Sampled Assurance API

Base path: /v1/audit/assurance/samples Auth: Session token or API key — see Authentication. Entitlement: entitlement.sampled_assurance · Feature flag: audit.sampled_assurance Permissions: audit:write (ingest), audit:read (status / report / verify bundle).

The offline batch audit surface. Submit a batch of AI logs against a stated policy; receive a signed compliance report with per-row verdicts, framework citations, severity-calibrated dollar exposure, and a Merkle-rooted verify bundle. See the Sampled Assurance product page.

Job flow

Ingest

POST /v1/audit/assurance/samples/ingest

Submit up to 1,024 logs for offline audit. Returns synchronously with { job_id, status, created_at }; the pipeline runs in the background.

{
  "policy_ref": "policy:contract_assistant_v3",
  "logs": [
    { "id": "log_abc123", "messages": [ { "role": "assistant", "content": "Customer SSN: 123-45-6789" } ] }
  ],
  "format_hint": "openai",
  "audit_window": { "start": "2026-10-01T00:00:00Z", "end": "2026-10-31T23:59:59Z" },
  "guardian_id": "g_acme_auditor_v2",
  "engagement_id": "eng_q4_pre_audit"
}

format_hint accepts openai · anthropic · bedrock · vertex · canonical · raw_text. engagement_id optionally cross-pins the receipt to an external audit engagement.

Response 202 Accepted:

{ "job_id": "saj_01J9X…", "status": "queued", "created_at": "2026-05-01T12:00:00Z" }

Status poll

GET /v1/audit/assurance/samples/jobs/:job_id

Returns the job's state (queued · running · completed · failed), item counts, and the Merkle root once complete. Poll with the standard async backoff (2s initial, linear to 10s).

Signed report

GET /v1/audit/assurance/samples/jobs/:job_id/report

Returns the signed compliance report once status = completed:

{
  "job_id": "saj_01J9X…",
  "policy_hash": "sha256:7f3a…",
  "pass_count": 986,
  "fail_count": 14,
  "total_liability_usd": "182500",
  "top_violated_controls": ["SOC2.CC6.6", "EU_AI_ACT.art13", "HIPAA.164.312"],
  "audit_window": { "start": "…", "end": "…" },
  "items": [
    {
      "log_id": "log_abc123",
      "verdict": "fail",
      "violated_controls": ["SOC2.CC6.6"],
      "severity": "high",
      "liability_usd": "15000",
      "policy_clause_refs": ["…"],
      "rationale": "…",
      "dlir_receipt_id": "led_01J9X…"
    }
  ],
  "signature": { "kms_key_id": "…", "sig": "…" },
  "merkle_root": "e3b0c4…",
  "anchor": { "rfc3161_ts": "…", "rekor_entry": "…" }
}

Verify bundle

GET /v1/audit/assurance/samples/jobs/:job_id/verify-bundle

Self-contained bundle a third party reproduces in a browser: per-item attestation + chain hashes, recomputed Merkle root, KMS signature, anchor receipt id. Verifiable without Trinitite.

Executive summary

POST /v1/audit/assurance/samples/jobs/:job_id/summary

Regenerate the one-page executive narrative with your auditor's own summarization_instructions — each regeneration produces a separately signed mini-artifact; the original attestation is never invalidated. Requires the entitlement.assurance_executive_summary entitlement.

Webhook events

Event	When	Severity
audit.assurance.sample.completed	Report signed + anchored.	medium if any item failed, else low.

See Webhooks for delivery, signature verification, and retries.

Errors

Surface-specific codes layer on the shared error envelope:

HTTP	error.code	When
402	entitlement_missing	Org lacks entitlement.sampled_assurance.
404	not_found (flag_rollout_off)	Feature flag disabled.
409	conflict	Job already terminal; start a new job to re-run.

---

→ Sampled Assurance — the product overview. → Continuous Assurance API — the Layer 2 twin. → Errors, rate limits & conventions — shared contract.