Export a signed compliance-evidence bundle

POST

/v1/compliance/evidence/export

curl --request POST \
  --url https://example.com/v1/compliance/evidence/export \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "signingKeyId": "example", "filter": { "runId": "example", "agentId": "example", "flowId": "example", "kind": "access-event", "from": "2026-04-15T12:00:00Z", "to": "2026-04-15T12:00:00Z" } }'

• Same-origin — path relative to the deployment root.

Signs the evidence the filter matches (exportable kinds only) with the deployment’s export key, and records the export (an export-signed audit event). The same envelope as the other signed exports; check publicKey against GET /v1/export-signing-keys. A deployment with no export key answers 404 signing-not-configured.

Authorizations

• bearerAuth

Parameters

Header Parameters

Idempotency-Key

string

>= 1 characters

Caller-supplied idempotency key, scoped to the caller: the same key from someone else in the tenant is their own request (from 0.1.5). Retries with the same key return the original response byte-identical (per docs/API-ROUTE-CONVENTIONS.md §3.1). A retry sent while the first request still runs is answered 409 idempotency-key-in-flight with Retry-After, on a runtime whose store holds keys (from 0.1.5); retry after it, and you get the first request’s answer. An answer that carries a secret (a new API key or public run token, a session token, a generated signing secret) isn’t kept: a retry gets 409 idempotency-key-replay-withheld, with the first request’s status and when it succeeded (from 0.1.5).

Request Body

Media typeapplication/json

Optional: no body exports every exportable kind, signed with the active key.

object

signingKeyId

Optional: sign with this key, one of GET /v1/export-signing-keys. Leave it out to sign with the deployment’s active key. A key the deployment doesn’t sign with is 404 signing-key-not-found.

string

>= 1 characters

filter

Optional filter narrowing the export set. Composition is AND — every populated field must match. Absent / empty filter exports every record for the tenant.

object

runId

string

agentId

string

flowId

string

kind

Compliance-relevant event class. Open set: evidence is a classifier lens over the audit stream, and a deployment can mark any audit-event kind exportable. examples lists the built-in kinds; clients must tolerate kinds they do not know.

string

>= 1 characters

from

string format: date-time

to

string format: date-time

Responses

200

Signed evidence bundle.

Media typeapplication/json

Signed compliance evidence. Body: { bundleSchemaVersion, tenantId, filter, records, recordCount, exportedAt }.

object

tenantId

required

string format: uuid

kind

Which export this is: audit-bundle, provenance or compliance. Absent from older servers.

string

Allowed value: compliance

bundle

required

Base64 of the exact bytes that were signed: the body, as sorted-key JSON with no whitespace. Verify these bytes; nothing needs re-serializing.

string

bundleSchemaVersion

required

The body’s version, semver: 1.0.0.

string

algorithm

required

The signing key’s algorithm. ecdsa-p256-sha256 signatures are IEEE P1363 r‖s. A verifier refuses an algorithm it doesn’t know.

string

Allowed values: ed25519 ecdsa-p256-sha256

signingKeyId

required

The key that signed it: one of GET /v1/export-signing-keys.

string

signature

required

Base64 of the 64-byte signature over the bundle bytes: Ed25519’s, or ECDSA P-256’s as IEEE P1363 r‖s.

string

publicKey

required

The signing key’s public half, PEM SPKI. On its own it only proves the bytes weren’t changed; check it against GET /v1/export-signing-keys (or a key you pinned) to know who signed them.

string

canonicalization

required

Sorted-key JSON, no whitespace (canonicalize in @kindgi/schema).

string

Allowed value: sorted-key-json

exportedAt

required

When it was signed: the same instant as the signed body’s exportedAt.

string format: date-time

Example

{
  "kind": "compliance",
  "algorithm": "ed25519",
  "canonicalization": "sorted-key-json"
}

400

Malformed request body.

Media typeapplication/json

object

error

required

object

code

required

Stable machine-readable discriminant. Values match domain error codes (see docs/API-ROUTE-CONVENTIONS.md §4.3).

string

message

required

string

details

Optional, kind-specific.

object

key

additional properties

any

requestId

required

Server-assigned request id; also echoed via X-Request-Id header.

string

Example^generated

{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}

401

Missing / malformed / expired / revoked bearer token.

Media typeapplication/json

object

error

required

object

code

required

Stable machine-readable discriminant. Values match domain error codes (see docs/API-ROUTE-CONVENTIONS.md §4.3).

string

message

required

string

details

Optional, kind-specific.

object

key

additional properties

any

requestId

required

Server-assigned request id; also echoed via X-Request-Id header.

string

Example^generated

{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}

404

Signing key id unknown, or signing not configured on this deployment.

Media typeapplication/json

object

error

required

object

code

required

Stable machine-readable discriminant. Values match domain error codes (see docs/API-ROUTE-CONVENTIONS.md §4.3).

string

message

required

string

details

Optional, kind-specific.

object

key

additional properties

any

requestId

required

Server-assigned request id; also echoed via X-Request-Id header.

string

Example^generated

{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}

409

Idempotency-Key was reused with a different body, or resource-state conflict.

Media typeapplication/json

object

error

required

object

code

required

Stable machine-readable discriminant. Values match domain error codes (see docs/API-ROUTE-CONVENTIONS.md §4.3).

string

message

required

string

details

Optional, kind-specific.

object

key

additional properties

any

requestId

required

Server-assigned request id; also echoed via X-Request-Id header.

string

Example^generated

{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}

413

The request body is over the API’s limit (request-too-large; details.maxBytes says how much).

Media typeapplication/json

object

error

required

object

code

required

Stable machine-readable discriminant. Values match domain error codes (see docs/API-ROUTE-CONVENTIONS.md §4.3).

string

message

required

string

details

Optional, kind-specific.

object

key

additional properties

any

requestId

required

Server-assigned request id; also echoed via X-Request-Id header.

string

Example^generated

{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}

500

Server error (unmapped domain code or framework crash).

Media typeapplication/json

object

error

required

object

code

required

Stable machine-readable discriminant. Values match domain error codes (see docs/API-ROUTE-CONVENTIONS.md §4.3).

string

message

required

string

details

Optional, kind-specific.

object

key

additional properties

any

requestId

required

Server-assigned request id; also echoed via X-Request-Id header.

string

Example^generated

{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}

See also

• GET /v1/compliance/evidence: List compliance-evidence records
• GET /v1/compliance/evidence/{evidenceId}: Fetch one compliance-evidence record
• Error code request-too-large
• Every error code