
Responses: 201 application/json: EvidenceBundleImportEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/evidence-graph-snapshots

Create evidence graph snapshot

Creates a deterministic product/release evidence adjacency snapshot through focused Package commands without an aggregate fallback. Current ownership and evidence:read grants precede every replay; PostgreSQL commits bounded adjacency, audit and replay atomically. PostgreSQL is required for local evaluation. Recorded references do not prove trust or evidence completeness.

Operation ID: createGraphSnapshot
Tags: evydence
Auth: BearerAuth
Scopes: evidence:read
Idempotency: Idempotency-Key
Request: application/json: CreateGraphSnapshotRequest
Responses: 201 application/json: EvidenceGraphSnapshotEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/evidence-summaries

Create evidence-backed summary

Creates an evidence-backed technical summary with citations, assumptions, and limitations. Supports tenant, product, release, evidence, build, and customer_package roots. Omit evidence_ids or use [] for automatic selection; explicit IDs are trimmed, sorted, unique and limited to 512. Automatic selection uses stored product/project/release coordinates, not inferred parents, exact build identity or a customer package's frozen manifest. PostgreSQL reads only bounded citation metadata under current report:read root authority and commits the summary, caller-attributed audit and successful idempotency replay in the same transaction. Citation titles are limited to 64 KiB, type text to 128 bytes, identifiers/hashes to 1024 bytes, and selected metadata plus the encoded public result each have a 4 MiB budget. Oversized selections fail rather than truncate. Replays recheck current root authority. Cookie-authenticated creates require a single same-host HTTPS Origin; explicit bearer credentials retain precedence. The handler requires focused ports, without an aggregate fallback; PostgreSQL is required for local evaluation. These summaries do not assert legal compliance, certification, or release security.

Operation ID: createEvidenceSummary
Tags: evydence
Auth: BearerAuth
Scopes: report:read
Idempotency: Idempotency-Key
Request: application/json: CreateEvidenceSummaryRequest
Responses: 201 application/json: EvidenceSummaryEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

GET /v1/evidence/search

Search evidence

Searches tenant-scoped evidence with exact deterministic filters under evidence:read. The legacy source alias remains supported for source_system; supplying both is rejected. PostgreSQL uses a focused, cache-independent repeatable-read query with SQL-side candidate grant visibility before keyset limits and selected ownership/worker-provenance checks before metadata reads. Only canonical permission denials are filtered and batches refill to preserve continuation. Product/project/release coordinates inferred through builds or deployments can authorize visibility, but filter matching remains against stored fields. Created-time bounds are inclusive; subject ID matches stored ID or digest. Existing response fields, ordering and tenant/resource/filter-bound cursors remain; the historical limit alias still sets page size. Raw NUL-free UTF-8 filter text is capped at 1024 bytes, timestamps must fit UTC years 1 through 9999, and serialized returned items have a 16 MiB page budget. The existing 8 MiB item/provenance and 4096-fact limits remain. Malformed or oversized selected projections fail without partial results; unauthorized metadata is not loaded. Stored JSON numbers are preserved exactly for transport without rehashing records or changing historical hash normalization. Queries roll back unconditionally and create no audit, receipt or job. Local memory remains an explicit compatibility profile. Search is not payload verification or an evidence completeness/security/compliance conclusion. Results use bounded keyset pagination. Cursor tokens are opaque and bound to the tenant, filters, sort, and direction.

Operation ID: searchEvidence
Tags: evydence
Auth: BearerAuth
Scopes: evidence:read
Idempotency: not required
Request: none
Responses: 200 application/json: EvidenceSearchEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

GET /v1/evidence/{id}

Get evidence

Returns a tenant-scoped immutable evidence item by id.

Operation ID: getEvidence
Tags: evydence
Auth: BearerAuth
Scopes: evidence:read
Idempotency: not required
Request: none
Responses: 200 application/json: EvidenceItemEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

GET /v1/evidence/{id}/lifecycle-events

List evidence lifecycle events

Lists append-only lifecycle events for a tenant-scoped evidence item. PostgreSQL pages ordinary evidence events from a consistent snapshot without loading all lifecycle records; worker-owned evidence retains its validated projection path. Sensitive detail fields are removed from responses. Results use bounded keyset pagination. Cursor tokens are opaque and bound to the tenant, filters, sort, and direction.

Operation ID: listEvidenceLifecycleEvents
Tags: evydence
Auth: BearerAuth
Scopes: evidence:read
Idempotency: not required
Request: none
Responses: 200 application/json: EvidenceLifecycleEventListEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/evidence/{id}/lifecycle-events

Record evidence lifecycle event

Appends an evidence lifecycle event such as amendment, redaction marker, tombstone, or retention marker. PostgreSQL uses focused native durable execution without Ledger cloning or reload. Every retry checks current tenant-owned evidence/parent/replacement/target coordinates and evidence:write grants; the writer fence precedes ownership locks held through relationship/event/audit/replay commit. Completed retries do not reread metadata or lifecycle history, rehash legacy origins, or allocate event IDs. Original request bytes remain the fingerprint. Strict non-null JSON rejects duplicate, unknown and case-aliased fields; raw NUL-free UTF-8 IDs are capped at 1024 bytes before trimming, action/target-type at 128 bytes and reason/details at 64 KiB, with existing 64 KiB body and 16 KiB JSON-string limits. Cookie writes require same-host HTTPS Origin with Bearer precedence. Local memory remains nondurable. Reasons/details are redacted; details cannot contain the reserved evydence_canonical_origin_v1 key. Ordinary events may mark worker-owned evidence without changing its projection.

Operation ID: recordEvidenceLifecycleEvent
Tags: evydence
Auth: BearerAuth
Scopes: evidence:write
Idempotency: Idempotency-Key
Request: application/json: RecordEvidenceLifecycleEventRequest
Responses: 201 application/json: EvidenceLifecycleEventEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/evidence/{id}/link

Link evidence

Creates an append-only relationship from evidence to another tenant-scoped subject. Worker-owned parser and build-attestation evidence has fixed projection relationships and returns a conflict instead. PostgreSQL uses focused native durable execution without Ledger cloning or reload. Every retry checks current tenant-owned evidence/parent/replacement/target coordinates and evidence:write grants; the writer fence precedes ownership locks held through relationship/event/audit/replay commit. Completed retries do not reread metadata or lifecycle history, rehash legacy origins, or allocate event IDs. Original request bytes remain the fingerprint. Strict non-null JSON rejects duplicate, unknown and case-aliased fields; raw NUL-free UTF-8 IDs are capped at 1024 bytes before trimming, action/target-type at 128 bytes and reason/details at 64 KiB, with existing 64 KiB body and 16 KiB JSON-string limits. Cookie writes require same-host HTTPS Origin with Bearer precedence. Local memory remains nondurable. Targets are product or release; a new key appends another link, while a completed retry adds no effects.

Operation ID: linkEvidence
Tags: evydence
Auth: BearerAuth
Scopes: evidence:write
Idempotency: Idempotency-Key
Request: application/json: LinkEvidenceRequest
Responses: 201 application/json: EvidenceItemEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/evidence/{id}/supersede

Supersede evidence

Supersedes immutable evidence by linking it to replacement evidence and appending lifecycle metadata. Worker-owned parser and build-attestation evidence has fixed projection relationships and returns a conflict instead. PostgreSQL uses focused native durable execution without Ledger cloning or reload. Every retry checks current tenant-owned evidence/parent/replacement/target coordinates and evidence:write grants; the writer fence precedes ownership locks held through relationship/event/audit/replay commit. Completed retries do not reread metadata or lifecycle history, rehash legacy origins, or allocate event IDs. Original request bytes remain the fingerprint. Strict non-null JSON rejects duplicate, unknown and case-aliased fields; raw NUL-free UTF-8 IDs are capped at 1024 bytes before trimming, action/target-type at 128 bytes and reason/details at 64 KiB, with existing 64 KiB body and 16 KiB JSON-string limits. Cookie writes require same-host HTTPS Origin with Bearer precedence. Local memory remains nondurable.

Operation ID: supersedeEvidence
Tags: evydence
Auth: BearerAuth
Scopes: evidence:write
Idempotency: Idempotency-Key
Request: application/json: SupersedeEvidenceRequest
Responses: 201 application/json: EvidenceItemEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

GET /v1/exceptions

List exceptions

Lists tenant- and current verify-grant-scoped exceptions, optionally filtered by release. In the PostgreSQL profile, release ownership and bounded keyset pages are resolved in one database snapshot before results are returned. A missing filtered release returns 404; an existing release outside the actor's grants returns 403. Results use bounded keyset pagination. Cursor tokens are opaque and bound to the tenant, filters, sort, and direction.

Operation ID: listExceptions
Tags: evydence
Auth: BearerAuth
Scopes: verify:read
Idempotency: not required
Request: none
Responses: 200 application/json: ExceptionListEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/exceptions

Create exception

Creates a scoped, expiring release/finding/control exception that is inactive until approved.

Operation ID: createException
Tags: evydence
Auth: BearerAuth
Scopes: release:write
Idempotency: Idempotency-Key
Request: application/json: CreateExceptionRequest
Responses: 201 application/json: ExceptionEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/exceptions/{id}/approve

Approve exception

Approves an unexpired exception as an audited append-only transition.

Operation ID: approveException
Tags: evydence
Auth: BearerAuth
Scopes: release:write
Idempotency: Idempotency-Key
Request: application/json: EmptyObject
Responses: 200 application/json: ExceptionEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

GET /v1/health

Health

Returns low-detail liveness status without touching tenant evidence or secret material.

Operation ID: health
Tags: evydence
Auth: BearerAuth
Scopes: none
Idempotency: not required
Request: none
Responses: 200 application/json: HealthStatusEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/incident-webhooks/{receiver_id}

Receive signed incident webhook event

Public incident timeline webhook: no bearer token or HTTP Idempotency-Key is required. PostgreSQL uses focused Operations commands and bounded tenant/receiver/event point reads. A single event-id, timestamp, and signature header is required. The Ed25519 signature covers UTC RFC3339 seconds, newline, trimmed event id, newline, and exact body bytes; timestamps must be within five minutes. Verification precedes payload parsing. Event-id retries with the same bytes return the original event/timeline, including after a fresh signature; changed bytes conflict. Current receiver status/key, incident parents, and linked evidence ownership are rechecked on replay. Evidence must belong to the incident product and, if release-scoped, its release. Event, timeline, and webhook-attributed audit commit together. JSON bodies are limited to 64 KiB and reject null/duplicate/unknown fields, NUL, and invalid UTF-8. IDs are capped at 1024 UTF-8 bytes; the tenant/receiver/event replay key is capped at 2304 combined bytes. New timestamps use UTC microsecond precision.

Operation ID: receiveIncidentWebhook
Tags: evydence
Auth: BearerAuth
Scopes: none
Idempotency: not required
Request: application/json: SignedIncidentWebhookPayload
Responses: 201 application/json: IncidentWebhookDeliveryEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/incidents

Create incident

Creates an append-only incident linked to a current tenant-owned product and optional matching release. PostgreSQL uses a focused Operations command; incident:write and current human tenant/product/release grants are checked before creation or replay. Record, principal-attributed audit, and replay completion commit together. Omitted opened_at defaults to creation time; timestamps are UTC with microsecond precision. Null fields and NUL/invalid UTF-8 are rejected; IDs are capped at 1024 bytes and title at 64 KiB.

Operation ID: createIncident
Tags: evydence
Auth: BearerAuth
Scopes: incident:write
Idempotency: Idempotency-Key
Request: application/json: CreateIncidentRequest
Responses: 201 application/json: IncidentEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/incidents/{id}/timeline

Record incident timeline event

Appends a timeline event to a current tenant-owned incident. PostgreSQL uses a focused Operations command and independently checks incident:write grants for the incident and optional current evidence parents before creation or replay. Event, audit, and replay completion commit together. Omitted occurred_at defaults to creation time; timestamps are UTC with microsecond precision. Null fields and NUL/invalid UTF-8 are rejected; IDs are capped at 1024 bytes and event_type/summary at 64 KiB each. Linked evidence organizes recorded references without proving remediation completeness.

Operation ID: recordIncidentTimeline
Tags: evydence
Auth: BearerAuth
Scopes: incident:write
Idempotency: Idempotency-Key
Request: application/json: RecordIncidentTimelineRequest
Responses: 201 application/json: IncidentTimelineEventEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/incidents/{id}/webhook-receivers

Create signed incident webhook receiver

Creates an incident-scoped Ed25519 webhook receiver. PostgreSQL uses a focused Operations command, current tenant-owned incident parents, and incident:write grants before creation or HTTP idempotency replay. Receiver, principal audit, and replay completion commit together. Public keys accept raw or padded standard base64 and are stored as raw standard base64; private keys stay with the external incident tool. JSON bodies are limited to 64 KiB; null/duplicate/unknown fields, NUL, and invalid UTF-8 are rejected. IDs are capped at 1024 UTF-8 bytes, name/provider at 64 KiB each, and encoded keys at 1024 bytes. New timestamps use UTC microsecond precision.

Operation ID: createIncidentWebhookReceiver
Tags: evydence
Auth: BearerAuth
Scopes: incident:write
Idempotency: Idempotency-Key
Request: application/json: CreateIncidentWebhookReceiverRequest
Responses: 201 application/json: IncidentWebhookReceiverEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/legal-holds

Create legal hold

Creates an append-only legal-hold marker for a tenant-scoped retention subject.

Operation ID: createLegalHold
Tags: evydence
Auth: BearerAuth
Scopes: admin
Idempotency: Idempotency-Key
Request: application/json: CreateLegalHoldRequest
Responses: 201 application/json: LegalHoldEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

GET /v1/marketplace-collectors

List marketplace collector records

Keyset-pages tenant-scoped marketplace collector metadata through a focused query without an aggregate fallback. Human sessions need a current tenant-level collector:read grant; PostgreSQL applies the tenant limit in SQL and is required for local evaluation. Results use bounded keyset pagination. Cursor tokens are opaque and bound to the tenant, filters, sort, and direction.

Operation ID: listMarketplaceCollectors
Tags: evydence
Auth: BearerAuth
Scopes: collector:read
Idempotency: not required
Request: none
Responses: 200 application/json: MarketplaceCollectorListEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/marketplace-collectors

Create marketplace collector record

Records tenant-scoped marketplace collector metadata through focused Experimental commands without an aggregate fallback. Current tenant-wide human collector:admin authority and signature, SBOM and scan ownership precede every replay. Metadata, manifest-hash audit and replay commit atomically in PostgreSQL, which is required for local evaluation. Registration does not verify package bytes, publish a package or endorse a provider.

Operation ID: createMarketplaceCollector
Tags: evydence
Auth: BearerAuth
Scopes: collector:admin
Idempotency: Idempotency-Key
Request: application/json: CreateMarketplaceCollectorRequest
Responses: 201 application/json: MarketplaceCollectorEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

GET /v1/marketplace-collectors/{id}/health

Marketplace collector health report

Returns marketplace collector health through a focused read-only query without an aggregate fallback. Human sessions need a current tenant-level collector:read grant. PostgreSQL, required for local evaluation, resolves current owned signature, SBOM and scan references without reading their payloads. Presence does not prove package safety, marketplace trust or provider endorsement.

Operation ID: marketplaceCollectorHealth
Tags: evydence
Auth: BearerAuth
Scopes: collector:read
Idempotency: not required
Request: none
Responses: 200 application/json: MarketplaceCollectorHealthReportEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/merkle-batches

Create Merkle checkpoint batch

Creates a Merkle batch over tenant audit-chain entries for checkpoint export or transparency anchoring.

Operation ID: createMerkleBatch
Tags: evydence
Auth: BearerAuth
Scopes: keys:admin
Idempotency: Idempotency-Key
Request: application/json: CreateMerkleBatchRequest
Responses: 201 application/json: MerkleBatchEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

GET /v1/merkle-batches/{id}/verify

Verify Merkle checkpoint batch

Verifies a tenant-scoped Merkle batch root and leaf set against stored audit-chain entries.

Operation ID: verifyMerkleBatch
Tags: evydence
Auth: BearerAuth
Scopes: verify:read
Idempotency: not required
Request: none
Responses: 200 application/json: VerificationResultEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

GET /v1/metrics

Safe tenant metrics

Returns safe tenant-scoped resource and object-reconciliation metrics for admin actors. Reconciliation metrics contain counters only: no object keys, digests, raw payloads, or provider errors. An explicit instance:admin actor also receives bounded aggregate outbox gauges without tenant labels, payloads, or failure details. A Prometheus text response is available when requested with Accept: text/plain. PostgreSQL is required for local evaluation.

Operation ID: metrics
Tags: evydence
Auth: BearerAuth
Scopes: admin
Idempotency: not required
Request: none
Responses: 200 application/json: MetricsSnapshotEnvelope, text/plain: string; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/object-retention-policies

Create object retention policy record

Creates a tenant-scoped retention-intent record and its maximum provider-observation age. Creation does not prove provider-enforced retention.

Operation ID: createObjectRetentionPolicy
Tags: evydence
Auth: BearerAuth
Scopes: admin
Idempotency: Idempotency-Key
Request: application/json: CreateObjectRetentionPolicyRequest
Responses: 201 application/json: ObjectRetentionPolicyEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/object-retention-policies/{id}/verify

Verify object retention policy record

Records a provider-backed retention observation when available. Without complete provider, bucket, mode, duration, legal-hold, and observation-time evidence, the policy remains not_verified; expired successful observations are reported as stale.

Operation ID: verifyObjectRetentionPolicy
Tags: evydence
Auth: BearerAuth
Scopes: verify:read
Idempotency: Idempotency-Key
Request: application/json: EmptyObject
Responses: 200 application/json: ObjectRetentionPolicyEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/openapi-contracts

Upload OpenAPI contract

Uploads an OpenAPI 3.1 contract, stores raw bytes as evidence, and records normalized operation metadata. Use application/vnd.oai.openapi+json with the explicit metadata headers for streaming uploads up to 20 MiB; the JSON envelope remains limited to small requests.

Operation ID: uploadOpenAPIContract
Tags: evydence
Auth: BearerAuth
Scopes: evidence:write
Idempotency: Idempotency-Key
Request: application/json: UploadOpenAPIContractRequest; application/vnd.oai.openapi+json: string
Responses: 201 application/json: OpenAPIContractEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

GET /v1/openapi-contracts/{id}

Get OpenAPI contract

Returns tenant-scoped OpenAPI contract metadata by id. PostgreSQL reads require current same-tenant source evidence, product, and optional release parentage; human sessions need an evidence:read grant covering the product or release.

Operation ID: getOpenAPIContract
Tags: evydence
Auth: BearerAuth
Scopes: evidence:read
Idempotency: not required
Request: none
Responses: 200 application/json: OpenAPIContractEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/openapi-diffs

Create OpenAPI contract diff

Creates a deterministic OpenAPI contract diff for release contract checks.

Operation ID: createOpenAPIDiff
Tags: evydence
Auth: BearerAuth
Scopes: evidence:read
Idempotency: Idempotency-Key
Request: application/json: CreateOpenAPIDiffRequest
Responses: 201 application/json: ContractDiffEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

GET /v1/openapi.json

OpenAPI

Returns the generated OpenAPI 3.1 document served by this process.

Operation ID: openapi
Tags: evydence
Auth: BearerAuth
Scopes: none
Idempotency: not required
Request: none
Responses: 200 application/json: OpenAPIDocument; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/organizations

Create organization

Creates a tenant-scoped organization record for human identity grouping. Focused Identity commands check current tenant-wide human authority and use atomic audit/replay; slugs are trimmed and case-sensitive. PostgreSQL is required for local evaluation.

Operation ID: createOrganization
Tags: evydence
Auth: BearerAuth
Scopes: identity:admin
Idempotency: Idempotency-Key
Request: application/json: CreateOrganizationRequest
Responses: 201 application/json: OrganizationEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/policies/evaluate

Evaluate release policy

Evaluates built-in deterministic release policy checks for a release.

Operation ID: evaluatePolicy
Tags: evydence
Auth: BearerAuth
Scopes: verify:read
Idempotency: Idempotency-Key
Request: application/json: EvaluatePolicyRequest
Responses: 201 application/json: PolicyEvaluationEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

GET /v1/products

List products

Lists tenant-scoped products visible to the authenticated actor. Results use bounded keyset pagination. Cursor tokens are opaque and bound to the tenant, filters, sort, and direction.

Operation ID: listProducts
Tags: evydence
Auth: BearerAuth
Scopes: product:read
Idempotency: not required
Request: none
Responses: 200 application/json: ProductListEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/products

Create product

Creates a tenant-scoped product requiring product:write and a current tenant-wide human grant. PostgreSQL uses native durable execution without Ledger replay/refresh. Every retry checks and locks current tenant authority without product metadata or slug uniqueness reads; fresh creation retains unique tenant/slugs and atomic product/audit/replay effects. Identical request bytes replay the original response; changed bytes conflict. Strict non-null exact JSON applies in both profiles. Raw NUL-free UTF-8 name/slug text is capped at 64 KiB before trimming; the normalized slug retains its 1024-byte limit, and the whole JSON body remains capped at 64 KiB. Cookie writes require same-host HTTPS Origin with Bearer precedence. Local memory remains nondurable.

Operation ID: createProduct
Tags: evydence
Auth: BearerAuth
Scopes: product:write
Idempotency: Idempotency-Key
Request: application/json: CreateProductRequest
Responses: 201 application/json: ProductEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

GET /v1/products/{id}

Get product

Returns a tenant-scoped product by id.

Operation ID: getProduct
Tags: evydence
Auth: BearerAuth
Scopes: product:read
Idempotency: not required
Request: none
Responses: 200 application/json: ProductEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/projects

Create project

Creates a tenant-scoped project requiring project:write and current product authority. PostgreSQL uses native durable execution; every retry holds current tenant/product ownership locks through the outer transaction without loading product names/slugs or existing child metadata. Fresh creation retains product slug-drift checks and atomic project/audit/replay effects. Project names are not reuse keys. Identical bytes replay the original response; changed bytes conflict. Both profiles use strict non-null exact JSON, NUL-free UTF-8 raw parent IDs capped at 1024 bytes and raw names capped at 64 KiB before trimming; the whole body remains capped at 64 KiB. Cookie writes require same-host HTTPS Origin with Bearer precedence. Local memory remains nondurable.

Operation ID: createProject
Tags: evydence
Auth: BearerAuth
Scopes: project:write
Idempotency: Idempotency-Key
Request: application/json: CreateProjectRequest
Responses: 201 application/json: ProjectEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

GET /v1/projects/{id}

Get project

Returns a tenant-scoped project by id.

Operation ID: getProject
Tags: evydence
Auth: BearerAuth
Scopes: project:read
Idempotency: not required
Request: none
Responses: 200 application/json: ProjectEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/provider-verifications

Verify stored provider identity metadata

Records an administrative provider-identity assessment using stored tenant-owned metadata, optional local OIDC/SAML credential verification, and an optional configured live OIDC provider validator. PostgreSQL uses focused bounded Identity reads and revalidates provider/link state before receipt, caller-attributed audit and safe replay commit atomically. Human callers need tenant-wide identity:admin authority before reservation/replay. Inactive providers may be assessed; no session or authorization grant is issued. Failed HTTP assessments roll back receipt/audit and retain only a safe failed-retry marker. Cookie-authenticated requests require a single same-host HTTPS Origin; bearer credentials take precedence. SAML assertions require authentication_request_id and API-delivered state_secret from the separate SAML initiation endpoint. The same bounded standard signature/recipient/NameID/correlation/replay profile as login applies. Verified proof consumption, receipt and audits commit together without issuing a session, including verified identity denials; invalid signatures do not consume state. Completed idempotent replay checks current administration and provider ownership without demanding fresh state or re-verifying the historical proof. Unbound/custom SAML assertions cannot produce a passing receipt. The handler requires focused command/replay ports, with no aggregate fallback. PostgreSQL is required for local evaluation.

Operation ID: verifyProviderIdentity
Tags: evydence
Auth: BearerAuth
Scopes: identity:admin
Idempotency: Idempotency-Key
Request: application/json: VerifyProviderIdentityRequest
Responses: 201 application/json: ProviderVerificationEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/public-transparency-log-entries

Publish public transparency log entry record

Records declared publication metadata through focused Experimental commands without an aggregate fallback. Current tenant-wide human keys:admin authority and owned log, checkpoint and Merkle batch precede every replay. Metadata, canonical entry-hash audit and replay commit atomically in PostgreSQL, which is required for local evaluation. No provider request, external publication or inclusion assurance is performed.

Operation ID: publishPublicTransparencyLogEntry
Tags: evydence
Auth: BearerAuth
Scopes: keys:admin
Idempotency: Idempotency-Key
Request: application/json: PublishPublicTransparencyLogEntryRequest
Responses: 201 application/json: PublicTransparencyLogEntryEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/public-transparency-log-entries/{id}/fetch-proof

Fetch and verify public transparency log inclusion proof

Fetches inclusion proof material through focused commands without an aggregate fallback and assesses it locally. Current tenant-wide human keys:admin authority and owned entry/root chain precede fetching and every saved replay; replay does not refetch. PostgreSQL holds bounded entry/endpoint locks through provider call, assessment, audit and replay commit and is required for local evaluation. Unusable provider results return safe 422 responses; well-formed nonmatching proofs remain not verified. Remote observation cannot be rolled back. Endpoint trust and provider semantics remain deployment responsibilities.

Operation ID: fetchPublicTransparencyLogEntryProof
Tags: evydence
Auth: BearerAuth
Scopes: keys:admin
Idempotency: Idempotency-Key
Request: application/json: EmptyObject
Responses: 200 application/json: PublicTransparencyLogEntryEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/public-transparency-log-entries/{id}/verify

Verify public transparency log inclusion proof

Assesses operator-supplied RFC6962-style inclusion proof material through focused commands without an aggregate fallback. Current tenant-wide human keys:admin authority and owned entry/root chain precede every replay. Passing or failing local assessment, proof-bound audit and replay commit atomically in PostgreSQL, which is required for local evaluation. Local root recomputation does not authenticate the supplied root or establish public-log trust.

Operation ID: verifyPublicTransparencyLogEntry
Tags: evydence
Auth: BearerAuth
Scopes: keys:admin
Idempotency: Idempotency-Key
Request: application/json: VerifyPublicTransparencyLogEntryRequest
Responses: 200 application/json: PublicTransparencyLogEntryEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/public-transparency-logs

Create public transparency log record

Records tenant-owned public transparency log configuration through focused Experimental commands without an aggregate fallback. Current tenant-wide human keys:admin authority precedes every replay. Metadata, audit and replay commit together in PostgreSQL, which is required for local evaluation. The supplied public key is metadata, not a validated trust root; no outbound request or external publication occurs.

Operation ID: createPublicTransparencyLog
Tags: evydence
Auth: BearerAuth
Scopes: keys:admin
Idempotency: Idempotency-Key
Request: application/json: CreatePublicTransparencyLogRequest
Responses: 201 application/json: PublicTransparencyLogEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

GET /v1/questionnaire-answer-library

List questionnaire answer library entries

Lists questionnaire answer drafts with optional question, product, and release filters. Product and release filters must reference current tenant-owned parents and agree when combined. Human sessions see only entries covered by their current resource grants; tenant-wide drafts require a tenant grant. The handler requires its focused query port, without an aggregate inventory fallback; PostgreSQL is required for local evaluation. Results use bounded keyset pagination. Cursor tokens are opaque and bound to the tenant, filters, sort, and direction.

Operation ID: listQuestionnaireAnswerLibrary
Tags: evydence
Auth: BearerAuth
Scopes: package:read
Idempotency: not required
Request: none
Responses: 200 application/json: QuestionnaireAnswerLibraryEntryListEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/questionnaire-answer-library

Create questionnaire answer library entry

Creates a reusable answer draft under package:write with at least one nonblank question/type/control selector and optional coherent product/release scope. Human sessions need a current matching tenant/product/release grant; unscoped entries require tenant-wide authority. Release parents are resolved for authorization only; raw product/release coordinates and exact stored-coordinate citation filtering remain unchanged. IDs/selectors are limited to 1024 raw UTF-8/NUL-free bytes, answers and each limitation to 64 KiB, citations to 4096, and limitations to 128. Aggregate input text, selected citation coordinates, and encoded output each have a 4 MiB budget; the complete HTTP body retains its 64 KiB limit. Citations and limitations are trimmed/sorted with duplicates preserved; blank limitations remain inert, and omitted/empty limitations use the existing human-review warning. PostgreSQL locks current tenant/root/control/framework/evidence parents after the worker/audit fence, selects no existing private answers or evidence payloads, and commits the answer, caller audit and body-keyed successful replay together. Replays recheck current root grants and all references. Both profiles reject null, duplicate, unknown or mixed-case fields, invalid UTF-8 and NUL. Cookie writes require one same-host HTTPS Origin; bearer credentials retain precedence. Historical response schemas remain unchanged. These entries are reusable drafts requiring human review, not evidence completeness, customer-package redaction or compliance conclusions. The handler requires focused ports, without an aggregate fallback; PostgreSQL is required for local evaluation.

Operation ID: createQuestionnaireAnswerLibraryEntry
Tags: evydence
Auth: BearerAuth
Scopes: package:write
Idempotency: Idempotency-Key
Request: application/json: CreateQuestionnaireAnswerLibraryEntryRequest
Responses: 201 application/json: QuestionnaireAnswerLibraryEntryEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/questionnaire-drafts

Create evidence-backed questionnaire draft

Creates a technical questionnaire draft from a tenant-owned template and optional coherent product/release scope. Requires package:read and matching tenant/product/release grants for human sessions. Reusable answers are independently authorized before private text is read; tenant-wide answers require a tenant grant. Candidates are ranked by matching question/control/type and scope specificity, then newest timestamp and ID ascending. Stored product/release selection is preserved; release-only input does not implicitly include product-scoped library entries. Without an authorized answer, the draft cites matching evidence or states that none is recorded. Cited evidence must remain in the requested scope. PostgreSQL uses bounded selectors rather than full prompts/payloads, allows at most 512 questions and 4096 combined answer candidates plus 4096 combined citations, limits identifiers/selectors to 1024 bytes, answers and each limitation to 64 KiB, limitations to 128 per response, and selected metadata and the public draft each to 4 MiB. Overflow fails rather than truncates. Draft, caller-attributed audit and successful idempotency replay commit together. Replay rechecks current root authority and binds canonical credential scopes and human resource grants without reading private answer text. Changed permissions or older body-only draft fingerprints conflict with 409 when root access remains allowed; use a new key for a new draft. Null/duplicate/unknown fields and invalid UTF-8/NUL input are rejected. Cookie writes require one same-host HTTPS Origin; bearer credentials retain precedence. The handler requires focused ports, without an aggregate fallback; PostgreSQL is required for local evaluation. These drafts require human review and do not provide compliance conclusions or customer-package redaction.

Operation ID: createQuestionnaireDraft
Tags: evydence
Auth: BearerAuth
Scopes: package:read
Idempotency: Idempotency-Key
Request: application/json: CreateQuestionnaireDraftRequest
Responses: 201 application/json: QuestionnaireDraftEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/questionnaire-packages

Create questionnaire package

Creates an evidence-backed questionnaire response package under package:write from one tenant-owned template and optional coherent product/release selection. Human sessions require matching tenant/product/release grants for the selection; unscoped selection requires tenant-wide authority. Optional package_id is an independently authorized customer-package association, not an implicit filter, download, redaction or expiry/NDA acceptance operation. Explicit selection must agree with its current product/release parents. Reusable answers require independent package:write authority before private text is read. Response ranking, raw selection coordinates, response schema and normalized-JSON manifest hash remain unchanged. PostgreSQL uses focused Package commands and bounded question selectors, candidate scope metadata and citations, never template prompts, associated manifests or evidence payloads. Limits are 512 questions, 4096 combined answer candidates, 4096 combined citations, 1024-byte IDs/selectors, 64 KiB answers and each limitation, 128 limitations per response, and 4 MiB selected metadata and encoded output. Overflow fails rather than truncates. The worker/audit fence precedes root/template/package locks; package, caller audit and successful replay commit atomically. Replay checks current roots and association and binds canonical credential scopes and human grants; changed permissions or older body-only fingerprints return 409 when current access is still allowed. Use a new key for a new result. The API rejects null/duplicate/unknown/mixed-case fields, invalid UTF-8 and NUL; cookie writes require one same-host HTTPS Origin, with bearer precedence. The handler requires focused ports, without an aggregate fallback; PostgreSQL is required for local evaluation. Generated responses require human review and provide neither compliance conclusions nor customer-safe redaction.

Operation ID: createQuestionnairePackage
Tags: evydence
Auth: BearerAuth
Scopes: package:write
Idempotency: Idempotency-Key
Request: application/json: CreateQuestionnairePackageRequest
Responses: 201 application/json: QuestionnairePackageEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/questionnaire-templates

Create questionnaire template

Creates a tenant-wide questionnaire definition under package:write; human sessions require a current tenant-level grant. Questions retain input order and require unique trimmed IDs, nonblank prompts and current same-tenant control/framework references when supplied. Name, version, selectors and allowed fields are limited to 1024 raw UTF-8/NUL-free bytes; prompts to 64 KiB; question count to 512; allowed fields to 128 per question. Aggregate input text and the encoded template each have a 4 MiB budget. Allowed fields are inert metadata, trimmed/sorted with duplicates and blank strings preserved. PostgreSQL uses focused Package commands, locks only tenant and selected control/framework identities after the worker/audit fence, and commits template, caller audit and successful body-keyed idempotency replay together. Replays recheck current tenant-wide authority and referenced control ownership. The API rejects null/duplicate/unknown/mixed-case fields, invalid UTF-8 and NUL; cookie mutations require one same-host HTTPS Origin, with explicit bearer precedence. Historical templates and response schemas are unchanged. The handler requires focused ports, without an aggregate fallback; PostgreSQL is required for local evaluation.

Operation ID: createQuestionnaireTemplate
Tags: evydence
Auth: BearerAuth
Scopes: package:write
Idempotency: Idempotency-Key
Request: application/json: CreateQuestionnaireTemplateRequest
Responses: 201 application/json: QuestionnaireTemplateEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

GET /v1/ready

Readiness

Runs bounded PostgreSQL, migration, writer-lease, object-store, and signing-configuration probes configured for this process. The public result contains no tenant data, credentials, paths, or raw dependency errors. An unavailable result includes typed dependency retry metadata and Retry-After. PostgreSQL is required for local evaluation.

Operation ID: ready
Tags: evydence
Auth: BearerAuth
Scopes: none
Idempotency: not required
Request: none
Responses: 200 application/json: ReadinessStatusEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/json: ReadinessStatusEnvelope

POST /v1/redaction-profiles

Create redaction profile

Creates an explicit redaction profile for customer and report package generation.

Operation ID: createRedactionProfile
Tags: evydence
Auth: BearerAuth
Scopes: package:write
Idempotency: Idempotency-Key
Request: application/json: CreateRedactionProfileRequest
Responses: 201 application/json: RedactionProfileEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/release-bundles

Create release bundle

Creates an immutable signed release bundle for a release.

Operation ID: createReleaseBundle
Tags: evydence
Auth: BearerAuth
Scopes: bundle:write
Idempotency: Idempotency-Key
Request: application/json: CreateReleaseBundleRequest
Responses: 201 application/json: ReleaseBundleEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

GET /v1/release-bundles/{id}

Get release bundle

Returns an immutable release bundle through a focused query only when its current tenant-owned release is covered by the caller's bundle:read grant. PostgreSQL is required for local evaluation.

Operation ID: getReleaseBundle
Tags: evydence
Auth: BearerAuth
Scopes: bundle:read
Idempotency: not required
Request: none
Responses: 200 application/json: ReleaseBundleEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

GET /v1/release-bundles/{id}/manifest

Get release bundle manifest

Returns the deterministic release bundle manifest through a focused query under the same current-release and bundle:read authorization as the bundle read. PostgreSQL is required for local evaluation.

Operation ID: getReleaseBundleManifest
Tags: evydence
Auth: BearerAuth
Scopes: bundle:read
Idempotency: not required
Request: none
Responses: 200 application/json: ReleaseBundleManifestEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

GET /v1/release-bundles/{id}/verify

Verify release bundle

Verifies a tenant-scoped release bundle and returns a deterministic verification result.

Operation ID: verifyReleaseBundle
Tags: evydence
Auth: BearerAuth
Scopes: verify:read
Idempotency: not required
Request: none
Responses: 200 application/json: VerificationResultEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

GET /v1/release-candidates

List release candidates

Lists tenant-scoped release candidates, optionally filtered by release. Results use bounded keyset pagination. Cursor tokens are opaque and bound to the tenant, filters, sort, and direction.

Operation ID: listReleaseCandidates
Tags: evydence
Auth: BearerAuth
Scopes: release:read
Idempotency: not required
Request: none
Responses: 200 application/json: ReleaseCandidateListEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/release-candidates

Create release candidate

Creates a release-candidate snapshot requiring release:write and current parent/reference ownership and human grants. PostgreSQL uses native durable execution without Ledger cloning/replay/refresh. Every retry checks coherent tenant/release/source parents and all seven reference groups without private metadata, stored candidate documents, clocks, IDs or hashing. The shared writer fence precedes ownership locks held through snapshot/audit/replay commit. Fresh creation preserves open/revision-1 initialization and the versioned normalized-JSON hash; reference sorting retains duplicates and different keys create distinct snapshots. Identical bytes replay the original result; changed bytes conflict. Both profiles require strict non-null exact JSON within 64 KiB. Raw NUL-free UTF-8 names are capped at 64 KiB, parent/reference IDs at 1024 bytes before trimming; arrays share 4096 entries and 64 KiB of raw identifier text. Cookie writes require same-host HTTPS Origin with Bearer precedence. Local memory remains nondurable. Snapshots do not establish release safety or compliance.

Operation ID: createReleaseCandidate
Tags: evydence
Auth: BearerAuth
Scopes: release:write
Idempotency: Idempotency-Key
Request: application/json: CreateReleaseCandidateRequest
Responses: 201 application/json: ReleaseCandidateEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

GET /v1/release-candidates/{id}

Get release candidate

Returns a tenant-scoped release candidate by id.

Operation ID: getReleaseCandidate
Tags: evydence
Auth: BearerAuth
Scopes: release:read
Idempotency: not required
Request: none
Responses: 200 application/json: ReleaseCandidateEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/release-candidates/{id}/promote

Promote release candidate

Records a release-candidate lifecycle transition without mutating the original snapshot. Supply the current revision as a strong decimal ETag in If-Match. PostgreSQL uses native durable execution without Ledger cloning/replay/refresh. Every retry checks current tenant/subject/release/product ownership and grants without lifecycle state, revision, private metadata, clocks or IDs; the shared writer fence precedes locks held through state/audit/replay commit. Completed replay returns the original response without reapplying lifecycle rules against newer state; fresh execution retains bounded revision/state checks. The unchanged conditional-action-v1 fingerprint binds canonical strong If-Match and original body bytes, so changed intent conflicts. Raw NUL-free UTF-8 IDs are limited to 1024 bytes before trimming and JSON to 64 KiB. Cookie writes require same-host HTTPS Origin with Bearer precedence. Local memory remains nondurable. Strict JSON accepts only non-null reason text, NUL-free UTF-8 capped at 64 KiB before trimming. Snapshot fields/hash remain unchanged.

Operation ID: promoteReleaseCandidate
Tags: evydence
Auth: BearerAuth
Scopes: release:write
Idempotency: Idempotency-Key
Request: application/json: ReleaseCandidateTransitionRequest
Responses: 200 application/json: ReleaseCandidateEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/release-candidates/{id}/reject

Reject release candidate

Operation ID: rejectReleaseCandidate
Tags: evydence
Auth: BearerAuth
Scopes: release:write
Idempotency: Idempotency-Key
Request: application/json: ReleaseCandidateTransitionRequest
Responses: 200 application/json: ReleaseCandidateEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/releases

Create release

Creates an append-only draft release at revision 1, requiring release:write and current product authority. PostgreSQL uses native durable execution; every retry holds current tenant/product ownership locks without names, slugs, versions or existing child reads. Fresh creation retains product slug-drift checks, unique per-product versions and atomic release/audit/replay effects. Identical bytes replay the original response; changed bytes conflict. Both profiles use strict non-null exact JSON, NUL-free UTF-8 raw parent IDs capped at 1024 bytes and raw versions capped at 64 KiB before trimming; the whole body remains capped at 64 KiB. Versions exceeding PostgreSQL encoded index capacity return safe 400 without writes. Cookie writes require same-host HTTPS Origin with Bearer precedence. Local memory remains nondurable.

Operation ID: createRelease
Tags: evydence
Auth: BearerAuth
Scopes: release:write
Idempotency: Idempotency-Key
Request: application/json: CreateReleaseRequest
Responses: 201 application/json: ReleaseEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

GET /v1/releases/{id}

Get release

Returns a tenant-scoped release by id.

Operation ID: getRelease
Tags: evydence
Auth: BearerAuth
Scopes: release:read
Idempotency: not required
Request: none
Responses: 200 application/json: ReleaseEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/releases/{id}/approve

Approve release

Approves a release as an append-only transition. Supply the current revision as a strong decimal ETag in If-Match. PostgreSQL uses native durable execution without Ledger cloning/replay/refresh. Every retry checks current tenant/subject/release/product ownership and grants without lifecycle state, revision, private metadata, clocks or IDs; the shared writer fence precedes locks held through state/audit/replay commit. Completed replay returns the original response without reapplying lifecycle rules against newer state; fresh execution retains bounded revision/state checks. The unchanged conditional-action-v1 fingerprint binds canonical strong If-Match and original body bytes, so changed intent conflicts. Raw NUL-free UTF-8 IDs are limited to 1024 bytes before trimming and JSON to 64 KiB. Cookie writes require same-host HTTPS Origin with Bearer precedence. Local memory remains nondurable. Nonempty bodies must be empty JSON objects; legacy absent/blank bodies remain accepted.

Operation ID: approveRelease
Tags: evydence
Auth: BearerAuth
Scopes: release:write
Idempotency: Idempotency-Key
Request: application/json: EmptyObject
Responses: 200 application/json: ReleaseEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/releases/{id}/evidence-flow/start

Start release evidence flow

Returns a high-level release evidence workflow plan, current evidence counts, required scopes, assumptions, and limitations. This read-only convenience operation does not create evidence.

Operation ID: startReleaseEvidenceFlow
Tags: evydence
Auth: BearerAuth
Scopes: release:read
Idempotency: not required
Request: none
Responses: 200 application/json: ReleaseEvidenceFlowEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/releases/{id}/freeze

Freeze release

Freezes a release as an append-only transition. Supply the current revision as a strong decimal ETag in If-Match. PostgreSQL uses native durable execution without Ledger cloning/replay/refresh. Every retry checks current tenant/subject/release/product ownership and grants without lifecycle state, revision, private metadata, clocks or IDs; the shared writer fence precedes locks held through state/audit/replay commit. Completed replay returns the original response without reapplying lifecycle rules against newer state; fresh execution retains bounded revision/state checks. The unchanged conditional-action-v1 fingerprint binds canonical strong If-Match and original body bytes, so changed intent conflicts. Raw NUL-free UTF-8 IDs are limited to 1024 bytes before trimming and JSON to 64 KiB. Cookie writes require same-host HTTPS Origin with Bearer precedence. Local memory remains nondurable. Nonempty bodies must be empty JSON objects; legacy absent/blank bodies remain accepted.

Operation ID: freezeRelease
Tags: evydence
Auth: BearerAuth
Scopes: release:write
Idempotency: Idempotency-Key
Request: application/json: EmptyObject
Responses: 200 application/json: ReleaseEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

GET /v1/releases/{id}/security-summary

Release security summary

Returns a tenant-scoped release security summary through a bounded focused Risk query, requiring report:read and current tenant/product/release grants for human sessions. Raw evidence payload bytes and private decision notes are excluded. PostgreSQL is required for local evaluation.

Operation ID: releaseSecuritySummary
Tags: evydence
Auth: BearerAuth
Scopes: report:read
Idempotency: not required
Request: none
Responses: 200 application/json: ReleaseSecuritySummaryEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/remediation-tasks

Create remediation task

Creates a remediation task with at least one incident or release reference and optional evidence. PostgreSQL uses a focused Operations command and independently checks incident:write grants for every current tenant-owned reference before creation or replay. Authorized incident and release references need not share a product. Task, audit, and replay completion commit together. Omitted due_at is absent; explicit null is rejected as published. Timestamps are UTC with microsecond precision. IDs are capped at 1024 bytes and title/owner at 64 KiB each; NUL/invalid UTF-8 are rejected. Recording a task does not prove remediation completeness.

Operation ID: createRemediationTask
Tags: evydence
Auth: BearerAuth
Scopes: incident:write
Idempotency: Idempotency-Key
Request: application/json: CreateRemediationTaskRequest
Responses: 201 application/json: RemediationTaskEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/report-templates

Create report template

Records an inert report-template definition requiring report:read and current tenant-wide human permission. PostgreSQL uses native durable execution without Ledger cloning/replay/refresh. Every retry checks tenant authority/existence without definition reads, clocks or IDs; the shared writer fence precedes locks held through record/audit/replay commit. Allowed fields are trimmed, sorted and deduplicated; template text is never executed. Different-key duplicate tenant/name/version creates conflict; changed original bytes conflict and same-key replay returns the original safe result. Raw NUL-free UTF-8 name/version/type/field text is bounded at 64 KiB, template text at 1 MiB and allowed fields at 1024 entries before deduplication; the normalized tenant/name/version key is bounded at 2304 bytes. Both profiles enforce exact-case non-null fields/items and the existing 1 MiB body/JSON structural limits. Cookie writes require same-host HTTPS Origin with Bearer precedence. Durable timestamps use UTC microseconds; local memory remains nondurable. A definition does not establish compliance or verify evidence.

Operation ID: createReportTemplate
Tags: evydence
Auth: BearerAuth
Scopes: report:read
Idempotency: Idempotency-Key
Request: application/json: CreateReportTemplateRequest
Responses: 201 application/json: CustomReportTemplateEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/report-templates/{id}/render

Render report template

Materializes an append-only metadata report requiring report:read and current tenant-wide human permission. Only allowed subject_type, subject_id and generated_at labels are emitted; unknown allowed fields are ignored, subjects are not dereferenced and template text is never executed. Raw labels remain in output while stored coordinates are trimmed; normalized string-output hashing is unchanged. PostgreSQL uses native durable execution without Ledger replay/refresh. Every retry checks current tenant/template ownership without definition reads, clocks, IDs or output generation; the shared writer fence precedes locks held through report/audit/replay commit. Completed replay preserves the original safe result; fresh rendering uses one current definition bounded at 8 MiB. Raw NUL-free UTF-8 tenant/template IDs are bounded at 1024 bytes and subject labels at 64 KiB. Both profiles enforce exact-case non-null fields and the existing 64 KiB body/JSON structural limits. Cookie writes require same-host HTTPS Origin with Bearer precedence. Durable timestamps use UTC microseconds; local memory remains nondurable. This does not verify subject evidence or establish security/compliance conclusions.

Operation ID: renderReportTemplate
Tags: evydence
Auth: BearerAuth
Scopes: report:read
Idempotency: Idempotency-Key
Request: application/json: RenderReportTemplateRequest
Responses: 201 application/json: RenderedCustomReportEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/reports/anomaly

Generate deterministic anomaly report

Creates an experimental anomaly report through focused commands without an aggregate fallback. Current report:read grants and owned subject coordinates precede every replay. Bounded release facts generate fixed signals; other supported roots currently have no checks, and clear is not a security conclusion. Report, audit and replay commit together in PostgreSQL, which is required for local evaluation. Replays retain original signals without recalculation.

Operation ID: generateAnomalyReport
Tags: evydence
Auth: BearerAuth
Scopes: report:read
Idempotency: Idempotency-Key
Request: application/json: CreateAnomalyReportRequest
Responses: 201 application/json: AnomalyReportEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

GET /v1/reports/control-coverage

Control coverage report

Returns deterministic control coverage through a focused bounded query with linked evidence, missing evidence, assumptions, and limitations. PostgreSQL is required for local evaluation.

Operation ID: controlCoverageReport
Tags: evydence
Auth: BearerAuth
Scopes: report:read
Idempotency: not required
Request: none
Responses: 200 application/json: ReadinessReportEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

GET /v1/reports/cra-readiness

CRA readiness report

Returns a CRA-oriented readiness report through a focused bounded query without legal compliance or certification conclusions. PostgreSQL is required for local evaluation.

Operation ID: craReadinessReport
Tags: evydence
Auth: BearerAuth
Scopes: report:read
Idempotency: not required
Request: none
Responses: 200 application/json: ReadinessReportEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

GET /v1/reports/cra-readiness-html

CRA readiness HTML package

Creates a deterministic CRA-readiness HTML package without legal compliance or certification conclusions.

Operation ID: craReadinessHTMLPackage
Tags: evydence
Auth: BearerAuth
Scopes: report:read
Idempotency: not required
Request: none
Responses: 200 application/json: HTMLReportPackageEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

GET /v1/reports/cra-vulnerability-handling

CRA vulnerability handling report

Returns a CRA-oriented vulnerability handling evidence report through a focused bounded query without legal compliance, certification, scanner-authority, or release-security conclusions. PostgreSQL is required for local evaluation.

Operation ID: craVulnerabilityHandlingReport
Tags: evydence
Auth: BearerAuth
Scopes: report:read
Idempotency: not required
Request: none
Responses: 200 application/json: CRAVulnerabilityHandlingReportEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

GET /v1/reports/custody-review

Signing custody review report

Returns tenant signing-provider and object-lock verification metadata for deployment custody review. It is evidence metadata only, not legal compliance proof, certification, HSM custody proof, or a secure-deployment guarantee.

Operation ID: signingCustodyReviewReport
Tags: evydence
Auth: BearerAuth
Scopes: keys:admin
Idempotency: not required
Request: none
Responses: 200 application/json: SigningCustodyReviewReportEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

GET /v1/reports/incident-package

Incident package report

Returns a deterministic incident package report with timeline, remediation tasks, linked evidence, assumptions, and limitations.

Operation ID: incidentReport
Tags: evydence
Auth: BearerAuth
Scopes: incident:read
Idempotency: not required
Request: none
Responses: 200 application/json: IncidentReportEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

GET /v1/reports/missing-evidence

Missing evidence report

Returns a read-only deterministic missing-evidence report for a release through focused readiness/report queries, with assumptions and limitations. It requires verify:read and current tenant/product/release grants for human sessions; reads do not create policy evaluations, audit entries, jobs or replay records. PostgreSQL is required for local evaluation.

Operation ID: missingEvidenceReport
Tags: evydence
Auth: BearerAuth
Scopes: verify:read
Idempotency: not required
Request: none
Responses: 200 application/json: MissingEvidenceReportEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/reports/pdf

Create reproducible PDF report package

Creates a minimal title-only PDF-marked envelope through focused Package commands without an aggregate fallback. Current report:read grants and owned matching product/release coordinates precede every replay. Verified staging metadata, finalizer job, report, audit and replay commit together in PostgreSQL, which is required for local evaluation. Physical staged bytes can outlive rollback. Replay does not regenerate or restage bytes and preserves the privacy-safe omission of payload_ref. This is not a full evidence report renderer, PDF-reader interoperability guarantee or compliance conclusion.

Operation ID: createPDFReportPackage
Tags: evydence
Auth: BearerAuth
Scopes: report:read
Idempotency: Idempotency-Key
Request: application/json: CreatePDFReportPackageRequest
Responses: 201 application/json: PDFReportPackageEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

GET /v1/reports/release-readiness

Release readiness report

Returns a deterministic release-readiness report with gaps, assumptions, and limitations.

Operation ID: releaseReadinessReport
Tags: evydence
Auth: BearerAuth
Scopes: verify:read
Idempotency: not required
Request: none
Responses: 200 application/json: ReadinessReportEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

GET /v1/reports/retention

Retention report

Returns a retention report for tenant-scoped holds and overrides with storage verification limitations.

Operation ID: retentionReport
Tags: evydence
Auth: BearerAuth
Scopes: admin
Idempotency: not required
Request: none
Responses: 200 application/json: RetentionReportEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

GET /v1/reports/security-review-package

Security review package report

Returns a redaction-aware security-review package report with assumptions and limitations.

Operation ID: securityReviewPackageReport
Tags: evydence
Auth: BearerAuth
Scopes: package:read
Idempotency: not required
Request: none
Responses: 200 application/json: SecurityReviewPackageReportEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

GET /v1/reports/security-update-evidence

Security update evidence report

Returns a security update evidence report through a focused bounded query for release-scoped fixed decisions, incidents, remediation tasks, and linked evidence without legal or security conclusions. PostgreSQL is required for local evaluation.

Operation ID: securityUpdateEvidenceReport
Tags: evydence
Auth: BearerAuth
Scopes: report:read
Idempotency: not required
Request: none
Responses: 200 application/json: SecurityUpdateEvidenceReportEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

GET /v1/reports/vulnerability-decision-summary

Customer-safe vulnerability decision summary

Returns customer-safe active vulnerability decision summaries for one tenant-owned release with assumptions and limitations. Raw payloads and internal notes are excluded.

Operation ID: vulnerabilityDecisionSummaryReport
Tags: evydence
Auth: BearerAuth
Scopes: report:read
Idempotency: not required
Request: none
Responses: 200 application/json: VulnerabilityDecisionSummaryReportEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

GET /v1/reports/vulnerability-posture

Vulnerability posture report

Returns aggregate severity counts and open-critical counts from stored vulnerability-scan findings only through a focused bounded query; decisions, VEX, exceptions, and workflow records are not included. Without release_id, human sessions require a tenant-wide security:read grant; a release filter permits a matching tenant, product, or release grant. Raw findings are not returned, and scanner coverage is not independently verified. PostgreSQL is required for local evaluation.

Operation ID: vulnerabilityPostureReport
Tags: evydence
Auth: BearerAuth
Scopes: security:read
Idempotency: not required
Request: none
Responses: 200 application/json: VulnerabilityPostureReportEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/retention-overrides

Create retention override

Creates an append-only retention override for a tenant-scoped retention subject.

Operation ID: createRetentionOverride
Tags: evydence
Auth: BearerAuth
Scopes: admin
Idempotency: Idempotency-Key
Request: application/json: CreateRetentionOverrideRequest
Responses: 201 application/json: RetentionOverrideEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

GET /v1/role-bindings

List role bindings

Lists tenant-scoped role bindings visible to the identity administrator. Results use bounded keyset pagination. Cursor tokens are opaque and bound to the tenant, filters, sort, and direction.

Operation ID: listRoleBindings
Tags: evydence
Auth: BearerAuth
Scopes: identity:admin
Idempotency: not required
Request: none
Responses: 200 application/json: RoleBindingListEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/role-bindings

Create role binding

Creates a tenant-scoped role binding for a user or collector subject. Focused Identity commands check current tenant-wide human admin authority and bounded current subject/resource ownership before writes and replay. Binding, audit and safe replay completion commit atomically. Empty/omitted resource type with an empty ID, or tenant with an empty/current tenant ID, remains tenant-wide; supported scoped resources require a nonempty owned ID. A package's optional release must match its product. Reusing a completed key/body returns the original public binding; a new key intentionally permits another assignment with identical grant coordinates. No credential hashes, target metadata or evidence manifests are loaded. PostgreSQL is required for local evaluation.

Operation ID: createRoleBinding
Tags: evydence
Auth: BearerAuth
Scopes: identity:admin
Idempotency: Idempotency-Key
Request: application/json: CreateRoleBindingRequest
Responses: 201 application/json: RoleBindingEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/saas/profiles

Create SaaS edition profile

Records experimental hosted-deployment intent through focused commands without an aggregate fallback. Exact issued instance:admin authority and both existing tenant roots precede every replay; tenant admin or wildcard authority is insufficient. An instance administrator may reference another admin tenant. Profile, raw-value configuration hash audit and replay commit atomically in PostgreSQL, which is required for local evaluation. No deployment, isolation enforcement or readiness certification is performed.

Operation ID: createSaaSEditionProfile
Tags: evydence
Auth: BearerAuth
Scopes: instance:admin
Idempotency: Idempotency-Key
Request: application/json: CreateSaaSEditionProfileRequest
Responses: 201 application/json: SaaSEditionProfileEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

GET /v1/sbom-components

List SBOM components

Lists tenant- and resource-grant-scoped SBOM components by SBOM, release, artifact, name/version/PURL query, or exact PURL. In the PostgreSQL profile, results use durable keyset pages without the legacy 500-component preselection cap. Source evidence must be an SBOM with matching release and artifact subject; an inaccessible, missing, or inconsistently linked filtered SBOM returns 404. Results use bounded keyset pagination. Cursor tokens are opaque and bound to the tenant, filters, sort, and direction.

Operation ID: listSBOMComponents
Tags: evydence
Auth: BearerAuth
Scopes: evidence:read
Idempotency: not required
Request: none
Responses: 200 application/json: SBOMComponentRecordListEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/sbom-diffs

Create SBOM diff

Creates a deterministic SBOM diff between two tenant-scoped SBOM records.

Operation ID: createSBOMDiff
Tags: evydence
Auth: BearerAuth
Scopes: evidence:read
Idempotency: Idempotency-Key
Request: application/json: CreateSBOMDiffRequest
Responses: 201 application/json: SBOMDiffEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/sboms

Upload CycloneDX SBOM

Uploads a CycloneDX SBOM payload, stores raw bytes in object storage, and records normalized SBOM metadata. Use application/vnd.cyclonedx+json with the explicit metadata headers for streaming uploads up to 20 MiB; the JSON envelope remains limited to small requests. In PostgreSQL mode, a focused command validates current tenant-owned release parents and human release/artifact grants before parsing or staging. IDs are NUL-free UTF-8 bounded at 1024 bytes. Wrapped JSON remains capped at 64 KiB and rejects null, duplicate, and unknown fields; native uploads require one nonblank release header and allow one optional artifact header. Declared source size and SHA-256 are verified. Evidence, SBOM, audit, payload metadata, outbox jobs, and idempotency completion commit together. Replay checks current grants without parsing; retained body-only native receipts require matching tenant, release, optional artifact, and format and never execute a new upload. With worker-owned parsing and object storage, the response contains parsed components while the stored projection stays accepted until its parser job runs. Acceptance does not prove SBOM completeness or release security.

Operation ID: uploadSBOM
Tags: evydence
Auth: BearerAuth
Scopes: evidence:write
Idempotency: Idempotency-Key
Request: application/json: EvidenceUploadRequest; application/vnd.cyclonedx+json: string
Responses: 201 application/json: SBOMEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/sboms/spdx

Upload SPDX SBOM

Uploads an SPDX 2.2 or 2.3 JSON SBOM payload, stores immutable raw bytes as evidence, and records deterministic normalization metadata. Use application/spdx+json with explicit metadata headers for streaming uploads up to 20 MiB; the JSON envelope remains limited to small requests. In PostgreSQL mode, a focused command validates current tenant-owned release parents and human release/artifact grants before parsing or staging. IDs are NUL-free UTF-8 bounded at 1024 bytes. Wrapped JSON remains capped at 64 KiB and rejects null, duplicate, and unknown fields; native uploads require one nonblank release header and allow one optional artifact header. Declared source size and SHA-256 are verified. Evidence, SBOM, audit, payload metadata, outbox jobs, and idempotency completion commit together. Replay checks current grants without parsing; retained body-only native receipts require matching tenant, release, optional artifact, and format and never execute a new upload. With worker-owned parsing and object storage, the response contains parsed components while the stored projection stays accepted until its parser job runs. Acceptance does not prove SBOM completeness or release security.

Operation ID: uploadSPDXSBOM
Tags: evydence
Auth: BearerAuth
Scopes: evidence:write
Idempotency: Idempotency-Key
Request: application/json: UploadSPDXSBOMRequest; application/spdx+json: string
Responses: 201 application/json: SBOMEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

GET /v1/sboms/{id}

Get SBOM

Returns a tenant-scoped SBOM record and its stored components when parsed; an accepted pending record may have an empty spec version and no components. In the PostgreSQL profile, source evidence and optional release/artifact parents must resolve within the same tenant, and the optional artifact must match the source evidence's sole artifact subject, before current resource grants are applied.

Operation ID: getSBOM
Tags: evydence
Auth: BearerAuth
Scopes: evidence:read
Idempotency: not required
Request: none
Responses: 200 application/json: SBOMEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/security-documents

Upload manual security document

Uploads sensitive manual security evidence such as threat model, security review, or penetration-test report metadata and raw payload reference. In PostgreSQL mode, focused security:write commands check current tenant-owned product/release parents and human resource grants before parsing or staging; scoped human artifact grants require a current authorized evidence/build association, while tenant-wide grants and issued credentials do not need a narrower association. No request reloads the Ledger aggregate. Wrapped JSON remains limited to 64 KiB and rejects null metadata/payload, duplicate keys, and unknown envelope fields. IDs are NUL-free UTF-8 bounded at 1024 bytes. Evidence, accepted document metadata, payload metadata, finalizer job, two audit entries, and safe idempotency completion commit in one transaction. Same-key replay rechecks current grants without parsing or staging and preserves safe metadata; payload_ref is omitted on replay by the central privacy policy. Raw payload bytes are never included in responses. Failed commands roll back document effects; a response-free failed-key record can remain. Local-memory mode retains its explicit compatibility command. Payload is an opaque non-null JSON value whose exact encoded bytes are retained, not executed. Omitted media_type defaults to application/octet-stream. Manual evidence has lower default trust and requires human review; acceptance does not establish legal sufficiency.

Operation ID: uploadManualSecurityDocument
Tags: evydence
Auth: BearerAuth
Scopes: security:write
Idempotency: Idempotency-Key
Request: application/json: UploadManualSecurityDocumentRequest
Responses: 201 application/json: ManualSecurityDocumentEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/security-scans

Upload security scan

Operation ID: uploadSecurityScan
Tags: evydence
Auth: BearerAuth
Scopes: security:write
Idempotency: Idempotency-Key
Request: application/json: UploadSecurityScanRequest
Responses: 201 application/json: SecurityScanEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

GET /v1/signing-keys

List signing keys

Lists tenant signing public-key lifecycle metadata under verify:read; human sessions require a current tenant-level grant. PostgreSQL reads are keyset-paginated and never select encrypted private key material. Results use bounded keyset pagination. Cursor tokens are opaque and bound to the tenant, filters, sort, and direction.

Operation ID: listSigningKeys
Tags: evydence
Auth: BearerAuth
Scopes: verify:read
Idempotency: not required
Request: none
Responses: 200 application/json: SigningKeyListEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/signing-keys/rotate

Rotate signing key

Rotates the active tenant signing key, retires the prior key with an explicit validity window, and returns public-key metadata only.

Operation ID: rotateSigningKey
Tags: evydence
Auth: BearerAuth
Scopes: keys:admin
Idempotency: Idempotency-Key
Request: application/json: SigningKeyRotationRequest
Responses: 201 application/json: SigningKeyEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/signing-keys/{id}/revoke

Revoke signing key

Revokes a tenant signing key as an audited lifecycle transition. Ordinary revocation preserves signatures valid at signing time; compromised-key policy is explicit and can invalidate historical results.

Operation ID: revokeSigningKey
Tags: evydence
Auth: BearerAuth
Scopes: keys:admin
Idempotency: Idempotency-Key
Request: application/json: SigningKeyTransitionRequest
Responses: 200 application/json: SigningKeyEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/signing-operations

Create signing provider operation receipt

Requests a configured signing executor through focused Verification commands without an aggregate fallback. Current tenant-wide human keys:admin authority and owned active provider/subject roots precede every replay. Canonical requests bind tenant, provider/type/key reference, subject, payload digest, request ID and nonce; caller-supplied signatures are rejected. Signature, operation, audit and replay commit together in PostgreSQL, which is required for local evaluation. Replay does not sign again; rollback cannot undo provider observation. Raw signature bytes and key material are not response data.

Operation ID: createSigningOperation
Tags: evydence
Auth: BearerAuth
Scopes: keys:admin
Idempotency: Idempotency-Key
Request: application/json: CreateSigningOperationRequest
Responses: 201 application/json: SigningOperationEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/signing-providers

Create signing provider record

Creates signing provider metadata for external signing operations. Production private key material must not be supplied.

Operation ID: createSigningProvider
Tags: evydence
Auth: BearerAuth
Scopes: keys:admin
Idempotency: Idempotency-Key
Request: application/json: CreateSigningProviderRequest
Responses: 201 application/json: SigningProviderEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/source/branches

Record source branch

Records or replaces source branch metadata after current repository tenant/project authorization before metadata reads. PostgreSQL mode requires any supplied head commit to belong to the same repository and tenant. Existing branch identity and creation time are retained; head, protected flag and protection hash are replaced, including defaults when omitted. Repository/name upserts serialize; each executed create/update and its audit persist in the same transaction with replay state. Combined tenant/repository/name identity is limited to 2304 UTF-8 bytes and protection hash metadata to 64 KiB. A supplied protection hash is recorded metadata only; recording does not verify provider identity or branch protection. PostgreSQL HTTP uses native durable replay with a read-only current tenant/repository/product/project and optional-head guard before reservation and completed replay, without mutable branch metadata reads, clocks or IDs. The common writer fence precedes tenant/repository/parent/head locks held through the outer replay commit. Original public JSON and request-byte fingerprints are preserved without reapplying old branch state; no outbox job is created. Raw bounds are checked before trimming within the 64 KiB HTTP envelope; whitespace-only supplied heads return not found. Cookie writes require same-host HTTPS Origin; explicit bearer credentials take precedence. Local evaluation requires PostgreSQL; there is no local-memory API path.

Operation ID: upsertSourceBranch
Tags: evydence
Auth: BearerAuth
Scopes: source:write
Idempotency: Idempotency-Key
Request: application/json: UpsertSourceBranchRequest
Responses: 201 application/json: SourceBranchEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/source/commits

Record source commit

Records immutable source commit metadata using current repository tenant/project authorization before metadata reads. PostgreSQL mode normalizes 40-character hexadecimal SHAs to lowercase and returns the original repository/SHA record without changing metadata or auditing twice. Commit and audit are persisted in the same transaction. Stores only sha256 of exact nonblank message bytes; whitespace-only messages have no hash. Author and message inputs are bounded to 64 KiB; timestamps use UTC microseconds and committed_at defaults to recording time when omitted. Recording does not verify provider identity or repository contents. PostgreSQL HTTP uses native durable replay with a read-only current tenant/repository/product/project guard before reservation and completed replay, without metadata reads, clocks or IDs. The common writer fence precedes tenant/repository/parent locks held through the outer replay commit. Original public JSON and request-byte fingerprints are preserved, with no outbox job. Raw bounds are checked before trimming; IDs and raw SHA text are limited to 1024 bytes within the 64 KiB HTTP envelope. Cookie writes require same-host HTTPS Origin; explicit bearer credentials take precedence. Local evaluation requires PostgreSQL; there is no local-memory API path.

Operation ID: recordSourceCommit
Tags: evydence
Auth: BearerAuth
Scopes: source:write
Idempotency: Idempotency-Key
Request: application/json: RecordSourceCommitRequest
Responses: 201 application/json: SourceCommitEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/source/pull-requests

Record pull request

Records an append-only pull-request metadata snapshot after current repository tenant/project authorization before metadata reads. Any supplied head commit must belong to the same repository and tenant. Each non-replayed call creates a new snapshot, even for the same provider ID; recording does not update an earlier snapshot. An omitted provider defaults to the stored repository provider. Snapshot, audit and HTTP replay state persist in the same transaction. Tenant/repository/head IDs are bounded to 1024 UTF-8 bytes and submitted metadata to 64 KiB; states are open, closed or merged. Recording does not verify provider identity, repository contents, review approval or merge authority. PostgreSQL HTTP uses native durable replay with a read-only current tenant/repository/product/project and optional-head guard before reservation and completed replay, without provider defaults, earlier snapshots, clocks or IDs. The common writer fence precedes tenant/repository/parent/head locks held through the outer replay commit. Original public JSON and request-byte fingerprints are preserved, with no outbox job. Raw bounds are checked before trimming within the 64 KiB HTTP envelope; whitespace-only supplied heads return not found. Cookie writes require same-host HTTPS Origin; explicit bearer credentials take precedence. Local evaluation requires PostgreSQL; there is no local-memory API path.

Operation ID: recordPullRequest
Tags: evydence
Auth: BearerAuth
Scopes: source:write
Idempotency: Idempotency-Key
Request: application/json: RecordPullRequestRequest
Responses: 201 application/json: PullRequestEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

GET /v1/source/repositories

List source repositories

Lists tenant-scoped source repositories, optionally filtered by project. Results use bounded keyset pagination. Cursor tokens are opaque and bound to the tenant, filters, sort, and direction.

Operation ID: listSourceRepositories
Tags: evydence
Auth: BearerAuth
Scopes: source:read
Idempotency: not required
Request: none
Responses: 200 application/json: SourceRepositoryListEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/source/repositories

Create source repository

Creates source repository metadata with source:write authorization and native durable replay in PostgreSQL. A read-only current tenant/ownership guard runs before reservation and completed replay, without reading clone URLs or branch metadata or allocating IDs. PostgreSQL serializes tenant/provider/full-name reuse and returns the existing repository unchanged without another audit entry. Human sessions need a tenant-wide grant for detached creation, or a matching product/project grant for attached creation; the existing repository is separately authorized before metadata is read. The tenant fence and submitted/existing product/project locks survive through the outer replay commit. Raw UTF-8 and NUL-free text bounds are checked before trimming; IDs are bounded at 1024 bytes, tenant/provider/full-name keys at 2304 bytes and optional metadata at 64 KiB, within the 64 KiB HTTP envelope. Repository and audit records commit in the same transaction as HTTP replay state, with no outbox job. Completed replay preserves the original public response and request-byte fingerprint. Cookie-authenticated writes require a same-host HTTPS Origin; explicit bearer credentials take precedence. Local evaluation requires PostgreSQL; there is no local-memory API path. This records supplied metadata and does not contact or verify the provider, clone URL or repository contents.

Operation ID: createSourceRepository
Tags: evydence
Auth: BearerAuth
Scopes: source:write
Idempotency: Idempotency-Key
Request: application/json: CreateSourceRepositoryRequest
Responses: 201 application/json: SourceRepositoryEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/sso/authentication-requests

Begin OIDC authentication

Creates server-owned OIDC login state for a configured active provider. Requests expire after five minutes; at most 64 retained requests per provider are allowed, including consumed rows until expiry. Overflow returns 429; creation prunes bounded expired operational rows without deleting evidence/audit/session history. API delivery returns state_secret once in JSON and sets no cookie. Browser delivery requires one same HTTPS Origin, sets a host-only HttpOnly Secure SameSite=Strict state cookie and omits state_secret from JSON. Send the returned nonce to the external provider and bind its response to this request. Trust changes invalidate outstanding requests. This endpoint does not redirect, perform authorization-code exchange or call a provider. PostgreSQL is required. Responses use Cache-Control: no-store.

Operation ID: beginOIDCAuthentication
Tags: evydence
Auth: BearerAuth
Scopes: none
Idempotency: not required
Request: application/json: BeginOIDCAuthenticationRequest
Responses: 201 application/json: BeginOIDCAuthenticationEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/sso/identity-links

Link SSO identity

Records an administrator-asserted verified provider subject for a current tenant-owned user with matching normalized email. PostgreSQL uses a focused Identity transaction: current tenant-wide identity:admin authority and parent ownership/email checks precede reservation or replay; link, audit and safe replay commit atomically. This does not verify a live provider credential, activate the user/provider, issue a session or grant roles. PostgreSQL is required for local evaluation.

Operation ID: linkSSOIdentity
Tags: evydence
Auth: BearerAuth
Scopes: identity:admin
Idempotency: Idempotency-Key
Request: application/json: LinkSSOIdentityRequest
Responses: 201 application/json: UserIdentityLinkEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/sso/logout

Logout SSO session

Revokes only the currently authenticated user's tenant-owned SSO session without requiring administration grants. API and collector keys cannot use this route. PostgreSQL uses bounded hash-free locked metadata and one revocation/audit/replay transaction without Ledger inventories. Successful logout clears the HttpOnly Secure SameSite=Strict host-only /v1 cookie only after durable commit. Unauthorized cookie admission also expires it without a database revocation; failed Origin checks and permission denials do not. A revoked or expired secret cannot authenticate another request, including saved-receipt replay. Ambient session-cookie requests require a single HTTPS Origin matching request Host; bearer requests do not. HTTPS proxies must preserve the public Host. PostgreSQL is required for local evaluation.

Operation ID: logoutSSOSession
Tags: evydence
Auth: BearerAuth
Scopes: none
Idempotency: Idempotency-Key
Request: application/json: EmptyObject
Responses: 200 application/json: SSOSessionEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/sso/providers

Create SSO provider

Records tenant SSO provider metadata. PostgreSQL uses focused Identity commands with current tenant-wide administration and input validation before reservation or completed replay, and atomic provider/audit/replay writes without Ledger reloads. Required issuer metadata is an absolute HTTPS URL with a host, no userinfo and no fragment; stored text is bounded, UTF-8 and NUL-free. Explicit null fields/items are rejected. Another key creates another provider for identical metadata. Authorized replay preserves harmless group names within the public provider DTO without weakening generic privacy redaction. Optional static JWKS public keys and SAML signing certificates can be supplied for local token/assertion verification without live provider calls. Shared stateless Identity normalization rejects private/symmetric JOSE members, retains supported public JWK fields only, and normalizes parsed RSA certificates without trailing PEM blocks. This validates supported metadata shapes, not provider ownership or key custody; historical rows and backups are not scrubbed. PostgreSQL is required for local evaluation.

Operation ID: createSSOProvider
Tags: evydence
Auth: BearerAuth
Scopes: identity:admin
Idempotency: Idempotency-Key
Request: application/json: CreateSSOProviderRequest
Responses: 201 application/json: SSOProviderEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/sso/providers/{id}/discover-oidc

Refresh SSO provider OIDC trust material

Fetches the OIDC discovery document and public JWKS for the tenant provider issuer, then stores normalized public trust material. PostgreSQL uses focused Identity commands and a bounded tenant-owned provider read, not Ledger state or provider inventories. Current tenant-wide administration, provider ownership/type and strict optional empty-object body checks precede reservation or replay without network calls. A newly acquired command uses the configured hardened discovery adapter; conditional trust update, canonical-hash audit and safe replay completion commit together. Authorized completed retries return the original public provider without refetching. Private/symmetric JOSE members, empty keys, issuer mismatch and malformed or unsafe retained public text fail verification without replacing current trust or appending an audit; unsupported extension metadata is not retained. Missing/foreign providers return 404, oversized stored metadata returns 409 and provider verification failures return 422. This does not authenticate users, prove provider ownership, scrub historical records/backups, or synchronize groups. PostgreSQL is required for local evaluation.

Operation ID: refreshSSOProviderOIDCTrustMaterial
Tags: evydence
Auth: BearerAuth
Scopes: identity:admin
Idempotency: Idempotency-Key
Request: application/json: EmptyObject
Responses: 200 application/json: SSOProviderEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

GET /v1/sso/providers/{id}/saml-binding

Get SAML provider binding

Returns the selected tenant-owned SAML recipient/NameID binding after current tenant-wide administration and ownership checks. No provider inventory, private trust snapshot, credential or audit mutation is returned or performed. Foreign/missing bindings return 404. PostgreSQL is required.

Operation ID: getSAMLProviderBinding
Tags: evydence
Auth: BearerAuth
Scopes: identity:admin
Idempotency: not required
Request: none
Responses: 200 application/json: SAMLProviderBindingEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/sso/providers/{id}/saml-binding

Configure SAML provider binding

Configures the tenant-owned SAML recipient and NameID format without changing OIDC provider records. Current tenant-wide administration and owned active SAML provider checks run before fresh execution and completed replay. Recipient is exact HTTPS without userinfo/query/fragment; supported NameID formats are explicit. Configuration, canonical-hash audit and safe replay commit together. Changes invalidate outstanding SAML state. Strict JSON rejects unknown/duplicate/case-aliased/null fields within 64 KiB; unsafe cookie writes require same origin. Foreign/missing providers return 404. Public responses omit internal provider trust snapshots. PostgreSQL is required.

Operation ID: configureSAMLProviderBinding
Tags: evydence
Auth: BearerAuth
Scopes: identity:admin
Idempotency: Idempotency-Key
Request: application/json: ConfigureSAMLProviderBindingRequest
Responses: 200 application/json: SAMLProviderBindingEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/sso/providers/{id}/trust-material

Update SSO provider trust material

Rotates tenant SSO provider public trust material for local OIDC ID-token or SAML assertion verification. PostgreSQL uses focused Identity commands and one bounded tenant-owned provider read, not Ledger state or provider inventories. Current tenant-wide administration, input and provider checks run before reservation or completed replay; update, canonical-hash audit and safe replay completion commit together. Foreign/missing providers return 404; oversized or ill-typed stored metadata returns 409 without truncation. OIDC requires nonempty JWKS only; SAML requires signing certificates only. Strict decoding rejects invalid UTF-8, duplicate/unknown fields, trailing JSON and explicit null fields/items; retained public-key text is NUL-free. Shared stateless Identity normalization rejects private/symmetric JOSE members and retains supported public JWK fields only; parsed RSA certificates exclude trailing PEM blocks. Authorized replay preserves normalized public PEM and harmless public group names without weakening generic privacy redaction. Invalid trust material does not replace current trust or append an audit. No live provider call is made; provider ownership and key custody are not proved. Historical records, receipts and backups are not scrubbed or repaired. PostgreSQL is required for local evaluation.

Operation ID: updateSSOProviderTrustMaterial
Tags: evydence
Auth: BearerAuth
Scopes: identity:admin
Idempotency: Idempotency-Key
Request: application/json: UpdateSSOProviderTrustMaterialRequest
Responses: 200 application/json: SSOProviderEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/sso/saml-authentication-requests

Begin SAML authentication

Creates five-minute server-owned SAML login state for an active configured provider and tenant-owned recipient/NameID binding. At most 64 retained requests per provider are allowed; overflow returns 429 and cleanup is bounded. API delivery returns state_secret once; browser delivery requires one same HTTPS Origin and uses a separate host-only HttpOnly Secure SameSite=Strict SAML state cookie. Responses exclude private hashes and use Cache-Control: no-store. Returned ID is the AuthnRequest correlation ID; the caller owns its external provider flow. Trust/binding changes invalidate outstanding state. This endpoint creates no session, redirects nowhere and makes no provider call. PostgreSQL is required.

Operation ID: beginSAMLAuthentication
Tags: evydence
Auth: BearerAuth
Scopes: none
Idempotency: not required
Request: application/json: BeginSAMLAuthenticationRequest
Responses: 201 application/json: BeginSAMLAuthenticationEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/sso/session-exchanges

Exchange SSO credential

Exchanges a locally verified OIDC ID token or SAML assertion after checking a verified identity link, active user and current tenant-owned grants. OIDC requires an unexpired server-owned authentication_request_id, matching state, signed nonce, current configured provider trust snapshot and delivery mode. A verified proof is consumed atomically with verification/session/audits, including identity denials; replay cannot issue another session. API delivery returns the secret once in JSON and sets no cookie. OIDC browser delivery requires one same HTTPS Origin and the single __Host-evydence_oidc_state cookie, omits the JSON secret, sets an HttpOnly Secure session cookie and clears login state. Unknown fields, duplicate keys, supplied nulls, trailing JSON, non-object, invalid UTF-8 and NUL-bearing inputs are rejected. Credential responses use Cache-Control: no-store. No credential or secret enters idempotency receipts; no live provider API or group synchronization call is made. Public identity lookup, credential-proof and linked-account permission denials share generic 401 Problem Details without a session or secret; administrative verification receipt errors retain their separate contract. This exchange and OIDC/SAML initiation share a per-client failure budget, default 20 per fixed UTC minute, independently of general request limiting. Concurrent work reserves capacity before verification; successes release it without clearing earlier failures. Exhaustion or bounded failure-state capacity returns 429 with Retry-After and Cache-Control: no-store before protected effects. The default eight-hour expiry is shortened when the configured maximum is lower; explicit expiry cannot exceed that maximum. Issued session policy and committed last-use activity have the same bounds as administrative issuance. SAML requires its server-owned authentication_request_id and matching state/delivery, configured recipient and NameID format, and a bare signed SAML 2.0 Assertion in the bounded XML signature profile. RSA-SHA256/SHA256, enveloped signature and exclusive canonicalization without comments are supported; the embedded certificate must match an active configured public pin. Signed assertion ID, issuer/audience/subject, recipient, InResponseTo and finite time bounds are checked. Scoped assertion replay and request consumption commit with verification/session/audits, including verified identity denial. Signed SessionNotOnOrAfter caps session lifetime; proof deadlines include selected certificate expiry and are rechecked after locks, writes and commit. SAML browser delivery uses only __Host-evydence_saml_state with the same origin/cookie rules; mixed, duplicate, malformed or ambient API state cookies are rejected. Case-aliased JSON fields are rejected. SAML subject and request IDs are bounded at 1024 and 128 bytes respectively. Historical custom assertions, SAML Response wrappers, encryption, unsolicited login and arbitrary algorithms/profiles are unsupported. The caller owns provider orchestration; no universal interoperability claim is made. PostgreSQL is required for local evaluation.

Operation ID: exchangeSSOCredential
Tags: evydence
Auth: BearerAuth
Scopes: none
Idempotency: not required
Request: application/json: ExchangeSSOCredentialRequest
Responses: 201 application/json: SSOCredentialExchangeEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/sso/sessions

Create SSO session

Creates an administrator-issued human SSO session with current tenant-wide identity:admin authority, a tenant-owned active user and a tenant-owned provider. PostgreSQL uses a focused Identity transaction for session, actual-caller audit and safe replay completion. The first 201 response returns the bearer secret once; completed replay contains only original session metadata and never reissues a credential. This route verifies no provider credential, grants no additional roles and sets no browser cookie. Credential responses use Cache-Control: no-store. Issued session schema v1.1.0 captures a bounded absolute lifetime and idle timeout. Authentication records last use transactionally without extending absolute expiry or replacing the secret; idle, expired, revoked and inactive-user/provider sessions fail across cookie and Bearer paths. PostgreSQL is required for local evaluation.

Operation ID: createSSOSession
Tags: evydence
Auth: BearerAuth
Scopes: identity:admin
Idempotency: Idempotency-Key
Request: application/json: CreateSSOSessionRequest
Responses: 201 application/json: SSOSessionCreateEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/sso/sessions/{id}/revoke

Revoke SSO session

Revokes a current tenant-owned SSO session with tenant-wide identity:admin authority. PostgreSQL reads bounded, hash-free session metadata under a row lock and commits revocation, actual-caller audit and safe replay together without Ledger inventories. An expired session, inactive user/provider or missing parent does not prevent administrative invalidation. A new request for an already-revoked session conflicts; authorized completed replay returns the original safe metadata after current session ownership checks. Ambient session-cookie requests require a single HTTPS Origin matching request Host; bearer requests do not. Successful admin revocation sets no browser cookie; unauthorized session-cookie admission clears it without a database revocation. PostgreSQL is required for local evaluation.

Operation ID: revokeSSOSession
Tags: evydence
Auth: BearerAuth
Scopes: identity:admin
Idempotency: Idempotency-Key
Request: application/json: EmptyObject
Responses: 200 application/json: SSOSessionEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/transparency-checkpoints

Record external transparency checkpoint

Records an external transparency or timestamp checkpoint reference for a Merkle batch.

Operation ID: createTransparencyCheckpoint
Tags: evydence
Auth: BearerAuth
Scopes: keys:admin
Idempotency: Idempotency-Key
Request: application/json: CreateTransparencyCheckpointRequest
Responses: 201 application/json: TransparencyCheckpointEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/users

Create user

Creates a tenant-scoped human user metadata record. Authentication is still controlled by API keys or configured SSO/session flows. Focused Identity commands check current tenant-wide human authority and current optional organization ownership. Email is trimmed/lowercased and must be a plain mailbox address; this does not verify ownership. The fixed public user DTO, including required email, survives authorized durable replay without broadening log or customer-package redaction. PostgreSQL is required for local evaluation.

Operation ID: createUser
Tags: evydence
Auth: BearerAuth
Scopes: identity:admin
Idempotency: Idempotency-Key
Request: application/json: CreateUserRequest
Responses: 201 application/json: HumanUserEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/users/{id}/deactivate

Deactivate user

Deactivates a tenant-scoped human user as an audited lifecycle transition. A focused command uses a bounded current-user projection with tenant-wide human authority and current organization ownership; status, audit and replay commit atomically. Committed deactivation invalidates current-user session authentication. A completed matching request replays the public DTO without another transition; a new transition of an inactive user conflicts. PostgreSQL is required for local evaluation.

Operation ID: deactivateUser
Tags: evydence
Auth: BearerAuth
Scopes: identity:admin
Idempotency: Idempotency-Key
Request: application/json: EmptyObject
Responses: 200 application/json: HumanUserEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/verify

Verify subject

Verifies one of nine supported tenant-scoped subject types using its existing assurance profile. PostgreSQL uses native durable execution, not Ledger replay. Current flat ownership and resource grants are checked before reservation and every replay; the common writer fence precedes share locks held through the outer commit. Audit-chain, Merkle, checkpoint, backup and artifact-signature profiles require tenant-wide human grants; evidence, attestation and release-bundle profiles retain their matching resource grants. Completed retries return the original receipt without re-reading changed payloads, manifests, digests, trust policies or prior verification metadata. The strict non-null JSON object is capped at 64 KiB, raw subject_type at 64 NUL-free UTF-8 bytes and raw subject_id at 1024 bytes before trimming. Only subject_type and subject_id are accepted; unknown, duplicate, case-aliased, malformed and non-object input is rejected. Audit-chain IDs must be absent or empty; other supported types require an ID. Cookie mutations require same-origin protection; bearer credentials take precedence. Fresh receipt, audit, verification job and successful replay commit atomically; failed HTTP inspection returns 422 and rolls back business effects. The API requires PostgreSQL, including local evaluation. Historical delivery does not establish current trust validity, provider runtime integrity, artifact safety or compliance.

Operation ID: verify
Tags: evydence
Auth: BearerAuth
Scopes: verify:read
Idempotency: Idempotency-Key
Request: application/json: VerifySubjectRequest
Responses: 200 application/json: VerificationResultEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

GET /v1/version

Version

Returns immutable build identity injected at build time: version, source commit, build time, dirty marker, Go version, and release-manifest digest.

Operation ID: version
Tags: evydence
Auth: BearerAuth
Scopes: none
Idempotency: not required
Request: none
Responses: 200 application/json: VersionInfoEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/vex

Upload OpenVEX document

Uploads OpenVEX payload bytes and atomically records normalized VEX metadata, an accepted import report, and a versioned bounded decision request. Decision mapping always runs asynchronously after commit. When a durable object payload is available, the worker replays it and verifies that it matches the normalized request; otherwise the worker consumes the normalized request directly. Poll the import-report endpoint for parsed or failed status. Use application/vnd.openvex+json with the explicit metadata headers for streaming uploads up to 20 MiB; the JSON envelope remains limited to small requests. In PostgreSQL mode, a focused command checks current tenant-owned release parents and human release/artifact grants before parsing or staging. IDs are NUL-free UTF-8 bounded at 1024 bytes; wrapped JSON remains capped at 64 KiB and rejects null, duplicate, and unknown fields. Declared source size and SHA-256 are verified. Normalized projections are limited to 100,000 statements, 1 MiB per string, and 64 MiB combined projection strings; the versioned post-commit decision request permits at most 1,000,000 values and 20 MiB combined decision text. Overflow fails validation rather than truncating. VEX, accepted report, evidence, audit, payload metadata, outbox jobs, and idempotency completion commit together; decisions are never written during upload. Replay checks current grants without parsing or staging. Retained body-only native OpenVEX receipts require exact tenant, release, optional artifact, and format and never execute a new upload. Normalized VEX metadata and the accepted report are always retained, regardless of worker-owned parsing. Acceptance does not establish source authority, signature trust, or legal sufficiency.

Operation ID: uploadVEX
Tags: evydence
Auth: BearerAuth
Scopes: evidence:write
Idempotency: Idempotency-Key
Request: application/json: EvidenceUploadRequest; application/vnd.openvex+json: string
Responses: 201 application/json: VEXDocumentEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/vex/cyclonedx

Upload CycloneDX VEX document

Uploads CycloneDX VEX JSON and atomically records normalized VEX metadata, an accepted import report, and a versioned bounded decision request. Decision mapping always runs asynchronously after commit. When a durable object payload is available, the worker replays it and verifies that it matches the normalized request; otherwise the worker consumes the normalized request directly. Poll the import-report endpoint for parsed or failed status. In PostgreSQL mode, a focused command checks current tenant-owned release parents and human release/artifact grants before parsing or staging. IDs are NUL-free UTF-8 bounded at 1024 bytes; wrapped JSON remains capped at 64 KiB and rejects null, duplicate, and unknown fields. Declared source size and SHA-256 are verified. Normalized projections are limited to 100,000 statements, 1 MiB per string, and 64 MiB combined projection strings; the versioned post-commit decision request permits at most 1,000,000 values and 20 MiB combined decision text. Overflow fails validation rather than truncating. VEX, accepted report, evidence, audit, payload metadata, outbox jobs, and idempotency completion commit together; decisions are never written during upload. Replay checks current grants without parsing or staging. Retained body-only native OpenVEX receipts require exact tenant, release, optional artifact, and format and never execute a new upload. Normalized VEX metadata and the accepted report are always retained, regardless of worker-owned parsing. Acceptance does not establish source authority, signature trust, or legal sufficiency.

Operation ID: uploadCycloneDXVEX
Tags: evydence
Auth: BearerAuth
Scopes: evidence:write
Idempotency: Idempotency-Key
Request: application/json: EvidenceUploadRequest
Responses: 201 application/json: VEXDocumentEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/vex/cyclonedx/preview

Preview CycloneDX VEX import

Validates a CycloneDX VEX payload and returns advisory mapping counts without storing raw payloads, creating evidence, creating decisions, or enqueueing parser jobs. In PostgreSQL mode, one read-only repeatable-read snapshot resolves current tenant-owned release parents and optional artifact ownership, then checks human release and artifact grants before parsing or candidate selection. The wrapped JSON request is limited to 64 KiB and rejects null, duplicate, and unknown fields. IDs are NUL-free UTF-8 bounded at 1024 bytes. Reads select only relevant finding coordinates and active-decision presence, never private notes or evidence metadata; at most 4096 release scans, 4096 candidate findings, and 8 MiB of combined candidate text are allowed. Oversized or malformed stored projections fail closed without a partial preview. Matching preserves duplicate and ambiguity policy and original statement indexes. Results remain advisory and create no audit, outbox, or idempotency records; Idempotency-Key is not required.

Operation ID: previewCycloneDXVEXImport
Tags: evydence
Auth: BearerAuth
Scopes: evidence:read
Idempotency: not required
Request: application/json: EvidenceUploadRequest
Responses: 200 application/json: VEXImportPreviewEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/vex/preview

Preview OpenVEX import

Validates an OpenVEX payload and returns advisory mapping counts without storing raw payloads, creating evidence, creating decisions, or enqueueing parser jobs. In PostgreSQL mode, one read-only repeatable-read snapshot resolves current tenant-owned release parents and optional artifact ownership, then checks human release and artifact grants before parsing or candidate selection. The wrapped JSON request is limited to 64 KiB and rejects null, duplicate, and unknown fields. IDs are NUL-free UTF-8 bounded at 1024 bytes. Reads select only relevant finding coordinates and active-decision presence, never private notes or evidence metadata; at most 4096 release scans, 4096 candidate findings, and 8 MiB of combined candidate text are allowed. Oversized or malformed stored projections fail closed without a partial preview. Matching preserves duplicate and ambiguity policy and original statement indexes. Results remain advisory and create no audit, outbox, or idempotency records; Idempotency-Key is not required.

Operation ID: previewVEXImport
Tags: evydence
Auth: BearerAuth
Scopes: evidence:read
Idempotency: not required
Request: application/json: EvidenceUploadRequest
Responses: 200 application/json: VEXImportPreviewEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

GET /v1/vex/{id}

Get VEX document

Returns a tenant-scoped VEX document metadata record by id.

Operation ID: getVEX
Tags: evydence
Auth: BearerAuth
Scopes: evidence:read
Idempotency: not required
Request: none
Responses: 200 application/json: VEXDocumentEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

GET /v1/vex/{id}/import-report

Get VEX import report

Returns the persisted parser report for a tenant-scoped VEX import. Uploads begin as accepted and become parsed or failed after asynchronous decision processing; the report includes safe counts, warnings, and mapping failures without raw payload bytes.

Operation ID: getVEXImportReport
Tags: evydence
Auth: BearerAuth
Scopes: evidence:read
Idempotency: not required
Request: none
Responses: 200 application/json: VEXImportReportEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

GET /v1/vulnerability-decisions

List vulnerability decisions

Lists append-only vulnerability decisions over time with tenant-scoped product, release, vulnerability, component, status, and active filters. Tenant-internal notes are excluded from responses. Results use bounded keyset pagination. Cursor tokens are opaque and bound to the tenant, filters, sort, and direction.

Operation ID: listVulnerabilityDecisions
Tags: evydence
Auth: BearerAuth
Scopes: evidence:read
Idempotency: not required
Request: none
Responses: 200 application/json: VulnerabilityDecisionListEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/vulnerability-findings/{id}/decisions

Create vulnerability decision

Creates an append-only vulnerability decision for a tenant-scoped scan finding. Tenant-internal notes are accepted for the ledger but excluded from the response and idempotency replays.

Operation ID: createVulnerabilityDecision
Tags: evydence
Auth: BearerAuth
Scopes: evidence:write
Idempotency: Idempotency-Key
Request: application/json: CreateVulnerabilityDecisionRequest
Responses: 201 application/json: VulnerabilityDecisionEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/vulnerability-findings/{id}/workflow

Record vulnerability workflow event

Records an append-only vulnerability workflow annotation through a focused Risk command and durable replay. Current finding/source/parent ownership and security:write grants are checked before every fresh request or replay; replay does not read historical workflow reasons or reapply effects. The annotation does not change a finding or decision. Record, principal audit and replay result commit together. PostgreSQL is required for local evaluation.

Operation ID: recordVulnerabilityWorkflow
Tags: evydence
Auth: BearerAuth
Scopes: security:write
Idempotency: Idempotency-Key
Request: application/json: RecordVulnerabilityWorkflowRequest
Responses: 201 application/json: VulnerabilityWorkflowRecordEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/vulnerability-scans

Upload vulnerability scan

Uploads either the Evydence generic scan schema or a versioned native-scanner envelope (Grype, Trivy, OSV-Scanner, or Dependency-Track). Scanner output is preserved as raw evidence and is not treated as authoritative. The request is streamed to a private temporary file while hashing and is limited to 20 MiB. In PostgreSQL mode, scope-only authorization precedes a complete bounded, size/SHA-256-checked release-ID probe. Normalized release IDs are NUL-free UTF-8 bounded at 1024 bytes. A focused command checks current tenant-owned release parents and human resource grants before full findings normalization or object staging. Normalized projections allow 100,000 findings, 1 MiB per string, and 64 MiB of combined projection strings; severity summaries must match findings. Scan, evidence, audit, payload metadata, outbox, and idempotency completion commit together. Same-byte replay checks current grants and exact tenant/release coordinates without findings normalization or staging. With worker-owned parsing and object storage, the response contains parsed findings while the stored projection stays accepted until its parser job runs.

Operation ID: uploadVulnerabilityScan
Tags: evydence
Auth: BearerAuth
Scopes: evidence:write
Idempotency: Idempotency-Key
Request: application/json: UploadVulnerabilityScanBody
Responses: 201 application/json: VulnerabilityScanEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

GET /v1/vulnerability-scans/{id}

Get vulnerability scan

Returns a tenant-scoped vulnerability scan by id.

Operation ID: getVulnerabilityScan
Tags: evydence
Auth: BearerAuth
Scopes: evidence:read
Idempotency: not required
Request: none
Responses: 200 application/json: VulnerabilityScanEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/waivers

Create waiver

Creates a first-class scoped waiver for controls or policies. Approval is a separate audited transition.

Operation ID: createWaiver
Tags: evydence
Auth: BearerAuth
Scopes: policy:write
Idempotency: Idempotency-Key
Request: application/json: CreateWaiverRequest
Responses: 201 application/json: WaiverEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

POST /v1/waivers/{id}/approve

Approve waiver

Approves an unexpired waiver as an audited transition.

Operation ID: approveWaiver
Tags: evydence
Auth: BearerAuth
Scopes: policy:write
Idempotency: Idempotency-Key
Request: application/json: EmptyObject
Responses: 200 application/json: WaiverEnvelope; 400 application/problem+json: Problem; 401 application/problem+json: Problem; 403 application/problem+json: Problem; 404 application/problem+json: Problem; 409 application/problem+json: Problem; 422 application/problem+json: Problem; 429 application/problem+json: Problem; 500 application/problem+json: Problem; 503 application/problem+json: Problem

Schemas

Name	Shape	Required fields
`APIKey`	object	id, tenant_id, name, prefix, scopes, created_at
`APIKeyCreateEnvelope`	object	data, meta
`APIKeyCreateResponse`	object	api_key
`APIKeyListEnvelope`	object	data, meta
`AnomalyReport`	object	id, tenant_id, subject_type, subject_id, result, assumptions, limitations, schema_version, created_at
`AnomalyReportEnvelope`	object	data, meta
`AnomalySignal`	object	name, severity, detail
`ApprovalRecord`	object	id, tenant_id, subject_type, subject_id, decision, reason, approver_id, schema_version, created_at
`ApprovalRecordEnvelope`	object	data, meta
`Artifact`	object	id, tenant_id, name, media_type, digest, size, created_at
`ArtifactEnvelope`	object	data, meta
`ArtifactSignature`	object	id, tenant_id, artifact_id, subject_digest, algorithm, signature, verification_status, schema_version, created_at
`ArtifactSignatureEnvelope`	object	data, meta
`AuditChainEntry`	object	id, tenant_id, sequence, entry_type, subject_type, subject_id, actor_type, actor_id, occurred_at, canonical_entry_hash, previous_entry_hash, entry_hash, schema_version
`AuditChainEntryListEnvelope`	object	data, meta
`BackupManifest`	object	id, tenant_id, state_hash, resource_counts, consistency_checks, limitations, schema_version, created_at
`BackupManifestEnvelope`	object	data, meta
`BeginOIDCAuthenticationEnvelope`	object	data, meta
`BeginOIDCAuthenticationRequest`	object	provider_id
`BeginOIDCAuthenticationResponse`	object	authentication_request, nonce
`BeginSAMLAuthenticationEnvelope`	object	data, meta
`BeginSAMLAuthenticationRequest`	object	provider_id
`BeginSAMLAuthenticationResponse`	object	authentication_request
`BuildAttestation`	object	id, tenant_id, build_id, evidence_id, payload_hash, payload_size, payload_type, predicate_type, subject_digests, signature_count, verification_status, schema_version, created_at
`BuildAttestationEnvelope`	object	data, meta
`BuildOutput`	object	digest
`BuildRun`	object	id, tenant_id, project_id, release_id, provider, commit_sha, status, schema_version, created_at
`BuildRunEnvelope`	object	data, meta
`CRAVulnerabilityHandlingReport`	object	report_type, template_version, product_id, release_id, summary, assumptions, limitations, generated_at
`CRAVulnerabilityHandlingReportEnvelope`	object	data, meta
`Collector`	object	id, tenant_id, name, type, version, api_key_id, status, allowed_scopes, schema_version, created_at
`CollectorCreateEnvelope`	object	data, meta
`CollectorCreateResponse`	object	collector, api_key
`CollectorHealthReport`	object	report_type, collector_id, collector_status, supply_chain_status, checks, assumptions, limitations, generated_at
`CollectorHealthReportEnvelope`	object	data, meta
`CollectorListEnvelope`	object	data, meta
`CollectorRelease`	object	id, tenant_id, collector_id, version, artifact_digest, pinned, verification_status, health_status, schema_version, created_at
`CollectorReleaseEnvelope`	object	data, meta
`CommercialCollectorDefinition`	object	id, tenant_id, name, provider, version, manifest_hash, allowed_scopes, status, schema_version, created_at
`CommercialCollectorDefinitionEnvelope`	object	data, meta
`CommercialCollectorDefinitionListEnvelope`	object	data, meta
`ConfigureSAMLProviderBindingRequest`	object	recipient
`ContainerImage`	object	id, tenant_id, repository, digest, schema_version, created_at
`ContainerImageEnvelope`	object	data, meta
`ContractDiff`	object	id, tenant_id, base_contract_id, target_contract_id, product_id, result, schema_version, created_at
`ContractDiffEnvelope`	object	data, meta
`ControlEvidence`	object	id, tenant_id, control_id, evidence_type, subject_type, subject_id, confidence, schema_version, created_at
`ControlEvidenceEnvelope`	object	data, meta
`ControlEvidenceListEnvelope`	object	data, meta
`ControlEvidenceRequirement`	object	type, required
`ControlFramework`	object	id, tenant_id, name, slug, version, status, schema_version, created_at
`ControlFrameworkEnvelope`	object	data, meta
`ControlFrameworkListEnvelope`	object	data, meta
`ControlFrameworkTemplatePack`	object	id, name, slug, version, controls, schema_version
`ControlFrameworkTemplatePackListEnvelope`	object	data, meta
`CosignVerification`	object	id, tenant_id, artifact_signature_id, subject_digest, result, checks, profile, limitations, schema_version, created_at
`CosignVerificationEnvelope`	object	data, meta
`CreateAPIKeyRequest`	object	name, scopes
`CreateAnomalyReportRequest`	object	subject_type, subject_id
`CreateApprovalRequest`	object	subject_type, subject_id, decision, reason
`CreateArtifactSignatureRequest`	object	artifact_id, algorithm, signature
`CreateBuildRequest`	object	project_id, release_id, provider, commit_sha, status, started_at
`CreateCollectorRequest`	object	name, type, version
`CreateCommercialCollectorRequest`	object	name, provider, version, manifest_hash
`CreateControlFrameworkRequest`	object	name, version
`CreateCustomPolicyRequest`	object	name, version, rules
`CreateCustomerPackageRequest`	object	product_id, redaction_profile_id, title, expires_at
`CreateCustomerPortalAccessRequest`	object	package_id, customer_name, expires_at
`CreateDSSETrustRootRequest`	object	name, key_id, algorithm, public_key, allowed_predicate_types, expected_builder_ids, required_claims
`CreateDeploymentEnvironmentRequest`	object	product_id, name, kind
`CreateEvidenceRequest`	object	type, title, payload_hash
`CreateEvidenceSummaryRequest`	object	subject_type, subject_id
`CreateExceptionRequest`	object	release_id, reason, owner, expires_at
`CreateGraphSnapshotRequest`	object	none
`CreateIncidentRequest`	object	product_id, title, severity
`CreateIncidentWebhookReceiverRequest`	object	name, provider, public_key
`CreateLegalHoldRequest`	object	scope_type, scope_id, reason, owner
`CreateMarketplaceCollectorRequest`	object	name, provider, version, publisher, manifest_hash
`CreateMerkleBatchRequest`	object	none
`CreateObjectRetentionPolicyRequest`	object	name, mode, retention_days
`CreateOpenAPIDiffRequest`	object	base_contract_id, target_contract_id, release_id
`CreateOrganizationRequest`	object	name, slug
`CreatePDFReportPackageRequest`	object	report_type, title
`CreateProductRequest`	object	name, slug
`CreateProjectRequest`	object	product_id, name
`CreatePublicTransparencyLogRequest`	object	name, endpoint, public_key
`CreateQuestionnaireAnswerLibraryEntryRequest`	anyOf(object, object, object)	answer
`CreateQuestionnaireDraftRequest`	object	template_id
`CreateQuestionnairePackageRequest`	object	template_id
`CreateQuestionnaireQuestion`	object	id, prompt
`CreateQuestionnaireTemplateRequest`	object	name, version, questions
`CreateRedactionProfileRequest`	object	none
`CreateReleaseBundleRequest`	object	release_id
`CreateReleaseCandidateRequest`	object	release_id, name
`CreateReleaseRequest`	object	product_id, version
`CreateRemediationTaskRequest`	object	title, owner
`CreateReportTemplateRequest`	object	name, version, report_type, allowed_fields, template
`CreateRetentionOverrideRequest`	object	scope_type, scope_id, retention_until, reason, owner
`CreateRoleBindingRequest`	object	subject_type, subject_id, role
`CreateSBOMDiffRequest`	object	base_sbom_id, target_sbom_id
`CreateSSOProviderRequest`	object	name, type, issuer, client_id
`CreateSSOSessionRequest`	object	user_id, provider_id, expires_at
`CreateSaaSEditionProfileRequest`	object	name, region, admin_tenant_id, isolation_model
`CreateSecurityControlRequest`	object	framework_id, code, title, objective
`CreateSigningOperationRequest`	object	provider_id, subject_type, subject_id, payload_hash
`CreateSigningProviderRequest`	object	name, type, key_ref
`CreateSourceRepositoryRequest`	object	provider, full_name
`CreateTransparencyCheckpointRequest`	object	batch_id, provider
`CreateUserRequest`	object	email, display_name
`CreateVulnerabilityDecisionRequest`	object	status, justification
`CreateWaiverRequest`	object	scope_type, scope_id, owner, risk, reason, expires_at
`CustomPolicy`	object	id, tenant_id, name, version, rules, schema_version, created_at
`CustomPolicyEnvelope`	object	data, meta
`CustomPolicyEvaluation`	object	id, tenant_id, policy_id, release_id, result, checks, input_hash, schema_version, created_at
`CustomPolicyEvaluationEnvelope`	object	data, meta
`CustomReportTemplate`	object	id, tenant_id, name, version, report_type, allowed_fields, template, schema_version, created_at
`CustomReportTemplateEnvelope`	object	data, meta
`CustomerPortalAccess`	object	id, tenant_id, package_id, customer_name, prefix, expires_at, access_count, failed_access_count, schema_version, created_at
`CustomerPortalAccessCreateEnvelope`	object	data, meta
`CustomerPortalAccessCreateResponse`	object	access
`CustomerPortalAccessEnvelope`	object	data, meta
`CustomerPortalAccessListEnvelope`	object	data, meta
`CustomerPortalPackageRequest`	object	token
`CustomerSecurityPackage`	object	id, tenant_id, product_id, redaction_profile_id, title, state, manifest, manifest_hash, expires_at, access_count, schema_version, created_at
`CustomerSecurityPackageEnvelope`	object	data, meta
`DSSEEnvelope`	object	payloadType, payload, signatures
`DSSETrustRoot`	object	id, tenant_id, name, key_id, algorithm, public_key, allowed_predicate_types, expected_builder_ids, required_claims, status, schema_version, created_at
`DSSETrustRootEnvelope`	object	data, meta
`DataEnvelope`	object	data, meta
`DependencyChange`	object	id, tenant_id, sbom_diff_id, change_type, component, schema_version, created_at
`DeploymentEnvironment`	object	id, tenant_id, product_id, name, kind, schema_version, created_at
`DeploymentEnvironmentEnvelope`	object	data, meta
`DeploymentEnvironmentListEnvelope`	object	data, meta
`DeploymentEvent`	object	id, tenant_id, environment_id, release_id, status, started_at, schema_version, created_at
`DeploymentEventEnvelope`	object	data, meta
`DeploymentEventListEnvelope`	object	data, meta
`EmptyObject`	object	none
`ErrorCode`	string	none
`EvaluatePolicyRequest`	object	release_id
`EvidenceBundle`	object	id, tenant_id, evidence_ids, manifest, manifest_hash, verification_text, schema_version, created_at
`EvidenceBundleEnvelope`	object	data, meta
`EvidenceBundleImport`	object	id, tenant_id, bundle_hash, result, imported_count, schema_version, created_at
`EvidenceBundleImportEnvelope`	object	data, meta
`EvidenceCitation`	object	evidence_id, type, title, canonical_hash
`EvidenceGraphEdge`	object	from, to, relationship
`EvidenceGraphNode`	object	id, type, label
`EvidenceGraphSnapshot`	object	id, tenant_id, nodes, edges, graph_hash, limitations, schema_version, created_at
`EvidenceGraphSnapshotEnvelope`	object	data, meta
`EvidenceItem`	object	id, tenant_id, type, title, source_system, observed_at, evidence_version, schema_version, payload_hash, canonical_hash, canonicalization, trust_level, verification_status, chain_entry_id, created_at
`EvidenceItemEnvelope`	object	data, meta
`EvidenceItemListEnvelope`	object	data, meta
`EvidenceLifecycleEvent`	object	id, tenant_id, evidence_id, action, reason, actor_id, schema_version, created_at
`EvidenceLifecycleEventEnvelope`	object	data, meta
`EvidenceLifecycleEventListEnvelope`	object	data, meta
`EvidenceNotice`	object	code, message
`EvidenceRef`	object	type, id
`EvidenceSearchEnvelope`	object	data, meta
`EvidenceSearchResponse`	object	items
`EvidenceSummary`	object	id, tenant_id, subject_type, subject_id, evidence_ids, summary, citations, assumptions, limitations, schema_version, created_at
`EvidenceSummaryEnvelope`	object	data, meta
`EvidenceUploadRequest`	object	release_id, payload
`Exception`	object	id, tenant_id, release_id, reason, owner, expires_at, approved, created_at
`ExceptionEnvelope`	object	data, meta
`ExceptionListEnvelope`	object	data, meta
`ExchangeSSOCredentialRequest`	oneOf(object, object, object, object)	provider_id, subject
`ExportEvidenceBundleRequest`	object	none
`FieldViolation`	object	field, code
`HTMLReportPackage`	object	id, tenant_id, report_type, product_id, html, hash, schema_version, created_at
`HTMLReportPackageEnvelope`	object	data, meta
`HealthStatus`	object	status
`HealthStatusEnvelope`	object	data, meta
`HumanUser`	object	id, tenant_id, email, display_name, status, schema_version, created_at
`HumanUserEnvelope`	object	data, meta
`Incident`	object	id, tenant_id, product_id, title, severity, status, opened_at, schema_version, created_at
`IncidentEnvelope`	object	data, meta
`IncidentReport`	object	report_type, template_version, incident_id, result, timeline, tasks, assumptions, limitations, generated_at
`IncidentReportEnvelope`	object	data, meta
`IncidentTimelineEvent`	object	id, tenant_id, incident_id, event_type, summary, occurred_at, schema_version, created_at
`IncidentTimelineEventEnvelope`	object	data, meta
`IncidentWebhookDelivery`	object	webhook_event, timeline_event
`IncidentWebhookDeliveryEnvelope`	object	data, meta
`IncidentWebhookEvent`	object	id, tenant_id, receiver_id, incident_id, provider, event_id, payload_hash, signature_hash, result, schema_version, created_at
`IncidentWebhookReceiver`	object	id, tenant_id, incident_id, name, provider, public_key, status, schema_version, created_at
`IncidentWebhookReceiverEnvelope`	object	data, meta
`InstanceAdminSnapshot`	object	report_type, tenant_count, resource_counts, limitations, generated_at
`InstanceAdminSnapshotEnvelope`	object	data, meta
`LegalHold`	object	id, tenant_id, scope_type, scope_id, reason, owner, schema_version, created_at
`LegalHoldEnvelope`	object	data, meta
`LinkControlEvidenceRequest`	object	evidence_type, subject_type, subject_id, confidence
`LinkEvidenceRequest`	object	target_type, target_id
`LinkSSOIdentityRequest`	object	user_id, provider_id, subject, email, verified
`ManualSecurityDocument`	object	id, tenant_id, document_type, title, sensitivity, evidence_id, payload_hash, schema_version, created_at
`ManualSecurityDocumentEnvelope`	object	data, meta
`MarketplaceCollector`	object	id, tenant_id, name, provider, version, publisher, manifest_hash, state, schema_version, created_at
`MarketplaceCollectorEnvelope`	object	data, meta
`MarketplaceCollectorHealthReport`	object	report_type, collector_id, name, provider, version, supply_chain_status, checks, collector, assumptions, limitations, generated_at
`MarketplaceCollectorHealthReportEnvelope`	object	data, meta
`MarketplaceCollectorListEnvelope`	object	data, meta
`MerkleBatch`	object	id, tenant_id, from_sequence, to_sequence, entry_count, leaf_hashes, root_hash, schema_version, created_at
`MerkleBatchEnvelope`	object	data, meta
`MetricsSnapshot`	object	tenant_id, resource_counts, customer_portal_failed_access_count, customer_portal_revoked_access_count
`MetricsSnapshotEnvelope`	object	data, meta
`MissingEvidenceReport`	object	report_type, template_version, release_id, result, missing, assumptions, limitations
`MissingEvidenceReportEnvelope`	object	data, meta
`OIDCAuthenticationRequest`	object	id, tenant_id, provider_id, delivery, created_at, expires_at, schema_version
`ObjectRetentionPolicy`	object	id, tenant_id, name, object_prefix, mode, retention_days, max_verification_age_hours, status, schema_version, created_at
`ObjectRetentionPolicyEnvelope`	object	data, meta
`OpenAPIContract`	object	id, tenant_id, product_id, version, hash, path_count, evidence_id, created_at
`OpenAPIContractEnvelope`	object	data, meta
`OpenAPIDocument`	object	openapi, info, paths
`OpenAPIOperationRecord`	object	path, method
`Organization`	object	id, tenant_id, name, slug, status, schema_version, created_at
`OrganizationEnvelope`	object	data, meta
`OutboxDiagnostics`	object	pending_jobs, running_jobs, terminal_jobs
`OutboxDiagnosticsEnvelope`	object	data, meta
`OutboxReplay`	object	job_id, status, replayed_at
`OutboxReplayEnvelope`	object	data, meta
`PDFReportPackage`	object	id, tenant_id, report_type, title, payload_hash, payload_size, limitations, schema_version, created_at
`PDFReportPackageEnvelope`	object	data, meta
`PolicyCheck`	object	name, result, severity, explanation
`PolicyEvaluation`	object	id, tenant_id, release_id, result, policy_set, checks, created_at
`PolicyEvaluationEnvelope`	object	data, meta
`PolicyRule`	object	name, severity, required
`Problem`	object	type, title, status, detail, code, request_id, retryable, retry_class
`Product`	object	id, tenant_id, name, slug, created_at
`ProductEnvelope`	object	data, meta
`ProductListEnvelope`	object	data, meta
`Project`	object	id, tenant_id, product_id, name, created_at
`ProjectEnvelope`	object	data, meta
`ProviderVerification`	object	id, tenant_id, provider_type, provider_id, subject, result, checks, profile, limitations, schema_version, created_at
`ProviderVerificationEnvelope`	object	data, meta
`PublicTransparencyLog`	object	id, tenant_id, name, endpoint, public_key, state, schema_version, created_at
`PublicTransparencyLogEntry`	object	id, tenant_id, log_id, checkpoint_id, merkle_batch_id, external_id, entry_hash, state, schema_version, created_at
`PublicTransparencyLogEntryEnvelope`	object	data, meta
`PublicTransparencyLogEnvelope`	object	data, meta
`PublishPublicTransparencyLogEntryRequest`	object	log_id, checkpoint_id, external_id
`PullRequest`	object	id, tenant_id, repository_id, provider, provider_id, state, schema_version, created_at
`PullRequestEnvelope`	object	data, meta
`QuestionnaireAnswerLibraryEntry`	object	id, tenant_id, answer, schema_version, created_at
`QuestionnaireAnswerLibraryEntryEnvelope`	object	data, meta
`QuestionnaireAnswerLibraryEntryListEnvelope`	object	data, meta
`QuestionnaireDraft`	object	id, tenant_id, template_id, responses, manifest_hash, limitations, schema_version, created_at
`QuestionnaireDraftEnvelope`	object	data, meta
`QuestionnairePackage`	object	id, tenant_id, template_id, responses, manifest_hash, schema_version, created_at
`QuestionnairePackageEnvelope`	object	data, meta
`QuestionnaireQuestion`	object	id, prompt
`QuestionnaireResponse`	object	question_id, answer
`QuestionnaireTemplate`	object	id, tenant_id, name, version, questions, schema_version, created_at
`QuestionnaireTemplateEnvelope`	object	data, meta
`ReadinessDiagnostics`	object	status, checks
`ReadinessDiagnosticsEnvelope`	object	data, meta
`ReadinessReport`	object	report_type, template_version, result, assumptions, limitations, generated_at
`ReadinessReportEnvelope`	object	data, meta
`ReadinessStatus`	object	status, checks
`ReadinessStatusEnvelope`	object	data, meta
`RecordCollectorReleaseRequest`	object	version, artifact_digest
`RecordDeploymentRequest`	object	environment_id, release_id, status
`RecordEvidenceLifecycleEventRequest`	object	action, reason
`RecordIncidentTimelineRequest`	object	event_type, summary
`RecordPullRequestRequest`	object	repository_id, provider_id, title, state
`RecordSourceCommitRequest`	object	repository_id, sha
`RecordVulnerabilityWorkflowRequest`	object	action, reason
`RedactionProfile`	object	id, tenant_id, name, schema_version, created_at
`RedactionProfileEnvelope`	object	data, meta
`RegisterArtifactRequest`	object	name, media_type, digest
`RegisterContainerImageRequest`	object	repository, digest
`Release`	object	id, tenant_id, product_id, version, revision, state, created_at
`ReleaseBundle`	object	id, tenant_id, release_id, state, manifest, manifest_hash, signature_refs, created_at
`ReleaseBundleEnvelope`	object	data, meta
`ReleaseBundleManifest`	object	manifest_version, bundle_id, tenant_id, release, evidence_ids, chain_checkpoint, generated_at, generator
`ReleaseBundleManifestEnvelope`	object	data, meta
`ReleaseBundleVerification`	object	result
`ReleaseBundleVerificationEnvelope`	object	data, meta
`ReleaseCandidate`	object	id, tenant_id, release_id, name, revision, state, snapshot_hash, schema_version, created_at
`ReleaseCandidateEnvelope`	object	data, meta
`ReleaseCandidateListEnvelope`	object	data, meta
`ReleaseCandidateTransitionRequest`	object	reason
`ReleaseEnvelope`	object	data, meta
`ReleaseEvidenceFlow`	object	release_id, product_id, status, counts, steps, assumptions, limitations, schema_version, generated_at
`ReleaseEvidenceFlowEnvelope`	object	data, meta
`ReleaseEvidenceFlowStep`	object	id, title, status, required, method, path, required_scopes, idempotency_required, description
`ReleaseSecurityApprovalSummary`	object	total, approved
`ReleaseSecurityExceptionSummary`	object	total, approved_unexpired, unapproved, expired
`ReleaseSecurityMissingDecision`	object	finding_id, scan_id, vulnerability, severity, state
`ReleaseSecurityProductSummary`	object	id, name, slug
`ReleaseSecurityReleaseSummary`	object	id, version, state
`ReleaseSecuritySummary`	object	product, release, artifact_count, sbom_status, vulnerability_scan_status, open_findings_by_severity, decisions_by_status, approval_summary, exception_summary, readiness_status, package_status, counts, assumptions, limitations, schema_version, generated_at
`ReleaseSecuritySummaryEnvelope`	object	data, meta
`RemediationTask`	object	id, tenant_id, title, owner, status, schema_version, created_at
`RemediationTaskEnvelope`	object	data, meta
`RenderReportTemplateRequest`	object	subject_type, subject_id
`RenderedCustomReport`	object	id, tenant_id, template_id, subject_type, subject_id, output, hash, schema_version, created_at
`RenderedCustomReportEnvelope`	object	data, meta
`RetentionOverride`	object	id, tenant_id, scope_type, scope_id, retention_until, reason, owner, schema_version, created_at
`RetentionOverrideEnvelope`	object	data, meta
`RetentionReport`	object	report_type, legal_holds, retention_overrides, limitations, generated_at
`RetentionReportEnvelope`	object	data, meta
`RetryClass`	string	none
`RoleBinding`	object	id, tenant_id, subject_type, subject_id, role, schema_version, created_at
`RoleBindingEnvelope`	object	data, meta
`RoleBindingListEnvelope`	object	data, meta
`SAMLAuthenticationRequest`	object	id, tenant_id, provider_id, delivery, issuer, audience, recipient, name_id_format, created_at, expires_at, schema_version
`SAMLProviderBinding`	object	tenant_id, provider_id, recipient, name_id_format, schema_version, updated_at
`SAMLProviderBindingEnvelope`	object	data, meta
`SBOM`	object	id, tenant_id, evidence_id, release_id, format, component_count, created_at
`SBOMComponent`	object	name
`SBOMComponentRecord`	object	id, sbom_id, component
`SBOMComponentRecordListEnvelope`	object	data, meta
`SBOMDiff`	object	id, tenant_id, base_sbom_id, target_sbom_id, unchanged_count, schema_version, created_at
`SBOMDiffEnvelope`	object	data, meta
`SBOMEnvelope`	object	data, meta
`SSOCredentialExchangeEnvelope`	object	data, meta
`SSOCredentialExchangeResponse`	object	verification, session
`SSOProvider`	object	id, tenant_id, name, type, issuer, client_id, status, schema_version, created_at
`SSOProviderEnvelope`	object	data, meta
`SSOSession`	object	id, tenant_id, user_id, provider_id, prefix, expires_at, schema_version, created_at
`SSOSessionCreateEnvelope`	object	data, meta
`SSOSessionCreateResponse`	object	session
`SSOSessionEnvelope`	object	data, meta
`SaaSEditionProfile`	object	id, tenant_id, name, region, admin_tenant_id, isolation_model, status, config_hash, limitations, schema_version, created_at
`SaaSEditionProfileEnvelope`	object	data, meta
`ScannerAdapterEnvelope`	object	scanner, target_ref, release_id, source_schema, payload
`SecurityControl`	object	id, tenant_id, framework_id, code, title, objective, schema_version, created_at
`SecurityControlEnvelope`	object	data, meta
`SecurityReviewPackageReport`	object	report_type, template_version, package_id, product_id, evidence_ids, assumptions, limitations, generated_at
`SecurityReviewPackageReportEnvelope`	object	data, meta
`SecurityScan`	object	id, tenant_id, category, format, scanner, target_ref, evidence_id, payload_hash, finding_count, redacted, quarantined, schema_version, created_at
`SecurityScanEnvelope`	object	data, meta
`SecurityUpdateEvidenceReport`	object	report_type, template_version, product_id, release_id, summary, assumptions, limitations, generated_at
`SecurityUpdateEvidenceReportEnvelope`	object	data, meta
`SignedIncidentWebhookPayload`	object	event_type, summary
`SigningCustodyReviewReport`	object	report_type, tenant_id, checks, assumptions, limitations, generated_at
`SigningCustodyReviewReportEnvelope`	object	data, meta
`SigningKey`	object	id, tenant_id, kid, version, provider, algorithm, status, public_key, valid_from, created_at
`SigningKeyEnvelope`	object	data, meta
`SigningKeyListEnvelope`	object	data, meta
`SigningKeyRotationRequest`	object	reason
`SigningKeyTransitionRequest`	object	reason
`SigningOperation`	object	id, tenant_id, provider_id, subject_type, subject_id, payload_hash, result, checks, schema_version, created_at
`SigningOperationEnvelope`	object	data, meta
`SigningProvider`	object	id, tenant_id, name, type, status, key_ref, encrypted, schema_version, created_at
`SigningProviderEnvelope`	object	data, meta
`SourceBranch`	object	id, tenant_id, repository_id, name, protected, schema_version, created_at
`SourceBranchEnvelope`	object	data, meta
`SourceCommit`	object	id, tenant_id, repository_id, sha, schema_version, created_at
`SourceCommitEnvelope`	object	data, meta
`SourceRepository`	object	id, tenant_id, provider, full_name, schema_version, created_at
`SourceRepositoryEnvelope`	object	data, meta
`SourceRepositoryListEnvelope`	object	data, meta
`SourceSnapshotBranchInput`	object	name
`SourceSnapshotCommitInput`	object	sha
`SourceSnapshotEnvelope`	object	data, meta
`SourceSnapshotPullRequestInput`	object	provider_id, title, state
`SourceSnapshotRepositoryInput`	object	full_name
`SourceSnapshotRequest`	object	repository
`SourceSnapshotResult`	object	repository
`SubjectRef`	object	type
`SupersedeEvidenceRequest`	object	replacement_evidence_id, reason
`TransparencyCheckpoint`	object	id, tenant_id, batch_id, provider, timestamp_hash, state, schema_version, created_at
`TransparencyCheckpointEnvelope`	object	data, meta
`UpdateSSOProviderTrustMaterialRequest`	object	none
`UploadAPISecurityScanRequest`	object	scanner, target_ref, payload
`UploadManualSecurityDocumentRequest`	object	document_type, title, sensitivity, payload
`UploadOpenAPIContractRequest`	object	product_id, release_id, version, spec
`UploadSPDXSBOMRequest`	object	release_id, payload
`UploadSecurityScanRequest`	object	category, scanner, target_ref, payload
`UploadVulnerabilityScanBody`	oneOf(UploadVulnerabilityScanRequest, ScannerAdapterEnvelope)	none
`UploadVulnerabilityScanRequest`	object	scanner, target_ref, release_id, findings
`UpsertSourceBranchRequest`	object	repository_id, name
`UserIdentityLink`	object	id, tenant_id, user_id, provider_id, subject, email, verified, schema_version, created_at
`UserIdentityLinkEnvelope`	object	data, meta
`VEXDocument`	object	id, tenant_id, evidence_id, release_id, format, statement_count, schema_version, created_at
`VEXDocumentEnvelope`	object	data, meta
`VEXImportIssue`	object	code, detail
`VEXImportPreview`	object	tenant_id, release_id, format, parser_version, advisory, statement_count, status_summary, decisions_would_create, decisions_would_supersede, assumptions, limitations, schema_version, generated_at
`VEXImportPreviewEnvelope`	object	data, meta
`VEXImportReport`	object	id, tenant_id, vex_document_id, evidence_id, parser_version, status, statement_count, decisions_created, decisions_superseded, schema_version, created_at, updated_at
`VEXImportReportEnvelope`	object	data, meta
`VerificationProfile`	object	id, version, required_checks, limitations
`VerificationResult`	object	id, tenant_id, subject_type, subject_id, result, checks, profile, limitations, schema_version, verified_at
`VerificationResultEnvelope`	object	data, meta
`VerifyCheck`	object	name, result
`VerifyCosignSignatureRequest`	object	mode, offline
`VerifyProviderIdentityRequest`	oneOf(object, object, object)	provider_type, provider_id, subject
`VerifyPublicTransparencyLogEntryRequest`	object	root_hash, leaf_index, tree_size, inclusion_proof
`VerifySubjectRequest`	object	subject_type
`VersionInfo`	object	version, commit, build_time, dirty, go_version, release_manifest_digest
`VersionInfoEnvelope`	object	data, meta
`VulnerabilityDecision`	object	id, tenant_id, finding_id, scan_id, vulnerability, status, justification, source, schema_version, created_at
`VulnerabilityDecisionCustomerSummary`	object	id, finding_id, scan_id, release_id, vulnerability, status, impact_statement, source, created_at
`VulnerabilityDecisionEnvelope`	object	data, meta
`VulnerabilityDecisionListEnvelope`	object	data, meta
`VulnerabilityDecisionSummaryReport`	object	report_type, template_version, product_id, release_id, decisions, assumptions, limitations, generated_at
`VulnerabilityDecisionSummaryReportEnvelope`	object	data, meta
`VulnerabilityFinding`	object	id, vulnerability, severity, state
`VulnerabilityIdentity`	object	none
`VulnerabilityPostureReport`	object	report_type, template_version, summary, open_critical, assumptions, limitations, generated_at
`VulnerabilityPostureReportEnvelope`	object	data, meta
`VulnerabilityScan`	object	id, tenant_id, release_id, scanner, target_ref, summary, findings, created_at
`VulnerabilityScanEnvelope`	object	data, meta
`VulnerabilityWorkflowRecord`	object	id, tenant_id, finding_id, action, reason, actor_id, schema_version, created_at
`VulnerabilityWorkflowRecordEnvelope`	object	data, meta
`Waiver`	object	id, tenant_id, scope_type, scope_id, owner, risk, reason, expires_at, approved, schema_version, created_at
`WaiverEnvelope`	object	data, meta