> ## Documentation Index > Fetch the complete documentation index at: https://evalgate.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Create proof exports > Requires scopes: eval:read ## OpenAPI ````yaml /api-reference/openapi.json post /api/proof/risks-and-controls/exports openapi: 3.1.2 info: title: EvalGate API version: 18.13.0 description: EvalGate API. See docs/api-contract.md for stability commitments. servers: - url: https://evalgate.com description: Production - url: http://localhost:3000 description: Local security: [] paths: /api/proof/risks-and-controls/exports: post: tags: - proof summary: Create proof exports description: 'Requires scopes: eval:read' operationId: post_proof_risks_and_controls_exports requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/PostApiProofRisksAndControlsExportsRequest' responses: '201': description: Successful response content: application/json: schema: $ref: >- #/components/schemas/PostApiProofRisksAndControlsExportsResponse201ApplicationJson application/vnd.openxmlformats-officedocument.spreadsheetml.sheet: schema: $ref: >- #/components/schemas/PostApiProofRisksAndControlsExportsResponse201ApplicationVndOpenxmlformatsOfficedocumentSpreadsheetmlSheet '400': $ref: '#/components/responses/ValidationError' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '404': $ref: '#/components/responses/NotFound' '409': $ref: '#/components/responses/Conflict' '429': $ref: '#/components/responses/RateLimited' '500': $ref: '#/components/responses/InternalError' '503': $ref: '#/components/responses/ServiceUnavailable' security: - bearerAuth: [] components: schemas: PostApiProofRisksAndControlsExportsRequest: type: object properties: scopeLabel: type: string format: oneOf: - type: string enum: - json - type: string enum: - xlsx controlId: type: number riskId: type: number additionalProperties: false required: - scopeLabel PostApiProofRisksAndControlsExportsResponse201ApplicationJson: type: object properties: xlsx: type: 'null' filename: type: 'null' export: type: object properties: controlId: oneOf: - type: 'null' - type: number excludedNote: type: string exportedAt: type: string format: date-time exportedBy: type: string id: type: number organizationId: $ref: '#/components/schemas/OrganizationId' riskId: oneOf: - type: 'null' - type: number scopeLabel: type: string snapshot: type: object additionalProperties: $ref: '#/components/schemas/JsonValue' additionalProperties: false required: - controlId - excludedNote - exportedAt - exportedBy - id - organizationId - riskId - scopeLabel - snapshot snapshot: type: object properties: scopeLabel: type: string exportedAt: type: string control: oneOf: - type: 'null' - type: object properties: id: type: number title: type: string intendedBehavior: type: string acceptanceCriteria: type: string failureHandling: type: string boundaryNote: type: string frequencyOrTrigger: type: string assuranceControlId: oneOf: - type: 'null' - type: number reviewerUserId: oneOf: - type: 'null' - type: string status: type: string additionalProperties: false required: - id - title - intendedBehavior - acceptanceCriteria - failureHandling - boundaryNote - frequencyOrTrigger - assuranceControlId - reviewerUserId - status projectMappingsTruncated: type: boolean controlProfilesTruncated: type: boolean controlProfiles: type: array items: type: object properties: id: type: string controlId: type: number version: type: number basisDigest: type: string basis: allOf: - type: object properties: scope: oneOf: - type: object properties: kind: type: string enum: - organization additionalProperties: false required: - kind - type: object properties: kind: type: string enum: - system aiSystemId: type: number systemVersionId: oneOf: - type: 'null' - type: number additionalProperties: false required: - kind - aiSystemId - systemVersionId applicability: oneOf: - type: string enum: - applies - type: string enum: - not_applicable - type: string enum: - unknown applicabilityRationale: type: string context: type: object properties: domain: oneOf: - type: 'null' - type: string riskTier: oneOf: - type: string enum: - critical - type: string enum: - high - type: string enum: - low - type: string enum: - medium - type: string enum: - unknown organizationalRole: oneOf: - type: 'null' - type: string intendedUse: oneOf: - type: 'null' - type: string affectedPeople: oneOf: - type: 'null' - type: string dataSensitivity: oneOf: - type: 'null' - type: string autonomy: oneOf: - type: 'null' - type: string lifecycleStage: oneOf: - type: 'null' - type: string environment: oneOf: - type: 'null' - type: string consequences: oneOf: - type: 'null' - type: string productContextHash: oneOf: - type: 'null' - type: string additionalProperties: false required: - domain - riskTier - organizationalRole - intendedUse - affectedPeople - dataSensitivity - autonomy - lifecycleStage - environment - consequences - productContextHash sources: type: array items: type: object properties: sourceType: oneOf: - type: string enum: - contract_requirement - type: string enum: - draft - type: string enum: - guidance - type: string enum: - organizational_policy - type: string enum: - reference_control - type: string enum: - standards_requirement issuer: type: string documentIdentifier: type: string edition: type: string title: type: string publicationStatus: oneOf: - type: string enum: - DRAFT - type: string enum: - FINAL - type: string enum: - INITIAL_PUBLIC_DRAFT - type: string enum: - SUPERSEDED - type: string enum: - WITHDRAWN verificationState: oneOf: - type: string enum: - INTERNALLY_ASSERTED - type: string enum: - UNVERIFIED locator: oneOf: - type: 'null' - type: string sourceRevision: oneOf: - type: 'null' - type: string sourceDigest: oneOf: - type: 'null' - type: string sourceUrl: oneOf: - type: 'null' - type: string license: oneOf: - type: 'null' - type: string attribution: oneOf: - type: 'null' - type: string relationship: oneOf: - type: string enum: - informs - type: string enum: - organization_authored - type: string enum: - related - type: string enum: - supports mappingRationale: type: string additionalProperties: false required: - sourceType - issuer - documentIdentifier - edition - title - publicationStatus - verificationState - locator - sourceRevision - sourceDigest - sourceUrl - license - attribution - relationship - mappingRationale assessmentMethods: type: array items: oneOf: - type: string enum: - adversarial_probe - type: string enum: - configuration_review - type: string enum: - deterministic_assertion - type: string enum: - human_evidence_review - type: string enum: - provenance_artifact_review - type: string enum: - resilience_exercise - type: string enum: - trace_telemetry_requirement implementation: type: array items: type: object properties: kind: oneOf: - type: string enum: - approval - type: string enum: - code - type: string enum: - configuration - type: string enum: - dataset - type: string enum: - deployment - type: string enum: - document - type: string enum: - supplier - type: string enum: - trace label: type: string ref: type: string revision: type: string url: oneOf: - type: 'null' - type: string additionalProperties: false required: - kind - label - ref - revision - url dependencies: type: array items: type: object properties: kind: oneOf: - type: string enum: - configuration - type: string enum: - dataset - type: string enum: - dependency - type: string enum: - environment - type: string enum: - judge - type: string enum: - model - type: string enum: - policy - type: string enum: - prompt - type: string enum: - provider - type: string enum: - repository_commit - type: string enum: - retriever - type: string enum: - system_version - type: string enum: - tool_schema ref: type: string revision: type: string additionalProperties: false required: - kind - ref - revision parent: oneOf: - type: 'null' - type: object properties: profileId: type: string digest: type: string additionalProperties: false required: - profileId - digest exceptionRationale: oneOf: - type: 'null' - type: string additionalProperties: false required: - scope - applicability - applicabilityRationale - context - sources - assessmentMethods - implementation - dependencies - parent - exceptionRationale - type: object properties: schemaVersion: oneOf: - type: string enum: - evalgate.control-profile.v1 - type: string enum: - evalgate.control-profile.v2 controlId: type: number controlWriteRevision: type: number requirementBasis: type: object properties: material: type: object properties: intendedBehavior: type: string acceptanceCriteria: type: string frequencyOrTrigger: type: string boundaryNote: type: string failureHandling: type: string aiSystemId: oneOf: - type: 'null' - type: number assuranceControlId: oneOf: - type: 'null' - type: number responsibleUserId: oneOf: - type: 'null' - type: string linkedRequirement: oneOf: - type: 'null' - type: object properties: id: type: number version: type: number requirementText: type: string acceptanceCriteria: $ref: '#/components/schemas/JsonValue' state: type: string status: type: string evalProgramIds: type: array items: type: number policyGateIds: type: array items: type: number additionalProperties: false required: - id - version - requirementText - acceptanceCriteria - state - status - evalProgramIds - policyGateIds additionalProperties: false required: - intendedBehavior - acceptanceCriteria - frequencyOrTrigger - boundaryNote - failureHandling - aiSystemId - assuranceControlId - responsibleUserId - linkedRequirement digest: type: string additionalProperties: false required: - material - digest additionalProperties: false required: - schemaVersion - controlId - controlWriteRevision basisIsRedactedPresentation: type: boolean status: oneOf: - type: string enum: - accepted - type: string enum: - pending - type: string enum: - rejected basisCurrency: oneOf: - type: string enum: - current - type: string enum: - stale - type: string enum: - unverified currencyReasons: type: array items: type: string createdBy: type: string reviewedBy: oneOf: - type: 'null' - type: string reviewedAt: oneOf: - type: 'null' - type: string rationale: type: string currentEvidenceCredit: type: string effectivenessEstablished: type: boolean releaseAuthorized: type: boolean additionalProperties: false required: - id - controlId - version - basisDigest - basis - basisIsRedactedPresentation - status - basisCurrency - currencyReasons - createdBy - reviewedBy - reviewedAt - rationale - currentEvidenceCredit - effectivenessEstablished - releaseAuthorized projectMappings: type: array items: type: object properties: id: type: string repositoryId: type: number graphVersionId: type: string findingId: type: string basisDigest: type: string headSha: type: string controlId: oneOf: - type: 'null' - type: number riskId: oneOf: - type: 'null' - type: number reviewedBy: oneOf: - type: 'null' - type: string reviewedAt: oneOf: - type: 'null' - type: string rationale: type: string sourceReferences: type: array items: type: object properties: id: type: string startLine: oneOf: - type: 'null' - type: number endLine: oneOf: - type: 'null' - type: number commitSha: type: string path: type: string additionalProperties: false required: - id - startLine - endLine - commitSha - path candidateAssociations: type: array items: type: object properties: nodeId: type: string type: type: string claim: type: string relation: type: string externalIdentity: oneOf: - type: 'null' - type: object properties: domain: type: string id: type: string version: type: string additionalProperties: false required: - domain - id label: type: string additionalProperties: false required: - nodeId - type - claim - relation - externalIdentity - label limitations: type: array items: type: string effectivenessEstablished: type: boolean additionalProperties: false required: - id - repositoryId - graphVersionId - findingId - basisDigest - headSha - controlId - riskId - reviewedBy - reviewedAt - rationale - sourceReferences - candidateAssociations - limitations - effectivenessEstablished links: type: array items: type: object properties: riskId: type: number controlId: type: number rationale: type: string limitations: type: string additionalProperties: false required: - riskId - controlId - rationale - limitations safeguards: type: array items: type: object properties: bindingId: type: string kind: type: string title: type: string activationState: type: string implementationKey: type: string configurationRevision: type: string supportsCriterion: type: string limitations: type: string additionalProperties: false required: - bindingId - kind - title - activationState - implementationKey - configurationRevision - supportsCriterion - limitations evidenceRequests: type: array items: type: object properties: id: type: number criterion: type: string environment: type: string periodLabel: type: string status: type: string acceptedForRequirementDoesNotImplyControlEffective: type: boolean submissions: type: array items: type: object properties: id: type: number revision: type: number submitterUserId: oneOf: - type: 'null' - type: string submitterKind: type: string guestInviteId: oneOf: - type: 'null' - type: number status: type: string supersedesSubmissionId: oneOf: - type: 'null' - type: number createdAt: type: string explanation: type: string reviewerNote: type: string items: type: array items: type: object properties: evidenceItemId: type: number claimScope: type: string claimedApplicability: type: string establishedEnvironment: oneOf: - type: 'null' - type: string provenanceState: type: string environmentMismatch: type: boolean unknownProvenance: type: boolean provenanceWarning: oneOf: - type: 'null' - type: string evidenceKind: oneOf: - type: 'null' - type: string evidenceSource: oneOf: - type: 'null' - type: string evidenceSubjectType: oneOf: - type: 'null' - type: string evidencePreview: $ref: '#/components/schemas/JsonValue' evidenceHref: oneOf: - type: 'null' - type: string relationshipRationale: type: string limitations: type: string additionalProperties: false required: - evidenceItemId - claimScope - claimedApplicability - establishedEnvironment - provenanceState - environmentMismatch - unknownProvenance - provenanceWarning - evidenceKind - evidenceSource - evidenceSubjectType - evidencePreview - evidenceHref - relationshipRationale - limitations additionalProperties: false required: - id - revision - submitterUserId - status - supersedesSubmissionId - createdAt - explanation - reviewerNote - items additionalProperties: false required: - id - criterion - environment - periodLabel - status - acceptedForRequirementDoesNotImplyControlEffective - submissions conclusions: type: array items: type: object properties: id: type: number dimension: type: string verdict: type: string rationale: type: string limitations: type: string scopeNote: type: string status: type: string configurationRevisionSnapshot: oneOf: - type: 'null' - type: string evidenceSubmissionIds: type: array items: type: number safeguardBindingIds: type: array items: type: string materialSnapshot: type: object additionalProperties: $ref: '#/components/schemas/JsonValue' decidedBy: type: string decidedAt: type: string additionalProperties: false required: - id - dimension - verdict - rationale - limitations - scopeNote - status - configurationRevisionSnapshot - evidenceSubmissionIds - safeguardBindingIds - materialSnapshot - decidedBy - decidedAt findings: type: array items: type: object properties: id: type: number failedCriterion: type: string description: type: string status: type: string remediationOwnerUserId: oneOf: - type: 'null' - type: string retestEvidenceSubmissionId: oneOf: - type: 'null' - type: number closeRationale: type: string additionalProperties: false required: - id - failedCriterion - description - status - remediationOwnerUserId - retestEvidenceSubmissionId - closeRationale riskAcceptances: type: array items: type: object properties: id: type: number riskId: type: number findingId: oneOf: - type: 'null' - type: number rationale: type: string status: type: string expiresAt: type: string doesNotConvertFailedTestsToPasses: type: boolean additionalProperties: false required: - id - riskId - findingId - rationale - status - expiresAt - doesNotConvertFailedTestsToPasses requestCount: type: number additionalProperties: false required: - scopeLabel - exportedAt - control - projectMappingsTruncated - controlProfilesTruncated - controlProfiles - projectMappings - links - safeguards - evidenceRequests - conclusions - findings - riskAcceptances - requestCount excludedNote: type: string format: type: string enum: - json additionalProperties: false required: - export - snapshot - excludedNote - format PostApiProofRisksAndControlsExportsResponse201ApplicationVndOpenxmlformatsOfficedocumentSpreadsheetmlSheet: type: string format: binary OrganizationId: type: string format: uuid JsonValue: oneOf: - type: 'null' - type: boolean - type: number - type: string - type: array items: $ref: '#/components/schemas/JsonValue' - type: object additionalProperties: $ref: '#/components/schemas/JsonValue' ApiError: type: object properties: error: type: object properties: code: type: string enum: - UNAUTHORIZED - FORBIDDEN - NOT_FOUND - INVALID_REFERENCE - VALIDATION_ERROR - RATE_LIMITED - CONFLICT - INTERNAL_ERROR - SERVICE_UNAVAILABLE - QUOTA_EXCEEDED - FEATURE_LIMIT_REACHED - NO_ORG_MEMBERSHIP - SHARE_REVOKED - SHARE_EXPIRED - SHARE_UNAVAILABLE - PROVIDER_KEY_MISSING - PROVIDER_KEY_EXPIRED - PROVIDER_RATE_LIMITED - PROVIDER_UNAUTHORIZED - PROVIDER_UNAVAILABLE - AGENT_HANDOFF_INVALID - AGENT_HANDOFF_EXPIRED - AGENT_HANDOFF_DENIED - AGENT_HANDOFF_CONSUMED - PAYLOAD_TOO_LARGE - METHOD_NOT_ALLOWED message: type: string details: {} requestId: type: string format: uuid redaction: type: object properties: applied: type: boolean enum: - true fieldCount: type: integer minimum: 0 secretCount: type: integer minimum: 0 required: - applied - fieldCount - secretCount required: - code - message required: - error responses: ValidationError: description: Validation error content: application/json: schema: $ref: '#/components/schemas/ApiError' headers: RateLimit-Limit: description: Quota in requests for the active window. schema: type: integer minimum: 0 RateLimit-Remaining: description: Remaining requests in the active window. schema: type: integer minimum: 0 RateLimit-Reset: description: Reset delay in seconds (not a Unix timestamp). schema: type: integer minimum: 1 X-RateLimit-Limit: schema: type: integer minimum: 0 X-RateLimit-Remaining: schema: type: integer minimum: 0 X-RateLimit-Reset: description: Legacy reset timestamp in Unix milliseconds. schema: type: integer minimum: 0 RateLimit-Policy: description: IETF HTTPAPI structured quota policy (work in progress). schema: type: string RateLimit: description: >- IETF HTTPAPI structured remaining quota and reset delay (work in progress). schema: type: string Unauthorized: description: Unauthorized content: application/json: schema: $ref: '#/components/schemas/ApiError' headers: RateLimit-Limit: description: Quota in requests for the active window. schema: type: integer minimum: 0 RateLimit-Remaining: description: Remaining requests in the active window. schema: type: integer minimum: 0 RateLimit-Reset: description: Reset delay in seconds (not a Unix timestamp). schema: type: integer minimum: 1 X-RateLimit-Limit: schema: type: integer minimum: 0 X-RateLimit-Remaining: schema: type: integer minimum: 0 X-RateLimit-Reset: description: Legacy reset timestamp in Unix milliseconds. schema: type: integer minimum: 0 RateLimit-Policy: description: IETF HTTPAPI structured quota policy (work in progress). schema: type: string RateLimit: description: >- IETF HTTPAPI structured remaining quota and reset delay (work in progress). schema: type: string WWW-Authenticate: description: >- Bearer challenge. Agent-facing routes include the RFC 9728 resource_metadata URL. schema: type: string Forbidden: description: Forbidden content: application/json: schema: $ref: '#/components/schemas/ApiError' headers: RateLimit-Limit: description: Quota in requests for the active window. schema: type: integer minimum: 0 RateLimit-Remaining: description: Remaining requests in the active window. schema: type: integer minimum: 0 RateLimit-Reset: description: Reset delay in seconds (not a Unix timestamp). schema: type: integer minimum: 1 X-RateLimit-Limit: schema: type: integer minimum: 0 X-RateLimit-Remaining: schema: type: integer minimum: 0 X-RateLimit-Reset: description: Legacy reset timestamp in Unix milliseconds. schema: type: integer minimum: 0 RateLimit-Policy: description: IETF HTTPAPI structured quota policy (work in progress). schema: type: string RateLimit: description: >- IETF HTTPAPI structured remaining quota and reset delay (work in progress). schema: type: string NotFound: description: Resource not found content: application/json: schema: $ref: '#/components/schemas/ApiError' headers: RateLimit-Limit: description: Quota in requests for the active window. schema: type: integer minimum: 0 RateLimit-Remaining: description: Remaining requests in the active window. schema: type: integer minimum: 0 RateLimit-Reset: description: Reset delay in seconds (not a Unix timestamp). schema: type: integer minimum: 1 X-RateLimit-Limit: schema: type: integer minimum: 0 X-RateLimit-Remaining: schema: type: integer minimum: 0 X-RateLimit-Reset: description: Legacy reset timestamp in Unix milliseconds. schema: type: integer minimum: 0 RateLimit-Policy: description: IETF HTTPAPI structured quota policy (work in progress). schema: type: string RateLimit: description: >- IETF HTTPAPI structured remaining quota and reset delay (work in progress). schema: type: string Conflict: description: Conflict content: application/json: schema: $ref: '#/components/schemas/ApiError' headers: RateLimit-Limit: description: Quota in requests for the active window. schema: type: integer minimum: 0 RateLimit-Remaining: description: Remaining requests in the active window. schema: type: integer minimum: 0 RateLimit-Reset: description: Reset delay in seconds (not a Unix timestamp). schema: type: integer minimum: 1 X-RateLimit-Limit: schema: type: integer minimum: 0 X-RateLimit-Remaining: schema: type: integer minimum: 0 X-RateLimit-Reset: description: Legacy reset timestamp in Unix milliseconds. schema: type: integer minimum: 0 RateLimit-Policy: description: IETF HTTPAPI structured quota policy (work in progress). schema: type: string RateLimit: description: >- IETF HTTPAPI structured remaining quota and reset delay (work in progress). schema: type: string RateLimited: description: Rate limit exceeded content: application/json: schema: $ref: '#/components/schemas/ApiError' headers: RateLimit-Limit: description: Quota in requests for the active window. schema: type: integer minimum: 0 RateLimit-Remaining: description: Remaining requests in the active window. schema: type: integer minimum: 0 RateLimit-Reset: description: Reset delay in seconds (not a Unix timestamp). schema: type: integer minimum: 1 X-RateLimit-Limit: schema: type: integer minimum: 0 X-RateLimit-Remaining: schema: type: integer minimum: 0 X-RateLimit-Reset: description: Legacy reset timestamp in Unix milliseconds. schema: type: integer minimum: 0 RateLimit-Policy: description: IETF HTTPAPI structured quota policy (work in progress). schema: type: string RateLimit: description: >- IETF HTTPAPI structured remaining quota and reset delay (work in progress). schema: type: string Retry-After: description: Delay in seconds before retrying when present. schema: type: integer minimum: 1 InternalError: description: Internal server error content: application/json: schema: $ref: '#/components/schemas/ApiError' headers: RateLimit-Limit: description: Quota in requests for the active window. schema: type: integer minimum: 0 RateLimit-Remaining: description: Remaining requests in the active window. schema: type: integer minimum: 0 RateLimit-Reset: description: Reset delay in seconds (not a Unix timestamp). schema: type: integer minimum: 1 X-RateLimit-Limit: schema: type: integer minimum: 0 X-RateLimit-Remaining: schema: type: integer minimum: 0 X-RateLimit-Reset: description: Legacy reset timestamp in Unix milliseconds. schema: type: integer minimum: 0 RateLimit-Policy: description: IETF HTTPAPI structured quota policy (work in progress). schema: type: string RateLimit: description: >- IETF HTTPAPI structured remaining quota and reset delay (work in progress). schema: type: string ServiceUnavailable: description: Service unavailable content: application/json: schema: $ref: '#/components/schemas/ApiError' headers: RateLimit-Limit: description: Quota in requests for the active window. schema: type: integer minimum: 0 RateLimit-Remaining: description: Remaining requests in the active window. schema: type: integer minimum: 0 RateLimit-Reset: description: Reset delay in seconds (not a Unix timestamp). schema: type: integer minimum: 1 X-RateLimit-Limit: schema: type: integer minimum: 0 X-RateLimit-Remaining: schema: type: integer minimum: 0 X-RateLimit-Reset: description: Legacy reset timestamp in Unix milliseconds. schema: type: integer minimum: 0 RateLimit-Policy: description: IETF HTTPAPI structured quota policy (work in progress). schema: type: string RateLimit: description: >- IETF HTTPAPI structured remaining quota and reset delay (work in progress). schema: type: string securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: EvalGate API key description: >- Organization-scoped EvalGate API key. Discover the supported agent scopes at /.well-known/oauth-protected-resource. Per-operation grants are listed in x-evalgate-required-scopes; OpenAPI bearer security requirement arrays remain empty as required for non-OAuth schemes. x-evalgate-scopes-supported: - eval:read - eval:write - objectives:read - objectives:write - runs:read - runs:write - traces:read - traces:write - exports:download - reports:write - prompt:publish - scorer:publish - red_team:read - red_team:run - red_team:approve - docs:read - agent:read - agent:execute - resources:read - resources:write - contexts:read - contexts:write - observations:write - checks:read - checks:run - standards:read - standards:write - standards:approve - grants:read - grants:write - admin:keys - admin:workspace - admin:org x-evalgate-protected-resource-metadata: https://www.evalgate.com/.well-known/oauth-protected-resource ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.