---
title: "GET /api/v1/evidence/schemas（运行时探得；schema 由真实响应推导）"
method: GET
path: "/api/v1/evidence/schemas"
tags: ["evidence"]
---

# GET /api/v1/evidence/schemas（运行时探得；schema 由真实响应推导）

`GET /api/v1/evidence/schemas`

## Request

- Base URL: `https://aishield.tools`
- URL: `https://aishield.tools/api/v1/evidence/schemas`
- Auth: HTTP bearer

本端点由运行时探针自动登记（清单：api/openapi_runtime_paths.json），schema 由真实响应反推，非手工编写。

## Response `200`

- object
  - `schema` string
  - `ocsf_classes` object
    - `investigation.open` object[]
    - `investigation.update` object[]
    - `investigation.close` object[]
    - `report.publish` object[]
    - `proposal.create` object[]
    - `proposal.approve` object[]
    - `proposal.reject` object[]
    - `executor.dispatch` object[]
    - `executor.complete` object[]
    - `executor.fail` object[]
    - `probe.execute` object[]
    - `probe.verify` object[]
    - `verification.result` object[]
    - `audit.record` object[]
    - `audit.rollback` object[]
  - `stix_observable_types` string[]
  - `attack_ttps` object
    - `supply_chain` object[]
    - `prompt_injection` object[]
    - `credential_theft` object[]
    - `privilege_escalation` object[]
    - `mcp_tool_abuse` object[]
    - `guardrail_bypass` object[]
    - `data_exfiltration` object[]
    - `agent_manipulation` object[]
  - `states` string[]
  - `transitions` object
    - `pending` object[]
    - `proposed` object[]
    - `approved` object[]
    - `executing` object[]
    - `executed` object[]
    - `observing` object[]
    - `inconclusive` object[]
    - `failed` object[]
    - `verified` object[]
    - `rolled_back` object[]
    - `rejected` object[]
    - `archived` object[]

---

[API](https://skmtc.dev/aishield/apis/aishield-api.md) · [All operations](https://skmtc.dev/aishield/apis/aishield-api/llms.txt) · [OpenAPI document](https://skmtc.dev/aishield/apis/aishield-api/revisions/9a04f4fb94bd?raw)