Create an evidence bundle

POST/v1/trust/evidence-exports

Create an evidence bundle.

Starts building a signed evidence bundle for the period and answers 202 with the export in PENDING; poll GET /v1/trust/evidence-exports/{id} until it is READY (or FAILED), then download the zip. The bundle holds the period's sub-processor, data handling, guardrail coverage and change reports, the configuration audit trails (virtual keys, routing configs, guardrails, prompts, MCP, Trust Pack) and the metadata of the requests logged in the region that builds the bundle (at most 50,000 rows each), plus a readable report.html. manifest.json records each file's SHA-256 and size and is signed with Ed25519 (manifest.sig); verify it against the key from GET /v1/public/trust/evidence-signing-key. A ready bundle is kept for 30 days, then deleted (EXPIRED).

The body is optional: without it the period is the 90 days up to now. The period can be at most 366 days long. Requires an organization owner or admin and the Trust Pack controls in the plan. One bundle is built at a time per organization.

Errors: 400 when start_time is not before end_time or the period is longer than 366 days; 402 when the plan does not include the Trust Pack controls; 403 for a caller who is not an organization owner or admin; 409 while another bundle for the organization is pending or running; 503 when evidence bundles are not available on this deployment (no signing key or file storage).

Authorization

AuthorizationBearer va_
A platform API key (va_...), created under Settings > API keys. Scoped to an organization or one workspace, with an admin or member role. Used by the management API.

Query parameters

organizationstringrequired
the organization slug

Request body application/json

the period to cover (optional)

start_timestring<date-time>
Start of the period (ISO 8601 date-time). Default: 90 days before end_time.
end_timestring<date-time>
End of the period (ISO 8601 date-time). Default: now.

Responses

200application/json

idstring<uuid>
The bundle id (UUID).
organizationstring
The organization slug.
statusenum<string>
Where the bundle is in its life. PENDING: accepted, not started. RUNNING: being built. READY: built and signed, downloadable until expires_at. FAILED: could not be built; error says why. EXPIRED: past its retention, the zip has been deleted.
One of "PENDING", "RUNNING", "READY", "FAILED", "EXPIRED"
start_timestring<date-time>
Start of the period the bundle covers (ISO 8601 date-time).
end_timestring<date-time>
End of the period the bundle covers (ISO 8601 date-time).
errorstring
Why the bundle could not be built; FAILED only.
file_namestring
The zip's file name, evidence-{organization}-{start date}-{end date}.zip (dates in UTC).
sha256string
SHA-256 of the zip file, hex; set once READY.
bytesinteger<int64>
Size of the zip file in bytes; set once READY.
key_idstring
Id of the key that signed the bundle; set once READY. The public key is at GET /v1/public/trust/evidence-signing-key.
regionstring
The AWS region that built the bundle; set once READY.
created_bystring
Who started the export: the user id, or api-key:{key id} for a platform API key.
created_atstring<date-time>
When the export was requested (ISO 8601 date-time).
completed_atstring<date-time>
When the bundle was built (ISO 8601 date-time); absent until then.
expires_atstring<date-time>
When the zip is deleted and the bundle becomes EXPIRED (ISO 8601 date-time), 30 days after it was built; absent until READY.
download_pathstring
Path to download the zip, relative to the API base URL; READY only.

Request

curl -X POST "https://api.vectoraxis.ai/v1/trust/evidence-exports?organization=string" \
  -H "Authorization: Bearer $VECTORAXIS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "start_time": "2026-01-15T09:30:00Z",
  "end_time": "2026-01-15T09:30:00Z"
}'

VectorAxis is built by GK Labs, a member of NVIDIA Inception.