Export a signed audit bundle for a decided approval
const url = 'https://example.com/v1/approvals/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/audit-bundle';const options = { method: 'POST', headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'}, body: '{"signingKeyId":"example","includeMessages":false}'};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request POST \ --url https://example.com/v1/approvals/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/audit-bundle \ --header 'Authorization: Bearer <token>' \ --header 'Content-Type: application/json' \ --data '{ "signingKeyId": "example", "includeMessages": false }'Signs the approval, its decision and its evidence with the deployment’s export key, and records the export (an export-signed audit event). The same envelope as the other signed exports, so one verifier reads all three; check publicKey against GET /v1/export-signing-keys. For a decided approval only (approved, rejected, escalated, expired, withdrawn): a pending one is 409 approval-not-decided. A deployment with no export key answers 404 signing-not-configured.
Authorizations
Section titled “Authorizations”Parameters
Section titled “Parameters”Path Parameters
Section titled “Path Parameters”ApprovalId — opaque branded string (a UUID).
Header Parameters
Section titled “Header Parameters”Caller-supplied idempotency key, scoped to the caller: the same key from someone else in the tenant is their own request (from 0.1.5). Retries with the same key return the original response byte-identical (per docs/API-ROUTE-CONVENTIONS.md §3.1). A retry sent while the first request still runs is answered 409 idempotency-key-in-flight with Retry-After, on a runtime whose store holds keys (from 0.1.5); retry after it, and you get the first request’s answer. An answer that carries a secret (a new API key or public run token, a session token, a generated signing secret) isn’t kept: a retry gets 409 idempotency-key-replay-withheld, with the first request’s status and when it succeeded (from 0.1.5).
Request Body
Section titled “Request Body”Body for POST /v1/approvals/{approvalId}/audit-bundle, optional: no body signs with the active key. includeMessages adds the conversation messages of the approval’s run.
object
Optional: sign with this key, one of GET /v1/export-signing-keys. Leave it out to sign with the deployment’s active key. A key the deployment doesn’t sign with is 404 signing-key-not-found.
When true, hydrates conversation messages tied to the approval’s run (agent turns pin runId === conversationId). Empty array for non-agent runs — field always present when requested.
Responses
Section titled “Responses”Signed audit bundle.
A decided approval’s signed audit bundle. Body: { bundleSchemaVersion, approvalId, tenantId, subjectKind, subjectRef, requiredRole, status, createdAt, decidedAt?, decision, evidence: { guardrailResults?, messages? }, exportedAt }.
object
Which export this is: audit-bundle, provenance or compliance. Absent from older servers.
Base64 of the exact bytes that were signed: the body, as sorted-key JSON with no whitespace. Verify these bytes; nothing needs re-serializing.
The body’s version, semver. 2.0.0: a string like the other exports’ (it was the integer 1), named bundleSchemaVersion in the body too, with exportedAt signed once.
The signing key’s algorithm. ecdsa-p256-sha256 signatures are IEEE P1363 r‖s. A verifier refuses an algorithm it doesn’t know.
The key that signed it: one of GET /v1/export-signing-keys.
Base64 of the 64-byte signature over the bundle bytes: Ed25519’s, or ECDSA P-256’s as IEEE P1363 r‖s.
The signing key’s public half, PEM SPKI. On its own it only proves the bytes weren’t changed; check it against GET /v1/export-signing-keys (or a key you pinned) to know who signed them.
Sorted-key JSON, no whitespace (canonicalize in @kindgi/schema).
When it was signed: the same instant as the signed body’s exportedAt.
Example
{ "kind": "audit-bundle", "algorithm": "ed25519", "canonicalization": "sorted-key-json"}Malformed request body.
object
object
Stable machine-readable discriminant. Values match domain error codes (see docs/API-ROUTE-CONVENTIONS.md §4.3).
Optional, kind-specific.
object
Server-assigned request id; also echoed via X-Request-Id header.
Examplegenerated
{ "error": { "code": "example", "message": "example", "details": {}, "requestId": "example" }}Missing / malformed / expired / revoked bearer token.
object
object
Stable machine-readable discriminant. Values match domain error codes (see docs/API-ROUTE-CONVENTIONS.md §4.3).
Optional, kind-specific.
object
Server-assigned request id; also echoed via X-Request-Id header.
Examplegenerated
{ "error": { "code": "example", "message": "example", "details": {}, "requestId": "example" }}The caller isn’t a reviewer.
object
object
Stable machine-readable discriminant. Values match domain error codes (see docs/API-ROUTE-CONVENTIONS.md §4.3).
Optional, kind-specific.
object
Server-assigned request id; also echoed via X-Request-Id header.
Examplegenerated
{ "error": { "code": "example", "message": "example", "details": {}, "requestId": "example" }}Approval not found, signing key id unknown, or signing not configured on this deployment.
object
object
Stable machine-readable discriminant. Values match domain error codes (see docs/API-ROUTE-CONVENTIONS.md §4.3).
Optional, kind-specific.
object
Server-assigned request id; also echoed via X-Request-Id header.
Examplegenerated
{ "error": { "code": "example", "message": "example", "details": {}, "requestId": "example" }}Idempotency-Key was reused with a different body, or resource-state conflict.
object
object
Stable machine-readable discriminant. Values match domain error codes (see docs/API-ROUTE-CONVENTIONS.md §4.3).
Optional, kind-specific.
object
Server-assigned request id; also echoed via X-Request-Id header.
Examplegenerated
{ "error": { "code": "example", "message": "example", "details": {}, "requestId": "example" }}The request body is over the API’s limit (request-too-large; details.maxBytes says how much).
object
object
Stable machine-readable discriminant. Values match domain error codes (see docs/API-ROUTE-CONVENTIONS.md §4.3).
Optional, kind-specific.
object
Server-assigned request id; also echoed via X-Request-Id header.
Examplegenerated
{ "error": { "code": "example", "message": "example", "details": {}, "requestId": "example" }}Server error (unmapped domain code or framework crash).
object
object
Stable machine-readable discriminant. Values match domain error codes (see docs/API-ROUTE-CONVENTIONS.md §4.3).
Optional, kind-specific.
object
Server-assigned request id; also echoed via X-Request-Id header.
Examplegenerated
{ "error": { "code": "example", "message": "example", "details": {}, "requestId": "example" }}