Evidence API
Evidence-pack operations: collect, export, redact, and verify compliance evidence.
6 routes
Response metadata: x-api-version, x-request-id, and traceresponse apply to normal routed responses and are omitted from the per-operation header tables below.
POST/api/evidence/collect
execute access
Evidence collect.
Permissions
| Access class | Credential | Scoping |
|---|---|---|
execute | An authenticated session or API bearer token is required. | The access class is enforced first; site and environment scopes narrow resources on scoped operations. |
HTTP request
POST https://<your-host>/api/evidence/collect
Path parameters
This operation has no path parameters.
Query parameters
This operation has no query parameters.
Request headers
| Name | Type | Requirement | Description |
|---|---|---|---|
Authorization | string | Optional | Human credential alternative: supply one Bearer rys_... session token, ryk_... API token, or validated identity-provider JWT here. Do not combine it with X-Ryuki-Session-Id or the session cookie; conflicting carriers fail closed. |
X-Ryuki-Session-Id | string | Optional | Opaque rys_... session-token carrier used by the portal for mutations. Administrative session UUIDs cannot authenticate. Supply exactly one credential carrier per request. |
Idempotency-Key | string | Optional | Optional at-most-once retry key for human mutations. When omitted, the idempotency middleware passes the request through without deduplication. |
traceparent | string | Optional | Optional correlation input. When the second dash-separated segment has 32 characters, Ryuki reuses it as the request correlation identifier; this is not full W3C validation. |
Request body
This operation does not accept a request body.
Response
| Status | Description | Body |
|---|---|---|
200 | OK | ryuki_engine::models::EvidencePack |
200 response body
Structure: ryuki_engine::models::EvidencePack.
| Name | Type | Requirement | Description |
|---|---|---|---|
id | string | Required | Identifier of the returned resource. |
request_id | string | Required | Request correlation or lifecycle identifier. |
items | array<object (EvidenceItem)> | Required | Resources returned by this operation. |
redacted | boolean | Required | Value of redacted returned in the response body. |
created_at | string | Required | RFC 3339 timestamp when the resource was created. |
format | string | Required | Value of format returned in the response body. |
compliance_checks | array<string> | Required | Value of compliance_checks returned in the response body. |
metadata | object<string, string> | Required | Value of metadata returned in the response body. |
Errors
JSON failures use one of the platform error envelopes and include the request correlation metadata when routing reaches the API middleware. See Errors for the exact shapes, authentication failures, retry guidance, and transport-level exceptions.
Examples
Request
curl --silent --show-error --globoff \
--request POST \
--header 'Authorization: Bearer <token>' \
--header 'Idempotency-Key: <idempotency-key>' \
'https://<your-host>/api/evidence/collect'
Schematic response body
Illustrative shape generated from the extracted field types, not a recorded live response. Values are placeholders; null marks a field whose type could not be resolved.
Success status: 200
{
"id": "<string>",
"request_id": "<string>",
"items": [],
"redacted": false,
"created_at": "<string>",
"format": "<string>",
"compliance_checks": [],
"metadata": {}
}
GET/api/evidence/compliance-dashboard-contract
request access
Evidence compliance dashboard.
Permissions
| Access class | Credential | Scoping |
|---|---|---|
request | An authenticated session or API bearer token is required. | The access class is enforced first; site and environment scopes narrow resources on scoped operations. |
HTTP request
GET https://<your-host>/api/evidence/compliance-dashboard-contract
Path parameters
This operation has no path parameters.
Query parameters
This operation has no query parameters.
Request headers
| Name | Type | Requirement | Description |
|---|---|---|---|
Authorization | string | Optional | Human credential alternative: supply one Bearer rys_... session token, ryk_... API token, or validated identity-provider JWT here. Do not combine it with X-Ryuki-Session-Id or the session cookie; conflicting carriers fail closed. |
X-Ryuki-Session-Id | string | Optional | Opaque rys_... session-token carrier used by the portal for mutations. Administrative session UUIDs cannot authenticate. Supply exactly one credential carrier per request. |
traceparent | string | Optional | Optional correlation input. When the second dash-separated segment has 32 characters, Ryuki reuses it as the request correlation identifier; this is not full W3C validation. |
Request body
This operation does not accept a request body.
Response
| Status | Description | Body |
|---|---|---|
200 | OK | Value |
200 response body
Structure: Value.
| Name | Type | Requirement | Description |
|---|---|---|---|
source | string | Required | Origin or authority of the returned data. |
complianceDashboardMode | string | Required | Value of complianceDashboardMode returned in the response body. |
evidenceRequired | boolean | Required | Value of evidenceRequired returned in the response body. |
providerCallsEnabled | boolean | Required | Value of providerCallsEnabled returned in the response body. |
liveEvaluationAllowed | boolean | Required | Value of liveEvaluationAllowed returned in the response body. |
evidenceMutationAllowed | boolean | Required | Value of evidenceMutationAllowed returned in the response body. |
exportMutationAllowed | boolean | Required | Value of exportMutationAllowed returned in the response body. |
retentionMutationAllowed | boolean | Required | Value of retentionMutationAllowed returned in the response body. |
workflowMutationAllowed | boolean | Required | Value of workflowMutationAllowed returned in the response body. |
notificationDispatchAllowed | boolean | Required | Value of notificationDispatchAllowed returned in the response body. |
rawEvidencePayloadsAllowed | boolean | Required | Value of rawEvidencePayloadsAllowed returned in the response body. |
rawControlRowsAllowed | boolean | Required | Value of rawControlRowsAllowed returned in the response body. |
rawAuditLogsAllowed | boolean | Required | Value of rawAuditLogsAllowed returned in the response body. |
rawUserDataAllowed | boolean | Required | Value of rawUserDataAllowed returned in the response body. |
rawProviderPayloadsAllowed | boolean | Required | Value of rawProviderPayloadsAllowed returned in the response body. |
rawRecipientDataAllowed | boolean | Required | Value of rawRecipientDataAllowed returned in the response body. |
credentialValuesAllowed | boolean | Required | Value of credentialValuesAllowed returned in the response body. |
tokenValuesAllowed | boolean | Required | Value of tokenValuesAllowed returned in the response body. |
tenantIdentifiersAllowed | boolean | Required | Value of tenantIdentifiersAllowed returned in the response body. |
objectIdentifiersAllowed | boolean | Required | Value of objectIdentifiersAllowed returned in the response body. |
principalIdentifiersAllowed | boolean | Required | Value of principalIdentifiersAllowed returned in the response body. |
privateNetworkValuesAllowed | boolean | Required | Value of privateNetworkValuesAllowed returned in the response body. |
domains | array<JSON value> | Required | Value of domains returned in the response body. |
statusBands | array<JSON value> | Required | Value of statusBands returned in the response body. |
trendWindows | array<JSON value> | Required | Value of trendWindows returned in the response body. |
requiredGuards | array<JSON value> | Required | Value of requiredGuards returned in the response body. |
blockedReasons | array<JSON value> | Required | Value of blockedReasons returned in the response body. |
requiredEvidence | array<JSON value> | Required | Value of requiredEvidence returned in the response body. |
Errors
JSON failures use one of the platform error envelopes and include the request correlation metadata when routing reaches the API middleware. See Errors for the exact shapes, authentication failures, retry guidance, and transport-level exceptions.
Examples
Request
curl --silent --show-error --globoff \
--request GET \
--header 'Authorization: Bearer <token>' \
'https://<your-host>/api/evidence/compliance-dashboard-contract'
Schematic response body
Illustrative shape generated from the extracted field types, not a recorded live response. Values are placeholders; null marks a field whose type could not be resolved.
Success status: 200
{
"source": "<string>",
"complianceDashboardMode": "<string>",
"evidenceRequired": false,
"providerCallsEnabled": false,
"liveEvaluationAllowed": false,
"evidenceMutationAllowed": false,
"exportMutationAllowed": false,
"retentionMutationAllowed": false,
"workflowMutationAllowed": false,
"notificationDispatchAllowed": false,
"rawEvidencePayloadsAllowed": false,
"rawControlRowsAllowed": false,
"rawAuditLogsAllowed": false,
"rawUserDataAllowed": false,
"rawProviderPayloadsAllowed": false,
"rawRecipientDataAllowed": false,
"credentialValuesAllowed": false,
"tokenValuesAllowed": false,
"tenantIdentifiersAllowed": false,
"objectIdentifiersAllowed": false,
"principalIdentifiersAllowed": false,
"privateNetworkValuesAllowed": false,
"domains": [],
"statusBands": [],
"trendWindows": [],
"requiredGuards": [],
"blockedReasons": [],
"requiredEvidence": []
}
GET/api/evidence/export
audit access
Export evidence.
Permissions
| Access class | Credential | Scoping |
|---|---|---|
audit | An authenticated session or API bearer token is required. | The access class is enforced first; site and environment scopes narrow resources on scoped operations. |
HTTP request
GET https://<your-host>/api/evidence/export
Path parameters
This operation has no path parameters.
Query parameters
| Name | Type | Requirement | Description |
|---|---|---|---|
format | string | Optional | Value supplied for the format query parameter. |
Request headers
| Name | Type | Requirement | Description |
|---|---|---|---|
Authorization | string | Optional | Human credential alternative: supply one Bearer rys_... session token, ryk_... API token, or validated identity-provider JWT here. Do not combine it with X-Ryuki-Session-Id or the session cookie; conflicting carriers fail closed. |
X-Ryuki-Session-Id | string | Optional | Opaque rys_... session-token carrier used by the portal for mutations. Administrative session UUIDs cannot authenticate. Supply exactly one credential carrier per request. |
traceparent | string | Optional | Optional correlation input. When the second dash-separated segment has 32 characters, Ryuki reuses it as the request correlation identifier; this is not full W3C validation. |
Request body
This operation does not accept a request body.
Response
| Status | Description | Body |
|---|---|---|
200 | OK | Value |
For 200, the known response body type is Value. Its field schema is unavailable, so no JSON shape is inferred.
Errors
JSON failures use one of the platform error envelopes and include the request correlation metadata when routing reaches the API middleware. See Errors for the exact shapes, authentication failures, retry guidance, and transport-level exceptions.
Examples
Request
curl --silent --show-error --globoff \
--request GET \
--header 'Authorization: Bearer <token>' \
'https://<your-host>/api/evidence/export'
GET/api/evidence/export-retention-contract
request access
Evidence export retention.
Permissions
| Access class | Credential | Scoping |
|---|---|---|
request | An authenticated session or API bearer token is required. | The access class is enforced first; site and environment scopes narrow resources on scoped operations. |
HTTP request
GET https://<your-host>/api/evidence/export-retention-contract
Path parameters
This operation has no path parameters.
Query parameters
This operation has no query parameters.
Request headers
| Name | Type | Requirement | Description |
|---|---|---|---|
Authorization | string | Optional | Human credential alternative: supply one Bearer rys_... session token, ryk_... API token, or validated identity-provider JWT here. Do not combine it with X-Ryuki-Session-Id or the session cookie; conflicting carriers fail closed. |
X-Ryuki-Session-Id | string | Optional | Opaque rys_... session-token carrier used by the portal for mutations. Administrative session UUIDs cannot authenticate. Supply exactly one credential carrier per request. |
traceparent | string | Optional | Optional correlation input. When the second dash-separated segment has 32 characters, Ryuki reuses it as the request correlation identifier; this is not full W3C validation. |
Request body
This operation does not accept a request body.
Response
| Status | Description | Body |
|---|---|---|
200 | OK | Value |
200 response body
Structure: Value.
| Name | Type | Requirement | Description |
|---|---|---|---|
source | string | Required | Origin or authority of the returned data. |
exportRetentionMode | string | Required | Value of exportRetentionMode returned in the response body. |
redactionRequired | boolean | Required | Value of redactionRequired returned in the response body. |
providerCallsEnabled | boolean | Required | Value of providerCallsEnabled returned in the response body. |
liveEvidenceMutationAllowed | boolean | Required | Value of liveEvidenceMutationAllowed returned in the response body. |
exportPackageMutationAllowed | boolean | Required | Value of exportPackageMutationAllowed returned in the response body. |
retentionPolicyMutationAllowed | boolean | Required | Value of retentionPolicyMutationAllowed returned in the response body. |
liveAuditSearchAllowed | boolean | Required | Value of liveAuditSearchAllowed returned in the response body. |
auditSearchQueryAllowed | boolean | Required | Value of auditSearchQueryAllowed returned in the response body. |
evidencePayloadsAllowed | boolean | Required | Value of evidencePayloadsAllowed returned in the response body. |
rawRequestPayloadsAllowed | boolean | Required | Value of rawRequestPayloadsAllowed returned in the response body. |
rawProviderPayloadsAllowed | boolean | Required | Value of rawProviderPayloadsAllowed returned in the response body. |
rawEvidencePayloadsAllowed | boolean | Required | Value of rawEvidencePayloadsAllowed returned in the response body. |
rawLogContentAllowed | boolean | Required | Value of rawLogContentAllowed returned in the response body. |
unfilteredLogsAllowed | boolean | Required | Value of unfilteredLogsAllowed returned in the response body. |
stackTracesAllowed | boolean | Required | Value of stackTracesAllowed returned in the response body. |
rawRowsAllowed | boolean | Required | Value of rawRowsAllowed returned in the response body. |
serialNumbersAllowed | boolean | Required | Value of serialNumbersAllowed returned in the response body. |
exportWithoutRedactionAllowed | boolean | Required | Value of exportWithoutRedactionAllowed returned in the response body. |
credentialValuesAllowed | boolean | Required | Value of credentialValuesAllowed returned in the response body. |
secretValuesAllowed | boolean | Required | Value of secretValuesAllowed returned in the response body. |
tokenValuesAllowed | boolean | Required | Value of tokenValuesAllowed returned in the response body. |
tenantIdentifiersAllowed | boolean | Required | Value of tenantIdentifiersAllowed returned in the response body. |
objectIdentifiersAllowed | boolean | Required | Value of objectIdentifiersAllowed returned in the response body. |
privateNetworkValuesAllowed | boolean | Required | Value of privateNetworkValuesAllowed returned in the response body. |
rawRecipientDataAllowed | boolean | Required | Value of rawRecipientDataAllowed returned in the response body. |
redactionStates | array<JSON value> | Required | Value of redactionStates returned in the response body. |
exportReadiness | array<JSON value> | Required | Value of exportReadiness returned in the response body. |
safeExportTargets | array<JSON value> | Required | Value of safeExportTargets returned in the response body. |
prohibitedContent | array<JSON value> | Required | Value of prohibitedContent returned in the response body. |
retentionClasses | array<JSON value> | Required | Value of retentionClasses returned in the response body. |
auditSearchStates | array<JSON value> | Required | Value of auditSearchStates returned in the response body. |
searchFacets | array<JSON value> | Required | Value of searchFacets returned in the response body. |
packageFields | array<JSON value> | Required | Value of packageFields returned in the response body. |
requiredGuards | array<JSON value> | Required | Value of requiredGuards returned in the response body. |
requiredEvidence | array<JSON value> | Required | Value of requiredEvidence returned in the response body. |
blockedReasons | array<JSON value> | Required | Value of blockedReasons returned in the response body. |
Errors
JSON failures use one of the platform error envelopes and include the request correlation metadata when routing reaches the API middleware. See Errors for the exact shapes, authentication failures, retry guidance, and transport-level exceptions.
Examples
Request
curl --silent --show-error --globoff \
--request GET \
--header 'Authorization: Bearer <token>' \
'https://<your-host>/api/evidence/export-retention-contract'
Schematic response body
Illustrative shape generated from the extracted field types, not a recorded live response. Values are placeholders; null marks a field whose type could not be resolved.
Success status: 200
{
"source": "<string>",
"exportRetentionMode": "<string>",
"redactionRequired": false,
"providerCallsEnabled": false,
"liveEvidenceMutationAllowed": false,
"exportPackageMutationAllowed": false,
"retentionPolicyMutationAllowed": false,
"liveAuditSearchAllowed": false,
"auditSearchQueryAllowed": false,
"evidencePayloadsAllowed": false,
"rawRequestPayloadsAllowed": false,
"rawProviderPayloadsAllowed": false,
"rawEvidencePayloadsAllowed": false,
"rawLogContentAllowed": false,
"unfilteredLogsAllowed": false,
"stackTracesAllowed": false,
"rawRowsAllowed": false,
"serialNumbersAllowed": false,
"exportWithoutRedactionAllowed": false,
"credentialValuesAllowed": false,
"secretValuesAllowed": false,
"tokenValuesAllowed": false,
"tenantIdentifiersAllowed": false,
"objectIdentifiersAllowed": false,
"privateNetworkValuesAllowed": false,
"rawRecipientDataAllowed": false,
"redactionStates": [],
"exportReadiness": [],
"safeExportTargets": [],
"prohibitedContent": [],
"retentionClasses": [],
"auditSearchStates": [],
"searchFacets": [],
"packageFields": [],
"requiredGuards": [],
"requiredEvidence": [],
"blockedReasons": []
}
POST/api/evidence/redact
execute access
Evidence redact.
Permissions
| Access class | Credential | Scoping |
|---|---|---|
execute | An authenticated session or API bearer token is required. | The access class is enforced first; site and environment scopes narrow resources on scoped operations. |
HTTP request
POST https://<your-host>/api/evidence/redact
Path parameters
This operation has no path parameters.
Query parameters
This operation has no query parameters.
Request headers
| Name | Type | Requirement | Description |
|---|---|---|---|
Authorization | string | Optional | Human credential alternative: supply one Bearer rys_... session token, ryk_... API token, or validated identity-provider JWT here. Do not combine it with X-Ryuki-Session-Id or the session cookie; conflicting carriers fail closed. |
Content-Type | string | Required | Required by the resolved Axum Json<T> request extractor; send application/json. |
X-Ryuki-Session-Id | string | Optional | Opaque rys_... session-token carrier used by the portal for mutations. Administrative session UUIDs cannot authenticate. Supply exactly one credential carrier per request. |
Idempotency-Key | string | Optional | Optional at-most-once retry key for human mutations. When omitted, the idempotency middleware passes the request through without deduplication. |
traceparent | string | Optional | Optional correlation input. When the second dash-separated segment has 32 characters, Ryuki reuses it as the request correlation identifier; this is not full W3C validation. |
Request body
JSON structure: EvidenceRedactRequest.
| Name | Type | Requirement | Description |
|---|---|---|---|
pack | JSON value | Required | Value of pack in the JSON request body. |
Response
| Status | Description | Body |
|---|---|---|
200 | OK | Value |
For 200, the known response body type is Value. Its field schema is unavailable, so no JSON shape is inferred.
Errors
JSON failures use one of the platform error envelopes and include the request correlation metadata when routing reaches the API middleware. See Errors for the exact shapes, authentication failures, retry guidance, and transport-level exceptions.
Examples
Request
curl --silent --show-error --globoff \
--request POST \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--header 'Idempotency-Key: <idempotency-key>' \
--data '{"pack":null}' \
'https://<your-host>/api/evidence/redact'
POST/api/evidence/verify-compliance
execute access
Evidence verify compliance.
Permissions
| Access class | Credential | Scoping |
|---|---|---|
execute | An authenticated session or API bearer token is required. | The access class is enforced first; site and environment scopes narrow resources on scoped operations. |
HTTP request
POST https://<your-host>/api/evidence/verify-compliance
Path parameters
This operation has no path parameters.
Query parameters
This operation has no query parameters.
Request headers
| Name | Type | Requirement | Description |
|---|---|---|---|
Authorization | string | Optional | Human credential alternative: supply one Bearer rys_... session token, ryk_... API token, or validated identity-provider JWT here. Do not combine it with X-Ryuki-Session-Id or the session cookie; conflicting carriers fail closed. |
Content-Type | string | Required | Required by the resolved Axum Json<T> request extractor; send application/json. |
X-Ryuki-Session-Id | string | Optional | Opaque rys_... session-token carrier used by the portal for mutations. Administrative session UUIDs cannot authenticate. Supply exactly one credential carrier per request. |
Idempotency-Key | string | Optional | Optional at-most-once retry key for human mutations. When omitted, the idempotency middleware passes the request through without deduplication. |
traceparent | string | Optional | Optional correlation input. When the second dash-separated segment has 32 characters, Ryuki reuses it as the request correlation identifier; this is not full W3C validation. |
Request body
JSON structure: EvidenceRedactRequest.
| Name | Type | Requirement | Description |
|---|---|---|---|
pack | JSON value | Required | Value of pack in the JSON request body. |
Response
| Status | Description | Body |
|---|---|---|
200 | OK | Value |
For 200, the known response body type is Value. Its field schema is unavailable, so no JSON shape is inferred.
Errors
JSON failures use one of the platform error envelopes and include the request correlation metadata when routing reaches the API middleware. See Errors for the exact shapes, authentication failures, retry guidance, and transport-level exceptions.
Examples
Request
curl --silent --show-error --globoff \
--request POST \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--header 'Idempotency-Key: <idempotency-key>' \
--data '{"pack":null}' \
'https://<your-host>/api/evidence/verify-compliance'