List owner-visible evidence declarations

GET

/katara/v1/orgs/{org_id}/promotion-evidence/declarations

const url = 'https://api.katara.com/katara/v1/orgs/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/promotion-evidence/declarations?source_environment_id=2489E9AD-2EE2-8E00-8EC9-32D5F69181C0&destination_environment_id=2489E9AD-2EE2-8E00-8EC9-32D5F69181C0&limit=25';
const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request GET \
  --url 'https://api.katara.com/katara/v1/orgs/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/promotion-evidence/declarations?source_environment_id=2489E9AD-2EE2-8E00-8EC9-32D5F69181C0&destination_environment_id=2489E9AD-2EE2-8E00-8EC9-32D5F69181C0&limit=25' \
  --header 'Authorization: Bearer <token>'

Lists at most 25 historical metadata rows created by the current human owner in the selected Test/Live pair and current Test reset generation. A signed-in human session and current owner authority in both environments are required. Does not return documents, content references, scores or request bodies. Expired or unavailable underlying evidence may still have directory metadata; opening a full record independently rechecks current evidence authority. The encrypted cursor binds both authorities, caller session and record kind, expires after 15 minutes, and may become invalid after service restart. Duplicate and unknown query parameters are rejected. Responses are no-store.

Authorizations

sessionBearer
sessionCookie

Parameters

Path Parameters

org_id

required

string format: uuid

/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/

Allowed value: 00000000-0000-0000-0000-000000000000

Header Parameters

X-Katara-Account-ID

string format: uuid

/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/

Required for cookie-authenticated changes. Use the UUID of the account that loaded the application. A different current cookie account returns account_changed before the handler runs. Session bearer and API key clients do not require this header.

Query Parameters

source_environment_id

required

string format: uuid

/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/

Allowed value: 00000000-0000-0000-0000-000000000000

destination_environment_id

required

string format: uuid

/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/

Allowed value: 00000000-0000-0000-0000-000000000000

limit

integer

default: 25 >= 1 <= 25

after

string

>= 1 characters <= 1024 characters

Responses

200

Successful request

application/json

Historical identifiers and state metadata under current paired owner authority, not proof of current evidence validity or publication readiness.

object

source

required

object

org_id

required

string format: uuid

/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/

Allowed value: 00000000-0000-0000-0000-000000000000

environment_id

required

string format: uuid

/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/

Allowed value: 00000000-0000-0000-0000-000000000000

mode

required

Allowed value: test

organization_epoch

required

integer

>= 1 <= 9007199254740991

authority_epoch

required

integer

>= 1 <= 9007199254740991

reset_generation

required

integer

>= 1 <= 9007199254740991

destination

required

object

org_id

required

string format: uuid

/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/

Allowed value: 00000000-0000-0000-0000-000000000000

environment_id

required

string format: uuid

/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/

Allowed value: 00000000-0000-0000-0000-000000000000

mode

required

Allowed value: live

organization_epoch

required

integer

>= 1 <= 9007199254740991

authority_epoch

required

integer

>= 1 <= 9007199254740991

reset_generation

required

integer

>= 1 <= 9007199254740991

kind

required

Allowed values: declaration preview receipt

data

required

Array<object>

<= 25 items

object

required

string format: uuid

/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/

Allowed value: 00000000-0000-0000-0000-000000000000

integrity

required

string

/^sha256:[a-f0-9]{64}$/

declaration_id

required

string format: uuid

/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/

Allowed value: 00000000-0000-0000-0000-000000000000

preview_id

required

Any of:

string
null

string format: uuid

/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/

Allowed value: 00000000-0000-0000-0000-000000000000

created_by

required

string format: uuid

/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/

Allowed value: 00000000-0000-0000-0000-000000000000

created_at

required

string format: date-time

state

required

Allowed values: insufficient_evidence criteria_failed criteria_met human_approved

expires_at

required

Any of:

string
null

string format: date-time

next_cursor

string

>= 1 characters <= 1024 characters /^[A-Za-z0-9_-]+$/

Example

{
  "source": {
    "mode": "test"
  },
  "destination": {
    "mode": "live"
  },
  "kind": "declaration",
  "data": [
    {
      "state": null
    }
  ]
}

Headers

Cache-Control

string

Allowed value: no-store

409

Account_changed: reload and review with the signed-in account.

default

Request error

application/json

object

error

required

object

message

required

string

>= 1 characters <= 500 characters

type

required

string

>= 1 characters <= 100 characters

code

required

Stable; branch on it. Any operation can answer invalid_request, with param naming the refused field when there is one; human_session_required, when an API key, service account or workload calls an operation only a signed-in person may perform; reauthentication_required, when a person’s sign-in is too old for the operation; permission_denied; route_not_found and method_not_allowed, when no operation matches the path or method; and feature_unavailable, when the operation’s service is not enabled on this deployment.

string

>= 1 characters <= 100 characters

param

required

The request field a refusal is about, such as the agent_id or run_id query parameter; null when the refusal is not about one field.

string | null

request_id

required

string

>= 1 characters <= 100 characters

upstream_status

required

integer | null

action

Allowed values: sign_in reauthenticate request_access review fund retry reconcile refresh support

operation_id

string format: uuid

/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/

Allowed value: 00000000-0000-0000-0000-000000000000

snapshot_ref

string format: uuid

/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/

Allowed value: 00000000-0000-0000-0000-000000000000

Example

{
  "error": {
    "action": "sign_in"
  }
}