Continuous Assurance API

Base path: /v1/audit/assurance/continuous Auth: Dual-posture — FlexibleAuthGuard (session/API key) for connector CRUD + attestation reads; HMAC-only for the per-event ingest route. Entitlement: entitlement.continuous_assurance · Feature flag: audit.continuous_assurance Permissions: audit:read / audit:write (per route).

The streaming audit surface. Provision a connector, stream every AI interaction to an HMAC-signed ingest endpoint, and receive one signed compliance number per calendar day with PSI drift detection. See the Continuous Assurance product page.

Flow

Connector lifecycle

POST /v1/audit/assurance/continuous/connectors

Provision a connector. Returns connector_id (cac_…) and a one-time secret (cas_…) — store it immediately; it is never re-readable. Rotate via POST /connectors/:id/rotate (24h overlap, no outage).

GET /v1/audit/assurance/continuous/connectors

List connectors. The secret is redacted.

HMAC signature format

Every ingest request signs HMAC-SHA256(secret, "<unix_timestamp>.<raw_body>") and sends it in:

X-Trinitite-Signature: t=<unix_ts>,v1=<hex_hmac>
X-Trinitite-Organization: <org_id>

A signature outside a 5-minute window returns 401 authentication_error (Signature timestamp out of range). See Webhooks for the equivalent verification recipe on the receiving side.

Event ingest

POST /v1/audit/assurance/continuous/ingest/:connectorId

Stream one AI interaction. Returns a per-event signed verdict:

{
  "event_id": "cae_01J9X…",
  "verdict": "fail",
  "violated_controls": ["SOC2.CC6.6"],
  "severity": "high",
  "attestation_hash": "sha256:…",
  "chain_hash": "…",
  "sequence_index": 1042,
  "policy_clause_refs": ["…"],
  "dlir_receipt_id": "led_01J9X…"
}

sequence_index is monotonic per connector — compare MAX(sequence_index) to your expected ingest count for trivial gap detection.

Daily attestations

GET /v1/audit/assurance/continuous/attestations/daily

List signed daily attestations:

{
  "report_id": "dar_01J9X…",
  "date": "2026-05-01",
  "event_count": 18432,
  "pass_count": 18301,
  "fail_count": 131,
  "pass_rate": 0.9929,
  "total_liability_usd": "41200",
  "merkle_root": "e3b0c4…",
  "psi": 0.07,
  "drift": "none",
  "signature": { "kms_key_id": "…", "sig": "…" },
  "anchor": { "rfc3161_ts": "…", "rekor_entry": "…" }
}

GET /v1/audit/assurance/continuous/attestations/:reportId/verify-bundle

Self-contained verify bundle for the day — recompute the Merkle root over per-connector chain heads, verify the KMS signature, resolve the anchor.

Manual roller trigger

POST /v1/audit/assurance/continuous/roller/trigger

Operator-only. Force the daily roller for a specific org/date (used for backfill or incident recovery).

Webhook events

Event	When	Severity
audit.assurance.continuous.daily_attestation_signed	Daily envelope signed + anchored.	low / medium.
audit.assurance.continuous.drift_detected	PSI ≥ threshold (default 0.25).	high.

The drift payload includes the structured comparison (PSI 0.41 ≥ threshold 0.25 between today (pass=18301, fail=131) and baseline (window=30d)).

Errors

HTTP	error.code	When
401	authentication_error	HMAC signature invalid or timestamp out of window.
402	entitlement_missing	Org lacks entitlement.continuous_assurance.
404	not_found (flag_rollout_off)	Feature flag disabled.

---

→ Continuous Assurance — the product overview. → Sampled Assurance API — the Layer 1 twin. → Errors, rate limits & conventions — shared contract.