{ "openapi": "3.0.3", "info": { "title": "VeriProof Data Access - development preview", "version": "1.0.0", "description": "Use the API origin displayed in Customer Portal. Customer-pulled immutable snapshots, not incremental records. This contract does not announce production availability." }, "paths": { "/v1/auth/service-principals/token": { "post": { "operationId": "exchangeClientCredentials", "summary": "Obtain a dedicated Data Access token", "description": "Use exactly one authentication method: client secret (form or HTTP Basic), or private_key_jwt. Assertions use ES256, registered kid, client ID as iss/sub, displayed audience, iat, exp within five minutes, and unique jti. Tokens last ten minutes.", "security": [], "requestBody": { "required": true, "content": { "application/x-www-form-urlencoded": { "schema": { "type": "object", "required": [ "grant_type", "scope" ], "properties": { "grant_type": { "type": "string", "enum": [ "client_credentials" ] }, "client_id": { "type": "string", "format": "uuid", "description": "Required for form-secret or private_key_jwt authentication. With HTTP Basic, the username supplies the client ID." }, "scope": { "type": "string", "enum": [ "veriproof.data-access.read" ] }, "client_secret": { "type": "string", "format": "password" }, "client_assertion_type": { "type": "string", "enum": [ "urn:ietf:params:oauth:client-assertion-type:jwt-bearer" ] }, "client_assertion": { "type": "string", "format": "password" } } } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "properties": { "access_token": { "type": "string" }, "token_type": { "type": "string" }, "expires_in": { "type": "integer" }, "scope": { "type": "string" } } } } } }, "400": { "description": "Invalid request or scope." }, "401": { "description": "Invalid client authentication." } } } }, "/v1/data-access/publications": { "get": { "operationId": "listPublications", "summary": "List retained publications; persist nextCursor after durable processing", "parameters": [ { "name": "pageSize", "in": "query", "required": false, "schema": { "type": "integer", "minimum": 1, "maximum": 100, "default": 50 } }, { "name": "cursor", "in": "query", "required": false, "schema": { "type": "string" } } ], "security": [ { "dataAccess": [] } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "required": [ "items", "nextCursor", "hasMore" ], "properties": { "items": { "type": "array", "items": { "$ref": "#/components/schemas/Publication" } }, "nextCursor": { "type": "string" }, "hasMore": { "type": "boolean", "description": "Continue listing with nextCursor while true; when false, poll that position later. A full final page may require one extra empty request." } } } } } }, "400": { "description": "Invalid page size or restart_listing. Cursor expires after 30 days or scope change. Follow cursors across empty pages; withdrawals reappear." }, "401": { "description": "Missing, expired or revoked credentials." }, "403": { "description": "Current grant or export permission refused." }, "404": { "description": "Missing or inaccessible." }, "429": { "description": "Rate limited. Wait for Retry-After.", "headers": { "Retry-After": { "schema": { "type": "integer" } } } }, "503": { "description": "Access audit could not be persisted. No evidence response is released. Retry after the Retry-After delay; error code audit_unavailable.", "headers": { "Retry-After": { "schema": { "type": "integer" }, "description": "Seconds to wait before retrying." } } } } } }, "/v1/data-access/publications/{publicationId}": { "get": { "operationId": "getPublication", "summary": "Check current availability", "parameters": [ { "name": "publicationId", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "dataAccess": [] } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Publication" } } } }, "401": { "description": "Missing, expired or revoked credentials." }, "403": { "description": "Current grant or export permission refused." }, "404": { "description": "Missing or inaccessible." }, "429": { "description": "Rate limited. Wait for Retry-After.", "headers": { "Retry-After": { "schema": { "type": "integer" } } } }, "503": { "description": "Access audit could not be persisted. No evidence response is released. Retry after the Retry-After delay; error code audit_unavailable.", "headers": { "Retry-After": { "schema": { "type": "integer" }, "description": "Seconds to wait before retrying." } } } } } }, "/v1/data-access/publications/{publicationId}/files/{fileId}": { "get": { "operationId": "downloadFile", "summary": "Download frozen files; verify signed manifest and hashes before import", "parameters": [ { "name": "publicationId", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "fileId", "in": "path", "required": true, "schema": { "type": "string", "enum": [ "manifest.json", "data.json", "report.pdf" ] } } ], "security": [ { "dataAccess": [] } ], "responses": { "200": { "description": "Frozen file. JSON up to 25 MiB (26,214,400 bytes); PDF up to 10 MB (10,000,000 bytes). No-store.", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/SignedManifest" }, { "$ref": "#/components/schemas/PublicationData" } ] } }, "application/pdf": { "schema": { "type": "string", "format": "binary" } } } }, "401": { "description": "Missing, expired or revoked credentials." }, "403": { "description": "Current grant or export permission refused." }, "404": { "description": "Missing or inaccessible." }, "410": { "description": "Expired or withdrawn." }, "429": { "description": "Rate limited. Wait for Retry-After.", "headers": { "Retry-After": { "schema": { "type": "integer" } } } }, "503": { "description": "Access audit could not be persisted. No evidence response is released. Retry after the Retry-After delay; error code audit_unavailable.", "headers": { "Retry-After": { "schema": { "type": "integer" }, "description": "Seconds to wait before retrying." } } } } } }, "/v1/data-access/assessments/revisions/{publicationId}/controls/{controlId}": { "get": { "operationId": "getControl", "summary": "Read a control from an exact frozen assessment publication", "parameters": [ { "name": "publicationId", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "controlId", "in": "path", "required": true, "schema": { "type": "string" } } ], "security": [ { "dataAccess": [] } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AssessmentControl" } } } }, "401": { "description": "Missing, expired or revoked credentials." }, "403": { "description": "Current grant or export permission refused." }, "404": { "description": "Missing or inaccessible." }, "410": { "description": "Expired or withdrawn." }, "429": { "description": "Rate limited. Wait for Retry-After.", "headers": { "Retry-After": { "schema": { "type": "integer" } } } }, "503": { "description": "Access audit could not be persisted. No evidence response is released. Retry after the Retry-After delay; error code audit_unavailable.", "headers": { "Retry-After": { "schema": { "type": "integer" }, "description": "Seconds to wait before retrying." } } } } } }, "/v1/data-access/verification-key": { "get": { "operationId": "getVerificationKey", "summary": "Read current public publication-verification key; retain trusted keys for older publications", "parameters": [], "security": [ { "dataAccess": [] } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "properties": { "keyId": { "type": "string" }, "algorithm": { "type": "string", "enum": [ "ecdsa-p256-sha256-v1" ] }, "publicKeySha256": { "type": "string" }, "publicKeyPem": { "type": "string" } } } } } }, "401": { "description": "Missing, expired or revoked credentials." }, "403": { "description": "Current grant or export permission refused." }, "404": { "description": "Missing or inaccessible." }, "429": { "description": "Rate limited. Wait for Retry-After.", "headers": { "Retry-After": { "schema": { "type": "integer" } } } }, "503": { "description": "Access audit could not be persisted. No evidence response is released. Retry after the Retry-After delay; error code audit_unavailable.", "headers": { "Retry-After": { "schema": { "type": "integer" }, "description": "Seconds to wait before retrying." } } } } } }, "/v1/data-access/assessments": { "get": { "operationId": "listAssessments", "summary": "List retained published assessment revisions within current access", "parameters": [ { "name": "pageSize", "in": "query", "required": false, "schema": { "type": "integer", "minimum": 1, "maximum": 100, "default": 50 } }, { "name": "cursor", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "applicationId", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "frameworkId", "in": "query", "required": false, "schema": { "type": "string" } } ], "security": [ { "dataAccess": [] } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "required": [ "items", "nextCursor", "hasMore" ], "properties": { "items": { "type": "array", "items": { "$ref": "#/components/schemas/Publication" } }, "nextCursor": { "type": "string" }, "hasMore": { "type": "boolean", "description": "Continue listing with nextCursor while true; when false, poll that position later. A full final page may require one extra empty request." } } } } } }, "400": { "description": "Invalid page size or restart_listing. Cursor expires after 30 days or scope change. Follow cursors across empty pages; withdrawals reappear." }, "401": { "description": "Missing, expired or revoked credentials." }, "403": { "description": "Current grant or export permission refused." }, "404": { "description": "Missing or inaccessible." }, "429": { "description": "Rate limited. Wait for Retry-After.", "headers": { "Retry-After": { "schema": { "type": "integer" } } } }, "503": { "description": "Access audit could not be persisted. No evidence response is released. Retry after the Retry-After delay; error code audit_unavailable.", "headers": { "Retry-After": { "schema": { "type": "integer" }, "description": "Seconds to wait before retrying." } } } }, "description": "Optional applicationId and frameworkId filters apply before pagination. Cursors are bound to these filters and cannot be used on the publications endpoint. Publication ID identifies an export revision; assessmentEvaluationIds identify its saved source evaluations. Empty items does not mean passing compliance." } }, "/v1/data-access/datasets": { "get": { "operationId": "discoverDatasets", "summary": "Discover authorized applications, datasets and registered framework source availability", "description": "Without applicationId, lists permitted active applications and dataset formats. Supply an authorized applicationId to check its registered, granted framework source availability. ready_to_publish means a source is eligible for preparation, not that a publication exists or that controls pass. This read never prepares reports.", "parameters": [ { "name": "applicationId", "in": "query", "required": false, "schema": { "type": "string" } } ], "security": [ { "dataAccess": [] } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Discovery" } } } }, "401": { "description": "Invalid credentials" }, "403": { "description": "Application or export access denied" }, "429": { "description": "Rate limited; wait for Retry-After" }, "503": { "description": "Access audit could not be persisted. No evidence response is released. Retry after the Retry-After delay; error code audit_unavailable.", "headers": { "Retry-After": { "schema": { "type": "integer" }, "description": "Seconds to wait before retrying." } } } } } } }, "components": { "securitySchemes": { "dataAccess": { "type": "http", "scheme": "bearer", "bearerFormat": "JWT", "description": "Dedicated veriproof.data-access.read token. Current credentials and grants are checked on every read." } }, "schemas": { "Publication": { "type": "object", "required": [ "publicationId", "datasetId", "applicationIds", "generatedAt", "expiresAt", "availability", "files", "assessmentEvaluationIds" ], "properties": { "publicationId": { "type": "string", "format": "uuid" }, "datasetId": { "type": "string", "enum": [ "application_inventory", "runtime_oversight", "framework_assessment" ] }, "frameworkCode": { "type": "string", "nullable": true }, "applicationIds": { "type": "array", "items": { "type": "string", "format": "uuid" } }, "generatedAt": { "type": "string", "format": "date-time" }, "expiresAt": { "type": "string", "format": "date-time" }, "availability": { "type": "string", "enum": [ "available", "expired", "withdrawn" ] }, "files": { "type": "array", "items": { "type": "string", "enum": [ "manifest.json", "data.json", "report.pdf" ] } }, "assessmentEvaluationIds": { "type": "array", "items": { "type": "string" }, "description": "Saved source evaluation identities; empty for non-assessment publications." }, "correctsPublicationId": { "type": [ "string", "null" ], "format": "uuid", "description": "Earlier publication in the same integration, dataset, framework and application scope that this publication corrects. The earlier publication is preserved and is not automatically withdrawn." } } }, "Discovery": { "type": "object", "required": [ "applications", "datasets", "selectedApplicationId", "frameworks", "retentionDays", "maximumPageSize" ], "properties": { "applications": { "type": "array", "items": { "type": "object", "required": [ "applicationId", "name", "frameworkCodes" ], "properties": { "applicationId": { "type": "string", "format": "uuid" }, "name": { "type": "string" }, "frameworkCodes": { "type": "array", "items": { "type": "string" } } } } }, "datasets": { "type": "array", "items": { "type": "object", "required": [ "datasetId", "name", "schemaVersion", "formats" ], "properties": { "datasetId": { "type": "string", "enum": [ "application_inventory", "runtime_oversight", "framework_assessment" ] }, "name": { "type": "string" }, "schemaVersion": { "type": "string", "enum": [ "1" ] }, "formats": { "type": "array", "items": { "type": "string" } } } } }, "selectedApplicationId": { "type": "string", "format": "uuid", "nullable": true }, "frameworks": { "type": "array", "items": { "type": "object", "required": [ "frameworkCode", "name", "status", "reasonCode", "reportId" ], "properties": { "frameworkCode": { "type": "string" }, "name": { "type": "string" }, "status": { "type": "string", "enum": [ "reference_only", "export_not_supported", "no_saved_assessment", "source_unavailable", "ready_to_publish" ] }, "reasonCode": { "type": "string", "nullable": true }, "reportId": { "type": "string", "nullable": true } } } }, "retentionDays": { "type": "integer", "enum": [ 30 ] }, "maximumPageSize": { "type": "integer", "enum": [ 100 ] } } }, "FileDescriptor": { "type": "object", "required": [ "fileId", "contentType", "length", "sha256" ], "properties": { "fileId": { "type": "string", "enum": [ "data.json", "report.pdf" ] }, "contentType": { "type": "string", "enum": [ "application/json", "application/pdf" ] }, "length": { "type": "integer", "minimum": 0 }, "sha256": { "type": "string", "pattern": "^[0-9a-f]{64}$" } } }, "PublicationManifest": { "type": "object", "required": [ "schemaVersion", "publicationId", "datasetId", "applicationIds", "frameworkCode", "generatedAt", "expiresAt", "coverageStartInclusiveUtc", "coverageEndExclusiveUtc", "contentPolicyVersion", "sourceIdentity", "files" ], "properties": { "schemaVersion": { "type": "integer", "enum": [ 1 ] }, "publicationId": { "type": "string", "format": "uuid" }, "datasetId": { "type": "string", "enum": [ "application_inventory", "runtime_oversight", "framework_assessment" ] }, "applicationIds": { "type": "array", "items": { "type": "string", "format": "uuid" } }, "frameworkCode": { "type": "string", "nullable": true }, "generatedAt": { "type": "string", "format": "date-time" }, "expiresAt": { "type": "string", "format": "date-time" }, "coverageStartInclusiveUtc": { "type": "string", "nullable": true, "format": "date-time" }, "coverageEndExclusiveUtc": { "type": "string", "nullable": true, "format": "date-time" }, "contentPolicyVersion": { "type": "string" }, "sourceIdentity": { "type": "string" }, "files": { "type": "array", "items": { "$ref": "#/components/schemas/FileDescriptor" }, "minItems": 2, "maxItems": 2 }, "correctsPublicationId": { "type": [ "string", "null" ], "format": "uuid", "description": "Earlier publication in the same integration, dataset, framework and application scope that this publication corrects. The earlier publication is preserved and is not automatically withdrawn." } }, "description": "Decoded signed payload. Verify the original payloadBase64 bytes before parsing; do not reserialize for signature verification. Coverage end is exclusive. Expiry controls retrieval, not the validity of a customer assessment." }, "SignedManifest": { "type": "object", "required": [ "payloadBase64", "signature" ], "properties": { "payloadBase64": { "type": "string", "format": "byte" }, "signature": { "type": "object", "required": [ "algorithm", "keyId", "publicKeySha256", "value" ], "properties": { "algorithm": { "type": "string", "enum": [ "ecdsa-p256-sha256-v1" ] }, "keyId": { "type": "string" }, "publicKeySha256": { "type": "string", "pattern": "^[0-9a-f]{64}$" }, "value": { "type": "string", "format": "byte", "description": "DER-encoded ECDSA P-256/SHA-256 signature in base64." } } } } }, "AssessmentSourceVersion": { "type": "object", "required": [ "evaluationId", "controlId", "definitionVersion", "evaluatorVersion", "sourceSetDigest", "periodStartUtc", "periodEndExclusiveUtc", "evaluatedAtUtc" ], "properties": { "evaluationId": { "type": "string", "format": "uuid" }, "controlId": { "type": "string", "format": "uuid" }, "definitionVersion": { "type": "string" }, "evaluatorVersion": { "type": "string" }, "sourceSetDigest": { "type": "string" }, "periodStartUtc": { "type": "string", "format": "date-time" }, "periodEndExclusiveUtc": { "type": "string", "format": "date-time" }, "evaluatedAtUtc": { "type": "string", "format": "date-time" } } }, "AssessmentControl": { "type": "object", "required": [ "controlId", "controlCode", "controlName", "framework", "status", "assessmentPresentationState", "severity", "definitionVersion", "assessmentRecordUnavailableReason", "applicationId", "assessmentEvaluationId", "assessmentPeriodStartUtc", "assessmentPeriodEndExclusiveUtc", "assessmentArtifact", "nistAssertions", "assertionBreakdown", "organizationRequirementCount", "veriproofEvidenceCoverage" ], "properties": { "controlId": { "type": "string" }, "controlCode": { "type": "string" }, "controlName": { "type": "string" }, "framework": { "type": "string" }, "status": { "type": "string", "description": "Recorded source outcome; not a receiving-system approval. Known values include met, partial, not_met, not_applicable, no_data, and not_evaluated." }, "assessmentPresentationState": { "type": "string", "nullable": true }, "severity": { "type": "string", "nullable": true }, "definitionVersion": { "type": "string", "nullable": true }, "assessmentRecordUnavailableReason": { "type": "string", "nullable": true, "description": "An unavailable saved record must not be interpreted as a passing result. archive_missing and archive_offline identify known archive failures." }, "applicationId": { "type": "string", "nullable": true }, "assessmentEvaluationId": { "type": "string", "nullable": true, "format": "uuid" }, "assessmentPeriodStartUtc": { "type": "string", "nullable": true, "format": "date-time" }, "assessmentPeriodEndExclusiveUtc": { "type": "string", "nullable": true, "format": "date-time" }, "assessmentArtifact": { "anyOf": [ { "$ref": "#/components/schemas/NistAssessmentArtifactReference" }, { "type": "object", "nullable": true, "enum": [ null ] } ] }, "nistAssertions": { "type": "array", "items": { "$ref": "#/components/schemas/NistAssertionBreakdown" } }, "assertionBreakdown": { "type": "array", "items": { "$ref": "#/components/schemas/ComplianceAssertionBreakdown" }, "nullable": true }, "organizationRequirementCount": { "type": "integer", "minimum": 0 }, "veriproofEvidenceCoverage": { "anyOf": [ { "$ref": "#/components/schemas/AssessmentEvidenceCoverage" }, { "type": "object", "nullable": true, "enum": [ null ] } ] } }, "description": "Frozen control result within a publication revision. Null/unavailable is distinct from zero or passing. Source IDs are preserved; do not use display names as record keys." }, "AssessmentFramework": { "type": "object", "required": [ "framework", "frameworkDisplayName", "evidenceCollectionSupported", "totalControls", "metCount", "partialCount", "notMetCount", "noDataCount", "notEvaluatedCount", "organizationRequirementCount", "requirementStateCounts", "veriproofEvidenceCoverage", "controls" ], "properties": { "framework": { "type": "string" }, "frameworkDisplayName": { "type": "string" }, "evidenceCollectionSupported": { "type": "boolean" }, "totalControls": { "type": "integer", "minimum": 0 }, "metCount": { "type": "integer", "minimum": 0 }, "partialCount": { "type": "integer", "minimum": 0 }, "notMetCount": { "type": "integer", "minimum": 0 }, "noDataCount": { "type": "integer", "minimum": 0 }, "notEvaluatedCount": { "type": "integer", "minimum": 0 }, "organizationRequirementCount": { "type": "integer", "minimum": 0 }, "requirementStateCounts": { "type": "object", "additionalProperties": { "type": "integer", "minimum": 0 } }, "veriproofEvidenceCoverage": { "anyOf": [ { "$ref": "#/components/schemas/AssessmentEvidenceCoverage" }, { "type": "object", "nullable": true, "enum": [ null ] } ] }, "controls": { "type": "array", "items": { "$ref": "#/components/schemas/AssessmentControl" } } } }, "AssessmentData": { "type": "object", "required": [ "kind", "sourceVersions", "scopeApplicationIds", "totalGaps", "criticalGaps", "lastEvaluated", "frameworks", "exclusions" ], "properties": { "kind": { "type": "string", "enum": [ "saved_assessment_snapshot" ] }, "sourceVersions": { "type": "array", "items": { "$ref": "#/components/schemas/AssessmentSourceVersion" } }, "scopeApplicationIds": { "type": "array", "items": { "type": "string", "format": "uuid" } }, "totalGaps": { "type": "integer", "minimum": 0 }, "criticalGaps": { "type": "integer", "minimum": 0 }, "lastEvaluated": { "type": "string", "nullable": true, "format": "date-time" }, "frameworks": { "type": "array", "items": { "$ref": "#/components/schemas/AssessmentFramework" } }, "exclusions": { "type": "array", "items": { "type": "string" } } } }, "InventoryData": { "type": "object", "required": [ "kind", "cutoffUtc", "applications", "declaredModels", "observedActivity", "exclusions" ], "properties": { "kind": { "type": "string", "enum": [ "inventory_snapshot" ] }, "cutoffUtc": { "type": "string", "format": "date-time" }, "applications": { "type": "array", "items": { "$ref": "#/components/schemas/ApplicationEvidenceInventoryApplication" } }, "declaredModels": { "type": "array", "items": { "$ref": "#/components/schemas/ApplicationEvidenceInventoryModel" } }, "observedActivity": { "type": "array", "items": { "$ref": "#/components/schemas/ObservedActivity" } }, "exclusions": { "type": "array", "items": { "type": "string" } } }, "description": "Declared inventory and bounded observed activity. Unavailable counts remain null; this is not an incremental change feed." }, "OversightData": { "type": "object", "required": [ "kind", "recordedThroughUtc", "policyDecisionSummaries", "reviewCases", "applicationExecutionAcknowledgments", "includesEarlierUnresolvedCases", "exclusions" ], "properties": { "kind": { "type": "string", "enum": [ "oversight_snapshot" ] }, "recordedThroughUtc": { "type": "string", "format": "date-time" }, "policyDecisionSummaries": { "type": "array", "items": { "$ref": "#/components/schemas/PolicyDecisionSummary" } }, "reviewCases": { "type": "array", "items": { "$ref": "#/components/schemas/ReviewCase" } }, "applicationExecutionAcknowledgments": { "type": "array", "items": { "$ref": "#/components/schemas/ExecutionAcknowledgment" } }, "includesEarlierUnresolvedCases": { "type": "boolean" }, "exclusions": { "type": "array", "items": { "type": "string" } } }, "description": "Policy summaries, human review and application execution remain separate facts. Overlapping snapshots must not be summed as new activity." }, "PublicationData": { "type": "object", "required": [ "schemaVersion", "publicationId", "datasetId", "applicationIds", "frameworkCode", "generatedAt", "coverageStartInclusiveUtc", "coverageEndExclusiveUtc", "contentPolicyVersion", "sourceIdentity", "data" ], "properties": { "schemaVersion": { "type": "integer", "enum": [ 1 ] }, "publicationId": { "type": "string", "format": "uuid" }, "datasetId": { "type": "string", "enum": [ "application_inventory", "runtime_oversight", "framework_assessment" ] }, "applicationIds": { "type": "array", "items": { "type": "string", "format": "uuid" } }, "frameworkCode": { "type": "string", "nullable": true }, "generatedAt": { "type": "string", "format": "date-time" }, "coverageStartInclusiveUtc": { "type": "string", "nullable": true, "format": "date-time" }, "coverageEndExclusiveUtc": { "type": "string", "nullable": true, "format": "date-time" }, "contentPolicyVersion": { "type": "string" }, "sourceIdentity": { "type": "string" }, "data": { "oneOf": [ { "$ref": "#/components/schemas/InventoryData" }, { "$ref": "#/components/schemas/OversightData" }, { "$ref": "#/components/schemas/AssessmentData" } ] }, "correctsPublicationId": { "type": [ "string", "null" ], "format": "uuid", "description": "Earlier publication in the same integration, dataset, framework and application scope that this publication corrects. The earlier publication is preserved and is not automatically withdrawn." } }, "description": "Frozen data.json bytes bound by the signed manifest. expiresAt is carried in the signed manifest and publication metadata, not this envelope." }, "ApplicationEvidenceInventoryApplication": { "type": "object", "properties": { "applicationId": { "type": "string" }, "name": { "type": "string" }, "environment": { "type": "string" }, "declaredDataClassifications": { "type": "array", "items": { "type": "string" }, "nullable": true }, "criticality": { "type": "string", "nullable": true }, "autonomyLevel": { "type": "string", "nullable": true }, "productionPromotionStatus": { "type": "string", "nullable": true }, "isSuspended": { "type": "boolean" }, "reviewBlocked": { "type": "boolean" }, "lastSessionAt": { "type": "string", "format": "date-time", "nullable": true }, "updatedAt": { "type": "string", "format": "date-time" }, "frameworkCodes": { "type": "array", "items": { "type": "string" } } }, "required": [ "applicationId", "name", "environment", "declaredDataClassifications", "criticality", "autonomyLevel", "productionPromotionStatus", "isSuspended", "reviewBlocked", "lastSessionAt", "updatedAt", "frameworkCodes" ] }, "ApplicationEvidenceInventoryModel": { "type": "object", "properties": { "inventoryId": { "type": "string" }, "applicationId": { "type": "string" }, "provider": { "type": "string" }, "modelName": { "type": "string" }, "modelVersion": { "type": "string", "nullable": true }, "useCase": { "type": "string" }, "riskTier": { "type": "string" }, "accessType": { "type": "string" }, "usedForDevelopment": { "type": "boolean", "nullable": true }, "isActive": { "type": "boolean" }, "lastReviewedAt": { "type": "string", "format": "date-time", "nullable": true }, "updatedAt": { "type": "string", "format": "date-time" }, "revisionId": { "type": "string", "format": "uuid", "nullable": true }, "revisionNumber": { "type": "integer", "nullable": true }, "snapshotDigest": { "type": "string", "nullable": true } }, "required": [ "inventoryId", "applicationId", "provider", "modelName", "modelVersion", "useCase", "riskTier", "accessType", "usedForDevelopment", "isActive", "lastReviewedAt", "updatedAt", "revisionId", "revisionNumber", "snapshotDigest" ] }, "ObservedModelSourceReference": { "type": "object", "properties": { "sessionId": { "type": "string" }, "startedAtUtc": { "type": "string", "format": "date-time" }, "stepId": { "type": "string" }, "stepNumber": { "type": "integer" }, "observedAtUtc": { "type": "string", "format": "date-time" }, "archiveRevision": { "type": "integer", "format": "int64" }, "archiveDigest": { "type": "string" } }, "required": [ "sessionId", "startedAtUtc", "stepId", "stepNumber", "observedAtUtc", "archiveRevision", "archiveDigest" ] }, "NistAssertionBreakdown": { "type": "object", "properties": { "requiresAccountableReview": { "type": "boolean" }, "establishedLimitation": { "type": "string", "nullable": true }, "definitionPresentationVersion": { "type": "string", "nullable": true }, "evaluationId": { "type": "string", "format": "uuid" }, "assertionId": { "type": "string", "format": "uuid" }, "resultId": { "type": "string", "format": "uuid" }, "nistSubcategories": { "type": "array", "items": { "type": "string" } }, "assertionCode": { "type": "string" }, "assertionText": { "type": "string" }, "isMandatory": { "type": "boolean" }, "requiresOrganizationAssessment": { "type": "boolean" }, "evidenceRequirementTexts": { "type": "array", "items": { "type": "string" } }, "requirementEvidence": { "type": "array", "items": { "$ref": "#/components/schemas/NistRequirementEvidence" } }, "outcome": { "type": "string" }, "evidenceCompleteness": { "type": "string" }, "humanReviewState": { "type": "string" }, "reason": { "type": "string", "enum": [ "" ] }, "sourceReferences": { "type": "array", "items": { "$ref": "#/components/schemas/NistAssertionSourceReference" } }, "humanReview": { "anyOf": [ { "$ref": "#/components/schemas/NistAssertionHumanReview" }, { "type": "object", "nullable": true, "enum": [ null ] } ] }, "applicabilityDecision": { "anyOf": [ { "$ref": "#/components/schemas/NistApplicabilityDecisionFinding" }, { "type": "object", "nullable": true, "enum": [ null ] } ] }, "priorHumanReview": { "anyOf": [ { "$ref": "#/components/schemas/NistAssertionHumanReview" }, { "type": "object", "nullable": true, "enum": [ null ] } ] }, "safetyFinding": { "anyOf": [ { "$ref": "#/components/schemas/NistSafetyFinding" }, { "type": "object", "nullable": true, "enum": [ null ] } ] }, "transparencyFinding": { "anyOf": [ { "$ref": "#/components/schemas/NistTransparencyFinding" }, { "type": "object", "nullable": true, "enum": [ null ] } ] }, "hasRecordedContext": { "type": "boolean" }, "recordedContextRunId": { "type": "string", "nullable": true }, "recordedModelGaps": { "type": "array", "items": { "$ref": "#/components/schemas/NistRecordedModelGap" }, "maxItems": 0 }, "nextAction": { "type": "string", "nullable": true }, "availableActionDestination": { "type": "string", "nullable": true }, "availableActionText": { "type": "string", "nullable": true } }, "required": [ "requiresAccountableReview", "establishedLimitation", "definitionPresentationVersion", "evaluationId", "assertionId", "resultId", "nistSubcategories", "assertionCode", "assertionText", "isMandatory", "requiresOrganizationAssessment", "evidenceRequirementTexts", "requirementEvidence", "outcome", "evidenceCompleteness", "humanReviewState", "reason", "sourceReferences", "humanReview", "applicabilityDecision", "priorHumanReview", "safetyFinding", "transparencyFinding", "hasRecordedContext", "recordedContextRunId", "recordedModelGaps", "nextAction", "availableActionDestination", "availableActionText" ] }, "NistRequirementEvidence": { "type": "object", "properties": { "requiresOrganizationEvidence": { "type": "boolean", "nullable": true }, "customerOrganizationEvidenceIntakeUnavailable": { "type": "boolean" }, "requirementCode": { "type": "string" }, "requirementText": { "type": "string" }, "state": { "type": "string" } }, "required": [ "requiresOrganizationEvidence", "customerOrganizationEvidenceIntakeUnavailable", "requirementCode", "requirementText", "state" ] }, "NistAssertionSourceReference": { "type": "object", "properties": { "currentVerificationState": { "type": "string", "nullable": true }, "currentVerificationReason": { "type": "string", "nullable": true }, "sessionSource": { "type": "object", "nullable": true, "enum": [ null ], "description": "Excluded from this external publication." }, "type": { "type": "string" }, "id": { "type": "string" }, "version": { "type": "string" }, "digest": { "type": "string", "nullable": true }, "polarity": { "type": "string" }, "verificationState": { "type": "string" } }, "required": [ "currentVerificationState", "currentVerificationReason", "sessionSource", "type", "id", "version", "digest", "polarity", "verificationState" ] }, "NistAssertionHumanReview": { "type": "object", "properties": { "reviewId": { "type": "string", "format": "uuid" }, "reviewedControlId": { "type": "string", "format": "uuid" }, "reviewedAssertionId": { "type": "string", "format": "uuid" }, "basedOnEvaluationId": { "type": "string", "format": "uuid" }, "reviewerId": { "type": "string", "enum": [ "Authorized reviewer" ] }, "reviewerName": { "type": "string", "nullable": true, "enum": [ null ] }, "approved": { "type": "boolean" }, "decidedAt": { "type": "string", "format": "date-time" }, "rationale": { "type": "string", "enum": [ "" ] }, "snapshotDigest": { "type": "string", "nullable": true } }, "required": [ "reviewId", "reviewedControlId", "reviewedAssertionId", "basedOnEvaluationId", "reviewerId", "reviewerName", "approved", "decidedAt", "rationale", "snapshotDigest" ] }, "NistApplicabilityDecisionFinding": { "type": "object", "properties": { "revisionId": { "type": "string", "format": "uuid" }, "snapshotDigest": { "type": "string" }, "conclusion": { "type": "string" }, "rationale": { "type": "string", "enum": [ "" ] }, "reviewerName": { "type": "string", "enum": [ "Authorized reviewer" ] }, "reviewedAt": { "type": "string", "format": "date-time" } }, "required": [ "revisionId", "snapshotDigest", "conclusion", "rationale", "reviewerName", "reviewedAt" ] }, "NistSafetyFinding": { "type": "object", "properties": { "revisionId": { "type": "string", "format": "uuid" }, "basedOnEvaluationId": { "type": "string", "format": "uuid" }, "runId": { "type": "string", "format": "uuid" }, "conclusion": { "type": "string" }, "remainingGaps": { "type": "string" }, "requiredAction": { "type": "string" }, "rationale": { "type": "string", "enum": [ "" ] }, "reviewerId": { "type": "string", "enum": [ "Authorized reviewer" ] }, "reviewedAt": { "type": "string", "format": "date-time" }, "snapshotDigest": { "type": "string" } }, "required": [ "revisionId", "basedOnEvaluationId", "runId", "conclusion", "remainingGaps", "requiredAction", "rationale", "reviewerId", "reviewedAt", "snapshotDigest" ] }, "NistTransparencyFinding": { "type": "object", "properties": { "reviewRevisionId": { "type": "string", "format": "uuid" }, "reviewDigest": { "type": "string" }, "mapScopeRevisionId": { "type": "string", "format": "uuid" }, "mapScopeDigest": { "type": "string" }, "reviewerId": { "type": "string", "enum": [ "Authorized reviewer" ] }, "reviewedAt": { "type": "string", "format": "date-time" }, "reviewScope": { "type": "string" }, "rationale": { "type": "string", "enum": [ "" ] }, "risks": { "type": "array", "items": { "$ref": "#/components/schemas/NistTransparencyRiskFinding" } } }, "required": [ "reviewRevisionId", "reviewDigest", "mapScopeRevisionId", "mapScopeDigest", "reviewerId", "reviewedAt", "reviewScope", "rationale", "risks" ] }, "NistTransparencyRiskFinding": { "type": "object", "properties": { "riskId": { "type": "string" }, "statement": { "type": "string" }, "finding": { "type": "string" }, "remainingActionOrLimit": { "type": "string" } }, "required": [ "riskId", "statement", "finding", "remainingActionOrLimit" ] }, "NistRecordedModelGap": { "type": "object", "properties": { "kind": { "type": "string" }, "sessionId": { "type": "string" }, "sessionStartedAt": { "type": "string", "format": "date-time" }, "observedAt": { "type": "string", "format": "date-time" }, "archiveRevision": { "type": "string" }, "stepNumber": { "type": "integer" } }, "required": [ "kind", "sessionId", "sessionStartedAt", "observedAt", "archiveRevision", "stepNumber" ] }, "ComplianceAssertionBreakdown": { "type": "object", "properties": { "requiresAccountableReview": { "type": "boolean" }, "evaluationId": { "type": "string", "format": "uuid" }, "assertionId": { "type": "string", "format": "uuid" }, "resultId": { "type": "string", "format": "uuid" }, "assertionCode": { "type": "string" }, "assertionText": { "type": "string" }, "isMandatory": { "type": "boolean" }, "requiresOrganizationAssessment": { "type": "boolean" }, "evidenceRequirementTexts": { "type": "array", "items": { "type": "string" } }, "requirementEvidence": { "type": "array", "items": { "$ref": "#/components/schemas/ComplianceRequirementEvidence" } }, "outcome": { "type": "string" }, "evidenceCompleteness": { "type": "string" }, "humanReviewState": { "type": "string" }, "reason": { "type": "string", "enum": [ "" ] }, "sourceReferences": { "type": "array", "items": { "$ref": "#/components/schemas/ComplianceAssertionSourceReference" } }, "recordedFacts": { "type": "array", "items": { "type": "string" } }, "nextAction": { "type": "string", "nullable": true }, "nextActionRole": { "type": "string", "nullable": true }, "nextActionDestination": { "type": "string", "nullable": true }, "expectedAssessmentEffect": { "type": "string", "nullable": true } }, "required": [ "requiresAccountableReview", "evaluationId", "assertionId", "resultId", "assertionCode", "assertionText", "isMandatory", "requiresOrganizationAssessment", "evidenceRequirementTexts", "requirementEvidence", "outcome", "evidenceCompleteness", "humanReviewState", "reason", "sourceReferences", "recordedFacts", "nextAction", "nextActionRole", "nextActionDestination", "expectedAssessmentEffect" ] }, "ComplianceRequirementEvidence": { "type": "object", "properties": { "requiresOrganizationEvidence": { "type": "boolean", "nullable": true }, "customerOrganizationEvidenceIntakeUnavailable": { "type": "boolean" }, "requirementCode": { "type": "string" }, "requirementText": { "type": "string" }, "state": { "type": "string" } }, "required": [ "requiresOrganizationEvidence", "customerOrganizationEvidenceIntakeUnavailable", "requirementCode", "requirementText", "state" ] }, "ComplianceAssertionSourceReference": { "type": "object", "properties": { "displayLabel": { "type": "string", "nullable": true }, "displaySummary": { "type": "string", "nullable": true }, "sessionSource": { "type": "object", "nullable": true, "enum": [ null ], "description": "Excluded from this external publication." }, "requirementCode": { "type": "string", "nullable": true }, "ruleId": { "type": "string", "format": "uuid", "nullable": true }, "policyVersionId": { "type": "string", "format": "uuid", "nullable": true }, "policyVersionNumber": { "type": "integer", "nullable": true }, "type": { "type": "string" }, "id": { "type": "string" }, "version": { "type": "string" }, "digest": { "type": "string", "nullable": true }, "polarity": { "type": "string" }, "verificationState": { "type": "string" } }, "required": [ "sessionSource", "ruleId", "policyVersionId", "policyVersionNumber", "type", "id", "version", "digest", "polarity", "verificationState" ] }, "NistAssessmentArtifactReference": { "type": "object", "properties": { "contentSha256": { "type": "string" }, "contentVersionId": { "type": "string", "nullable": true }, "recordedAt": { "type": "string", "format": "date-time" }, "versionPinned": { "type": "boolean" } }, "required": [ "contentSha256", "contentVersionId", "recordedAt", "versionPinned" ] }, "AssessmentEvidenceCoverage": { "type": "object", "properties": { "contractVersion": { "type": "integer" }, "scopeDescription": { "type": "string" }, "status": { "type": "string" }, "percent": { "type": "number", "nullable": true }, "expectedCount": { "type": "integer" }, "completeCount": { "type": "integer" }, "missingCount": { "type": "integer" }, "invalidCount": { "type": "integer" }, "unsupportedFormatCount": { "type": "integer" }, "notApplicableCount": { "type": "integer" }, "obligations": { "type": "array", "items": { "$ref": "#/components/schemas/AssessmentEvidenceCoverageObligation" } } }, "required": [ "contractVersion", "scopeDescription", "status", "percent", "expectedCount", "completeCount", "missingCount", "invalidCount", "unsupportedFormatCount", "notApplicableCount", "obligations" ] }, "AssessmentEvidenceCoverageObligation": { "type": "object", "properties": { "id": { "type": "string" }, "label": { "type": "string" }, "status": { "type": "string" }, "reason": { "type": "string" }, "references": { "type": "array", "items": { "$ref": "#/components/schemas/AssessmentEvidenceSourceReference" } }, "queryResult": { "anyOf": [ { "$ref": "#/components/schemas/AssessmentEvidenceQueryResult" }, { "type": "object", "nullable": true, "enum": [ null ] } ] }, "applicationId": { "type": "string", "nullable": true }, "applicationName": { "type": "string", "nullable": true }, "assessmentPeriodStartUtc": { "type": "string", "format": "date-time", "nullable": true }, "assessmentPeriodEndExclusiveUtc": { "type": "string", "format": "date-time", "nullable": true }, "assessmentFromDate": { "type": "string", "format": "date", "nullable": true }, "assessmentToDate": { "type": "string", "format": "date", "nullable": true } }, "required": [ "id", "label", "status", "reason", "references", "queryResult" ] }, "AssessmentEvidenceSourceReference": { "type": "object", "properties": { "sourceType": { "type": "string" }, "sourceId": { "type": "string" }, "sourceVersion": { "type": "string" }, "digest": { "type": "string", "nullable": true }, "verificationState": { "type": "string" }, "unavailableReason": { "type": "string", "nullable": true }, "polarity": { "type": "string", "nullable": true }, "evidenceRequirementId": { "type": "string", "format": "uuid", "nullable": true }, "sessionInspection": { "anyOf": [ { "$ref": "#/components/schemas/AssessmentSessionInspection" }, { "type": "object", "nullable": true, "enum": [ null ] } ] } }, "required": [ "sourceType", "sourceId", "sourceVersion", "verificationState" ] }, "AssessmentSessionInspection": { "type": "object", "properties": { "applicationId": { "type": "string" }, "sessionId": { "type": "string" }, "startedAt": { "type": "string", "format": "date-time" } }, "required": [ "applicationId", "sessionId", "startedAt" ] }, "AssessmentEvidenceQueryResult": { "type": "object", "properties": { "queryCode": { "type": "string" }, "queryVersion": { "type": "string" }, "scopeDigest": { "type": "string" }, "candidateCount": { "type": "integer", "format": "int64", "nullable": true }, "selectedCount": { "type": "integer", "nullable": true }, "inspectedCount": { "type": "integer", "nullable": true }, "limit": { "type": "integer", "nullable": true }, "populationCount": { "type": "integer", "format": "int64", "nullable": true } }, "required": [ "queryCode", "queryVersion", "scopeDigest" ] }, "ObservedDeclaration": { "type": "object", "required": [ "inventoryId", "revisionId", "revisionNumber", "snapshotDigest", "recordedAtUtc" ], "properties": { "inventoryId": { "type": "string" }, "revisionId": { "type": "string", "format": "uuid" }, "revisionNumber": { "type": "integer" }, "snapshotDigest": { "type": "string" }, "recordedAtUtc": { "type": "string", "format": "date-time" } } }, "ObservedModel": { "type": "object", "required": [ "provider", "model", "environment", "reportedVersion", "calls", "firstObservedUtc", "lastObservedUtc", "matchStatus", "declaredInventoryId", "sourceReferences", "declaration" ], "properties": { "provider": { "type": "string", "nullable": true }, "model": { "type": "string", "nullable": true }, "environment": { "type": "string", "nullable": true }, "reportedVersion": { "type": "string", "nullable": true }, "calls": { "type": "integer", "format": "int64" }, "firstObservedUtc": { "type": "string", "format": "date-time" }, "lastObservedUtc": { "type": "string", "format": "date-time" }, "matchStatus": { "type": "string" }, "declaredInventoryId": { "type": "string", "nullable": true }, "sourceReferences": { "type": "array", "items": { "$ref": "#/components/schemas/ObservedModelSourceReference" } }, "declaration": { "anyOf": [ { "$ref": "#/components/schemas/ObservedDeclaration" }, { "type": "object", "nullable": true, "enum": [ null ] } ] } } }, "ObservedActivity": { "type": "object", "required": [ "applicationId", "periodStartUtc", "periodEndExclusiveUtc", "declarationCutoffUtc", "unavailableReason", "verifiedIndexedCalls", "missingModel", "missingProvider", "locatorMutationEpoch", "availability", "models" ], "properties": { "applicationId": { "type": "string" }, "periodStartUtc": { "type": "string", "format": "date-time" }, "periodEndExclusiveUtc": { "type": "string", "format": "date-time" }, "declarationCutoffUtc": { "type": "string", "format": "date-time", "nullable": true }, "unavailableReason": { "type": "string", "nullable": true }, "verifiedIndexedCalls": { "type": "integer", "format": "int64", "nullable": true }, "missingModel": { "type": "integer", "format": "int64", "nullable": true }, "missingProvider": { "type": "integer", "format": "int64", "nullable": true }, "locatorMutationEpoch": { "type": "integer", "format": "int64", "nullable": true }, "availability": { "type": "string", "enum": [ "available", "unavailable" ] }, "models": { "type": "array", "items": { "$ref": "#/components/schemas/ObservedModel" } } } }, "PolicyDecisionPublicExplanation": { "type": "object", "properties": { "code": { "type": "string" }, "templateVersion": { "type": "integer" }, "explanation": { "type": "string" } }, "required": [ "code", "templateVersion", "explanation" ] }, "PolicyDecisionSummary": { "type": "object", "required": [ "applicationId", "action", "count", "latestDecidedAt", "publicExplanation" ], "properties": { "applicationId": { "type": "string" }, "action": { "type": "string" }, "count": { "type": "integer" }, "latestDecidedAt": { "type": "string", "format": "date-time" }, "publicExplanation": { "$ref": "#/components/schemas/PolicyDecisionPublicExplanation" } } }, "ReviewDecision": { "type": "object", "required": [ "reviewId", "reviewerRole", "reviewSource", "decisionSurface", "authMethod", "reviewedAt" ], "properties": { "reviewId": { "type": "string", "format": "uuid" }, "reviewerRole": { "type": "string", "nullable": true }, "reviewSource": { "type": "string" }, "decisionSurface": { "type": "string", "nullable": true }, "authMethod": { "type": "string", "nullable": true }, "reviewedAt": { "type": "string", "format": "date-time" } } }, "ReviewCase": { "type": "object", "required": [ "reviewCaseId", "applicationId", "isSyntheticSetup", "caseVersion", "decisionOutcome", "decisionVersion", "createdAt", "dueAtUtc", "expiresAt", "cancelledAt", "decision" ], "properties": { "reviewCaseId": { "type": "string" }, "applicationId": { "type": "string" }, "isSyntheticSetup": { "type": "boolean" }, "caseVersion": { "type": "integer", "format": "int64" }, "decisionOutcome": { "type": "string", "nullable": true }, "decisionVersion": { "type": "integer", "format": "int64", "nullable": true }, "createdAt": { "type": "string", "format": "date-time" }, "dueAtUtc": { "type": "string", "format": "date-time" }, "expiresAt": { "type": "string", "format": "date-time" }, "cancelledAt": { "type": "string", "format": "date-time", "nullable": true }, "decision": { "anyOf": [ { "$ref": "#/components/schemas/ReviewDecision" }, { "type": "object", "nullable": true, "enum": [ null ] } ] } } }, "ExecutionAcknowledgment": { "type": "object", "required": [ "acknowledgmentId", "reviewCaseId", "applicationId", "decisionVersion", "state", "applicationAcknowledgedAt", "recordedAt" ], "properties": { "acknowledgmentId": { "type": "string" }, "reviewCaseId": { "type": "string" }, "applicationId": { "type": "string" }, "decisionVersion": { "type": "integer", "format": "int64" }, "state": { "type": "string" }, "applicationAcknowledgedAt": { "type": "string", "format": "date-time" }, "recordedAt": { "type": "string", "format": "date-time" } } } } } }