Open source / Rust / MIT Field guide / indexed
Field guide / Evidence APIReviewable source / main

Evidence API

Evidence-pack operations: collect, export, redact, and verify compliance evidence.

6 routes

Response metadata: x-api-version, x-request-id, and traceresponse apply to normal routed responses and are omitted from the per-operation header tables below.

POST/api/evidence/collect

execute access

Evidence collect.

Permissions

Access classCredentialScoping
executeAn authenticated session or API bearer token is required.The access class is enforced first; site and environment scopes narrow resources on scoped operations.

HTTP request

POST https://<your-host>/api/evidence/collect

Path parameters

This operation has no path parameters.

Query parameters

This operation has no query parameters.

Request headers

NameTypeRequirementDescription
AuthorizationstringOptionalHuman credential alternative: supply one Bearer rys_... session token, ryk_... API token, or validated identity-provider JWT here. Do not combine it with X-Ryuki-Session-Id or the session cookie; conflicting carriers fail closed.
X-Ryuki-Session-IdstringOptionalOpaque rys_... session-token carrier used by the portal for mutations. Administrative session UUIDs cannot authenticate. Supply exactly one credential carrier per request.
Idempotency-KeystringOptionalOptional at-most-once retry key for human mutations. When omitted, the idempotency middleware passes the request through without deduplication.
traceparentstringOptionalOptional correlation input. When the second dash-separated segment has 32 characters, Ryuki reuses it as the request correlation identifier; this is not full W3C validation.

Request body

This operation does not accept a request body.

Response

StatusDescriptionBody
200OKryuki_engine::models::EvidencePack

200 response body

Structure: ryuki_engine::models::EvidencePack.

NameTypeRequirementDescription
idstringRequiredIdentifier of the returned resource.
request_idstringRequiredRequest correlation or lifecycle identifier.
itemsarray<object (EvidenceItem)>RequiredResources returned by this operation.
redactedbooleanRequiredValue of redacted returned in the response body.
created_atstringRequiredRFC 3339 timestamp when the resource was created.
formatstringRequiredValue of format returned in the response body.
compliance_checksarray<string>RequiredValue of compliance_checks returned in the response body.
metadataobject<string, string>RequiredValue of metadata returned in the response body.

Errors

JSON failures use one of the platform error envelopes and include the request correlation metadata when routing reaches the API middleware. See Errors for the exact shapes, authentication failures, retry guidance, and transport-level exceptions.

Examples

Request

curl --silent --show-error --globoff \
  --request POST \
  --header 'Authorization: Bearer <token>' \
  --header 'Idempotency-Key: <idempotency-key>' \
  'https://<your-host>/api/evidence/collect'

Schematic response body

Illustrative shape generated from the extracted field types, not a recorded live response. Values are placeholders; null marks a field whose type could not be resolved.

Success status: 200

{
  "id": "<string>",
  "request_id": "<string>",
  "items": [],
  "redacted": false,
  "created_at": "<string>",
  "format": "<string>",
  "compliance_checks": [],
  "metadata": {}
}

GET/api/evidence/compliance-dashboard-contract

request access

Evidence compliance dashboard.

Permissions

Access classCredentialScoping
requestAn authenticated session or API bearer token is required.The access class is enforced first; site and environment scopes narrow resources on scoped operations.

HTTP request

GET https://<your-host>/api/evidence/compliance-dashboard-contract

Path parameters

This operation has no path parameters.

Query parameters

This operation has no query parameters.

Request headers

NameTypeRequirementDescription
AuthorizationstringOptionalHuman credential alternative: supply one Bearer rys_... session token, ryk_... API token, or validated identity-provider JWT here. Do not combine it with X-Ryuki-Session-Id or the session cookie; conflicting carriers fail closed.
X-Ryuki-Session-IdstringOptionalOpaque rys_... session-token carrier used by the portal for mutations. Administrative session UUIDs cannot authenticate. Supply exactly one credential carrier per request.
traceparentstringOptionalOptional correlation input. When the second dash-separated segment has 32 characters, Ryuki reuses it as the request correlation identifier; this is not full W3C validation.

Request body

This operation does not accept a request body.

Response

StatusDescriptionBody
200OKValue

200 response body

Structure: Value.

NameTypeRequirementDescription
sourcestringRequiredOrigin or authority of the returned data.
complianceDashboardModestringRequiredValue of complianceDashboardMode returned in the response body.
evidenceRequiredbooleanRequiredValue of evidenceRequired returned in the response body.
providerCallsEnabledbooleanRequiredValue of providerCallsEnabled returned in the response body.
liveEvaluationAllowedbooleanRequiredValue of liveEvaluationAllowed returned in the response body.
evidenceMutationAllowedbooleanRequiredValue of evidenceMutationAllowed returned in the response body.
exportMutationAllowedbooleanRequiredValue of exportMutationAllowed returned in the response body.
retentionMutationAllowedbooleanRequiredValue of retentionMutationAllowed returned in the response body.
workflowMutationAllowedbooleanRequiredValue of workflowMutationAllowed returned in the response body.
notificationDispatchAllowedbooleanRequiredValue of notificationDispatchAllowed returned in the response body.
rawEvidencePayloadsAllowedbooleanRequiredValue of rawEvidencePayloadsAllowed returned in the response body.
rawControlRowsAllowedbooleanRequiredValue of rawControlRowsAllowed returned in the response body.
rawAuditLogsAllowedbooleanRequiredValue of rawAuditLogsAllowed returned in the response body.
rawUserDataAllowedbooleanRequiredValue of rawUserDataAllowed returned in the response body.
rawProviderPayloadsAllowedbooleanRequiredValue of rawProviderPayloadsAllowed returned in the response body.
rawRecipientDataAllowedbooleanRequiredValue of rawRecipientDataAllowed returned in the response body.
credentialValuesAllowedbooleanRequiredValue of credentialValuesAllowed returned in the response body.
tokenValuesAllowedbooleanRequiredValue of tokenValuesAllowed returned in the response body.
tenantIdentifiersAllowedbooleanRequiredValue of tenantIdentifiersAllowed returned in the response body.
objectIdentifiersAllowedbooleanRequiredValue of objectIdentifiersAllowed returned in the response body.
principalIdentifiersAllowedbooleanRequiredValue of principalIdentifiersAllowed returned in the response body.
privateNetworkValuesAllowedbooleanRequiredValue of privateNetworkValuesAllowed returned in the response body.
domainsarray<JSON value>RequiredValue of domains returned in the response body.
statusBandsarray<JSON value>RequiredValue of statusBands returned in the response body.
trendWindowsarray<JSON value>RequiredValue of trendWindows returned in the response body.
requiredGuardsarray<JSON value>RequiredValue of requiredGuards returned in the response body.
blockedReasonsarray<JSON value>RequiredValue of blockedReasons returned in the response body.
requiredEvidencearray<JSON value>RequiredValue of requiredEvidence returned in the response body.

Errors

JSON failures use one of the platform error envelopes and include the request correlation metadata when routing reaches the API middleware. See Errors for the exact shapes, authentication failures, retry guidance, and transport-level exceptions.

Examples

Request

curl --silent --show-error --globoff \
  --request GET \
  --header 'Authorization: Bearer <token>' \
  'https://<your-host>/api/evidence/compliance-dashboard-contract'

Schematic response body

Illustrative shape generated from the extracted field types, not a recorded live response. Values are placeholders; null marks a field whose type could not be resolved.

Success status: 200

{
  "source": "<string>",
  "complianceDashboardMode": "<string>",
  "evidenceRequired": false,
  "providerCallsEnabled": false,
  "liveEvaluationAllowed": false,
  "evidenceMutationAllowed": false,
  "exportMutationAllowed": false,
  "retentionMutationAllowed": false,
  "workflowMutationAllowed": false,
  "notificationDispatchAllowed": false,
  "rawEvidencePayloadsAllowed": false,
  "rawControlRowsAllowed": false,
  "rawAuditLogsAllowed": false,
  "rawUserDataAllowed": false,
  "rawProviderPayloadsAllowed": false,
  "rawRecipientDataAllowed": false,
  "credentialValuesAllowed": false,
  "tokenValuesAllowed": false,
  "tenantIdentifiersAllowed": false,
  "objectIdentifiersAllowed": false,
  "principalIdentifiersAllowed": false,
  "privateNetworkValuesAllowed": false,
  "domains": [],
  "statusBands": [],
  "trendWindows": [],
  "requiredGuards": [],
  "blockedReasons": [],
  "requiredEvidence": []
}

GET/api/evidence/export

audit access

Export evidence.

Permissions

Access classCredentialScoping
auditAn authenticated session or API bearer token is required.The access class is enforced first; site and environment scopes narrow resources on scoped operations.

HTTP request

GET https://<your-host>/api/evidence/export

Path parameters

This operation has no path parameters.

Query parameters

NameTypeRequirementDescription
formatstringOptionalValue supplied for the format query parameter.

Request headers

NameTypeRequirementDescription
AuthorizationstringOptionalHuman credential alternative: supply one Bearer rys_... session token, ryk_... API token, or validated identity-provider JWT here. Do not combine it with X-Ryuki-Session-Id or the session cookie; conflicting carriers fail closed.
X-Ryuki-Session-IdstringOptionalOpaque rys_... session-token carrier used by the portal for mutations. Administrative session UUIDs cannot authenticate. Supply exactly one credential carrier per request.
traceparentstringOptionalOptional correlation input. When the second dash-separated segment has 32 characters, Ryuki reuses it as the request correlation identifier; this is not full W3C validation.

Request body

This operation does not accept a request body.

Response

StatusDescriptionBody
200OKValue

For 200, the known response body type is Value. Its field schema is unavailable, so no JSON shape is inferred.

Errors

JSON failures use one of the platform error envelopes and include the request correlation metadata when routing reaches the API middleware. See Errors for the exact shapes, authentication failures, retry guidance, and transport-level exceptions.

Examples

Request

curl --silent --show-error --globoff \
  --request GET \
  --header 'Authorization: Bearer <token>' \
  'https://<your-host>/api/evidence/export'

GET/api/evidence/export-retention-contract

request access

Evidence export retention.

Permissions

Access classCredentialScoping
requestAn authenticated session or API bearer token is required.The access class is enforced first; site and environment scopes narrow resources on scoped operations.

HTTP request

GET https://<your-host>/api/evidence/export-retention-contract

Path parameters

This operation has no path parameters.

Query parameters

This operation has no query parameters.

Request headers

NameTypeRequirementDescription
AuthorizationstringOptionalHuman credential alternative: supply one Bearer rys_... session token, ryk_... API token, or validated identity-provider JWT here. Do not combine it with X-Ryuki-Session-Id or the session cookie; conflicting carriers fail closed.
X-Ryuki-Session-IdstringOptionalOpaque rys_... session-token carrier used by the portal for mutations. Administrative session UUIDs cannot authenticate. Supply exactly one credential carrier per request.
traceparentstringOptionalOptional correlation input. When the second dash-separated segment has 32 characters, Ryuki reuses it as the request correlation identifier; this is not full W3C validation.

Request body

This operation does not accept a request body.

Response

StatusDescriptionBody
200OKValue

200 response body

Structure: Value.

NameTypeRequirementDescription
sourcestringRequiredOrigin or authority of the returned data.
exportRetentionModestringRequiredValue of exportRetentionMode returned in the response body.
redactionRequiredbooleanRequiredValue of redactionRequired returned in the response body.
providerCallsEnabledbooleanRequiredValue of providerCallsEnabled returned in the response body.
liveEvidenceMutationAllowedbooleanRequiredValue of liveEvidenceMutationAllowed returned in the response body.
exportPackageMutationAllowedbooleanRequiredValue of exportPackageMutationAllowed returned in the response body.
retentionPolicyMutationAllowedbooleanRequiredValue of retentionPolicyMutationAllowed returned in the response body.
liveAuditSearchAllowedbooleanRequiredValue of liveAuditSearchAllowed returned in the response body.
auditSearchQueryAllowedbooleanRequiredValue of auditSearchQueryAllowed returned in the response body.
evidencePayloadsAllowedbooleanRequiredValue of evidencePayloadsAllowed returned in the response body.
rawRequestPayloadsAllowedbooleanRequiredValue of rawRequestPayloadsAllowed returned in the response body.
rawProviderPayloadsAllowedbooleanRequiredValue of rawProviderPayloadsAllowed returned in the response body.
rawEvidencePayloadsAllowedbooleanRequiredValue of rawEvidencePayloadsAllowed returned in the response body.
rawLogContentAllowedbooleanRequiredValue of rawLogContentAllowed returned in the response body.
unfilteredLogsAllowedbooleanRequiredValue of unfilteredLogsAllowed returned in the response body.
stackTracesAllowedbooleanRequiredValue of stackTracesAllowed returned in the response body.
rawRowsAllowedbooleanRequiredValue of rawRowsAllowed returned in the response body.
serialNumbersAllowedbooleanRequiredValue of serialNumbersAllowed returned in the response body.
exportWithoutRedactionAllowedbooleanRequiredValue of exportWithoutRedactionAllowed returned in the response body.
credentialValuesAllowedbooleanRequiredValue of credentialValuesAllowed returned in the response body.
secretValuesAllowedbooleanRequiredValue of secretValuesAllowed returned in the response body.
tokenValuesAllowedbooleanRequiredValue of tokenValuesAllowed returned in the response body.
tenantIdentifiersAllowedbooleanRequiredValue of tenantIdentifiersAllowed returned in the response body.
objectIdentifiersAllowedbooleanRequiredValue of objectIdentifiersAllowed returned in the response body.
privateNetworkValuesAllowedbooleanRequiredValue of privateNetworkValuesAllowed returned in the response body.
rawRecipientDataAllowedbooleanRequiredValue of rawRecipientDataAllowed returned in the response body.
redactionStatesarray<JSON value>RequiredValue of redactionStates returned in the response body.
exportReadinessarray<JSON value>RequiredValue of exportReadiness returned in the response body.
safeExportTargetsarray<JSON value>RequiredValue of safeExportTargets returned in the response body.
prohibitedContentarray<JSON value>RequiredValue of prohibitedContent returned in the response body.
retentionClassesarray<JSON value>RequiredValue of retentionClasses returned in the response body.
auditSearchStatesarray<JSON value>RequiredValue of auditSearchStates returned in the response body.
searchFacetsarray<JSON value>RequiredValue of searchFacets returned in the response body.
packageFieldsarray<JSON value>RequiredValue of packageFields returned in the response body.
requiredGuardsarray<JSON value>RequiredValue of requiredGuards returned in the response body.
requiredEvidencearray<JSON value>RequiredValue of requiredEvidence returned in the response body.
blockedReasonsarray<JSON value>RequiredValue of blockedReasons returned in the response body.

Errors

JSON failures use one of the platform error envelopes and include the request correlation metadata when routing reaches the API middleware. See Errors for the exact shapes, authentication failures, retry guidance, and transport-level exceptions.

Examples

Request

curl --silent --show-error --globoff \
  --request GET \
  --header 'Authorization: Bearer <token>' \
  'https://<your-host>/api/evidence/export-retention-contract'

Schematic response body

Illustrative shape generated from the extracted field types, not a recorded live response. Values are placeholders; null marks a field whose type could not be resolved.

Success status: 200

{
  "source": "<string>",
  "exportRetentionMode": "<string>",
  "redactionRequired": false,
  "providerCallsEnabled": false,
  "liveEvidenceMutationAllowed": false,
  "exportPackageMutationAllowed": false,
  "retentionPolicyMutationAllowed": false,
  "liveAuditSearchAllowed": false,
  "auditSearchQueryAllowed": false,
  "evidencePayloadsAllowed": false,
  "rawRequestPayloadsAllowed": false,
  "rawProviderPayloadsAllowed": false,
  "rawEvidencePayloadsAllowed": false,
  "rawLogContentAllowed": false,
  "unfilteredLogsAllowed": false,
  "stackTracesAllowed": false,
  "rawRowsAllowed": false,
  "serialNumbersAllowed": false,
  "exportWithoutRedactionAllowed": false,
  "credentialValuesAllowed": false,
  "secretValuesAllowed": false,
  "tokenValuesAllowed": false,
  "tenantIdentifiersAllowed": false,
  "objectIdentifiersAllowed": false,
  "privateNetworkValuesAllowed": false,
  "rawRecipientDataAllowed": false,
  "redactionStates": [],
  "exportReadiness": [],
  "safeExportTargets": [],
  "prohibitedContent": [],
  "retentionClasses": [],
  "auditSearchStates": [],
  "searchFacets": [],
  "packageFields": [],
  "requiredGuards": [],
  "requiredEvidence": [],
  "blockedReasons": []
}

POST/api/evidence/redact

execute access

Evidence redact.

Permissions

Access classCredentialScoping
executeAn authenticated session or API bearer token is required.The access class is enforced first; site and environment scopes narrow resources on scoped operations.

HTTP request

POST https://<your-host>/api/evidence/redact

Path parameters

This operation has no path parameters.

Query parameters

This operation has no query parameters.

Request headers

NameTypeRequirementDescription
AuthorizationstringOptionalHuman credential alternative: supply one Bearer rys_... session token, ryk_... API token, or validated identity-provider JWT here. Do not combine it with X-Ryuki-Session-Id or the session cookie; conflicting carriers fail closed.
Content-TypestringRequiredRequired by the resolved Axum Json<T> request extractor; send application/json.
X-Ryuki-Session-IdstringOptionalOpaque rys_... session-token carrier used by the portal for mutations. Administrative session UUIDs cannot authenticate. Supply exactly one credential carrier per request.
Idempotency-KeystringOptionalOptional at-most-once retry key for human mutations. When omitted, the idempotency middleware passes the request through without deduplication.
traceparentstringOptionalOptional correlation input. When the second dash-separated segment has 32 characters, Ryuki reuses it as the request correlation identifier; this is not full W3C validation.

Request body

JSON structure: EvidenceRedactRequest.

NameTypeRequirementDescription
packJSON valueRequiredValue of pack in the JSON request body.

Response

StatusDescriptionBody
200OKValue

For 200, the known response body type is Value. Its field schema is unavailable, so no JSON shape is inferred.

Errors

JSON failures use one of the platform error envelopes and include the request correlation metadata when routing reaches the API middleware. See Errors for the exact shapes, authentication failures, retry guidance, and transport-level exceptions.

Examples

Request

curl --silent --show-error --globoff \
  --request POST \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --header 'Idempotency-Key: <idempotency-key>' \
  --data '{"pack":null}' \
  'https://<your-host>/api/evidence/redact'

POST/api/evidence/verify-compliance

execute access

Evidence verify compliance.

Permissions

Access classCredentialScoping
executeAn authenticated session or API bearer token is required.The access class is enforced first; site and environment scopes narrow resources on scoped operations.

HTTP request

POST https://<your-host>/api/evidence/verify-compliance

Path parameters

This operation has no path parameters.

Query parameters

This operation has no query parameters.

Request headers

NameTypeRequirementDescription
AuthorizationstringOptionalHuman credential alternative: supply one Bearer rys_... session token, ryk_... API token, or validated identity-provider JWT here. Do not combine it with X-Ryuki-Session-Id or the session cookie; conflicting carriers fail closed.
Content-TypestringRequiredRequired by the resolved Axum Json<T> request extractor; send application/json.
X-Ryuki-Session-IdstringOptionalOpaque rys_... session-token carrier used by the portal for mutations. Administrative session UUIDs cannot authenticate. Supply exactly one credential carrier per request.
Idempotency-KeystringOptionalOptional at-most-once retry key for human mutations. When omitted, the idempotency middleware passes the request through without deduplication.
traceparentstringOptionalOptional correlation input. When the second dash-separated segment has 32 characters, Ryuki reuses it as the request correlation identifier; this is not full W3C validation.

Request body

JSON structure: EvidenceRedactRequest.

NameTypeRequirementDescription
packJSON valueRequiredValue of pack in the JSON request body.

Response

StatusDescriptionBody
200OKValue

For 200, the known response body type is Value. Its field schema is unavailable, so no JSON shape is inferred.

Errors

JSON failures use one of the platform error envelopes and include the request correlation metadata when routing reaches the API middleware. See Errors for the exact shapes, authentication failures, retry guidance, and transport-level exceptions.

Examples

Request

curl --silent --show-error --globoff \
  --request POST \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --header 'Idempotency-Key: <idempotency-key>' \
  --data '{"pack":null}' \
  'https://<your-host>/api/evidence/verify-compliance'
Last updated 2026-07-16 · Generated from the API route registrations.