---
title: "List evidence snapshots"
method: GET
path: "/v1/projects/{project_id}/compliance/evidence-snapshots"
tags: ["compliance"]
---

# List evidence snapshots

`GET /v1/projects/{project_id}/compliance/evidence-snapshots`

## Request

- Base URL: `https://api.connic.co`
- URL: `https://api.connic.co/v1/projects/{project_id}/compliance/evidence-snapshots`
- Auth: HTTP bearer

List immutable compliance evidence snapshots for a project or system, newest first.

Required permission: `compliance.view`.

## Path parameters

- `project_id` string, uuid, required

## Query parameters

- `system_id` string, uuid, nullable: Only snapshots scoped to this AI system.
- `limit` integer: Maximum number of snapshots to return.
- `offset` integer: Number of snapshots to skip.
- `before_created_at` string, date-time, nullable: Cursor: `created_at` of the last snapshot on the previous page. Send together with `before_id`.
- `before_id` string, uuid, nullable: Cursor: ID of the last snapshot on the previous page. Send together with `before_created_at`.

## Response `200`

Successful Response

- ComplianceEvidenceSnapshotResponse[]
  - `id` string, uuid, required
  - `project_id` string, uuid, required: Project the snapshot belongs to.
  - `system_id` string, uuid, nullable, required: AI system the snapshot was limited to. null when it covers several systems.
  - `name` string, required
  - `scope` object, required: What was captured: `system_ids`, `environment_ids`, `system_agent_environment_pairs`, `telemetry_scope`, `time_from` and `time_to`.
  - `content_hash` string, required: SHA-256 hash of the canonical snapshot content, also sent as `X-Content-SHA256` on download.
  - `catalog_version` string, required: Version of the obligation catalog when the snapshot was taken.
  - `created_by` string, required: ID of the user who captured the snapshot.
  - `created_at` string, date-time, required
  - `coverage` object, required: Coverage summary: control counts by status, transparency record counts, `missing_items` and `missing_evidence`, the time and environment scope, and the plan's data retention in days.

## Other responses

- `401`: Missing or invalid API key.
- `403`: The API key lacks the required permission or access to the environment.
- `422`: Validation Error
- `429`: Rate limit exceeded.

---

[API](https://skmtc.dev/connic/apis/connic-api.md) · [All operations](https://skmtc.dev/connic/apis/connic-api/llms.txt) · [OpenAPI document](https://skmtc.dev/connic/apis/connic-api/revisions/482932da5fbe?raw)