Reads the audit rows that stand behind one control, over a window.
Reads the audit rows that stand behind one control, over a window.
GET /v1/trust/evidence
| Address | https://api.hanzo.ai/v1/trust/evidence |
| Method | GET |
| Operation | get_trust_evidence |
| Auth | Authorization: Bearer $HANZO_API_KEY |
Reads the audit rows that stand behind one control, over a window.
The inventory decides what evidences what: a control names the audit actions that are its trail, and this resolves the control id to those actions and reads them. So evidence cannot drift from the inventory, and it is scoped to your own organization — the query carries no organization field for a caller to fill in.
A control that nothing in the trail evidences says so plainly rather than answering an empty page, because an empty page reads like a clean quarter. A deployment with no audit store answers 501 and says the trail was not read, for the same reason.
Request
4 fields.
| Field | In | Type | Required | Description |
|---|---|---|---|---|
control | query | string | — | Control is the control id whose trail to read. |
from | query | string | — | From is the inclusive lower bound, an RFC 3339 date or instant ("2026-01-01" or "2026-01-01T00:00:00Z"). Empty leaves it unbounded. |
to | query | string | — | To is the upper bound, same form and same tolerance. |
limit | query | string | — | Limit caps the rows returned, 1..1000, default 100. |
Response
| Status | Body | Meaning |
|---|---|---|
200 | ok |
200 body — 1 field.
| Field | In | Type | Always | Description |
|---|---|---|---|---|
(body) | body | any | yes |
Failure carries the platform error shape — see Errors.
Examples
hanzo has no subcommand for this operation — the CLI serves only what cloud's live route table confirms. Use HTTP or an SDK.
import { Configuration, TrustApi } from 'hanzoai';
const api = new TrustApi(new Configuration({ accessToken: process.env.HANZO_API_KEY }));
const { data } = await api.getTrustEvidence();from hanzoai.cloud import ApiClient, Configuration
from hanzoai.cloud.api import TrustApi
client = ApiClient(Configuration(access_token=os.environ["HANZO_API_KEY"]))
result = TrustApi(client).get_trust_evidence()cfg := cloud.NewConfiguration()
cfg.AddDefaultHeader("Authorization", "Bearer "+os.Getenv("HANZO_API_KEY"))
client := cloud.NewAPIClient(cfg)
resp, _, err := client.TrustAPI.GetTrustEvidence(context.Background()).Execute()
if err != nil {
return err
}use hanzo_cloud::apis::{configuration::Configuration, trust_api};
let mut cfg = Configuration::new();
cfg.bearer_access_token = std::env::var("HANZO_API_KEY").ok();
let result = trust_api::get_trust_evidence(&cfg, Default::default()).await?;import ai.hanzo.cloud.ApiClient;
import ai.hanzo.cloud.api.TrustApi;
ApiClient client = new ApiClient();
client.setRequestInterceptor(b -> b.header("Authorization", "Bearer " + System.getenv("HANZO_API_KEY")));
var result = new TrustApi(client).getTrustEvidence();The method above is the one at the current release of the document. [email protected] (npm) and [email protected] (PyPI) were generated from an earlier release, where this operation carried a different id, so it spells the method differently — regenerating the clients is what makes the two agree. SDKs →
curl https://api.hanzo.ai/v1/trust/evidence \
-H "Authorization: Bearer $HANZO_API_KEY"The door declares no tool for trust — tools/list on https://api.hanzo.ai/v1/mcp names the products it does reach. Use HTTP or an SDK.
How is this guide?