---
title: "Create evidence snapshot"
method: POST
path: "/v1/projects/{project_id}/compliance/evidence-snapshots"
tags: ["compliance"]
---

# Create evidence snapshot

`POST /v1/projects/{project_id}/compliance/evidence-snapshots`

## Request

- Base URL: `https://api.connic.co`
- URL: `https://api.connic.co/v1/projects/{project_id}/compliance/evidence-snapshots`
- Auth: HTTP bearer

Create an immutable export snapshot of selected compliance evidence.

If a snapshot with the same scope and content already exists, that snapshot is returned.

Required permission: `compliance.export`.

## Path parameters

- `project_id` string, uuid, required

## Request body

- ComplianceEvidenceSnapshotCreate: Captures an immutable, metadata-only snapshot of governance records and telemetry. Raw prompts and outputs are never included.
  - `name` string, required: Label for the snapshot.
  - `system_id` string, uuid, nullable: AI system to capture. null captures every system, or those linked to `environment_ids`.
  - `environment_ids` string[]: Limit telemetry to these environments. Each must be linked to a captured system.
  - `time_from` string, date-time, nullable: Start of the window for time-bound evidence such as incidents, transparency records and run telemetry.
  - `time_to` string, date-time, nullable: End of the window for time-bound evidence. Must not precede `time_from`.

## Response `201`

Successful Response

- ComplianceEvidenceSnapshotResponse: Immutable, metadata-only capture of governance records and telemetry. Download it as a ZIP archive.
  - `id` string, uuid, required
  - `project_id` string, uuid, required: Project the snapshot belongs to.
  - `system_id` string, uuid, nullable, required: AI system the snapshot was limited to. null when it covers several systems.
  - `name` string, required
  - `scope` object, required: What was captured: `system_ids`, `environment_ids`, `system_agent_environment_pairs`, `telemetry_scope`, `time_from` and `time_to`.
  - `content_hash` string, required: SHA-256 hash of the canonical snapshot content, also sent as `X-Content-SHA256` on download.
  - `catalog_version` string, required: Version of the obligation catalog when the snapshot was taken.
  - `created_by` string, required: ID of the user who captured the snapshot.
  - `created_at` string, date-time, required
  - `coverage` object, required: Coverage summary: control counts by status, transparency record counts, `missing_items` and `missing_evidence`, the time and environment scope, and the plan's data retention in days.

## Other responses

- `401`: Missing or invalid API key.
- `403`: The API key lacks the required permission or access to the environment.
- `422`: Validation Error
- `429`: Rate limit exceeded.

---

[API](https://skmtc.dev/connic/apis/connic-api.md) · [All operations](https://skmtc.dev/connic/apis/connic-api/llms.txt) · [OpenAPI document](https://skmtc.dev/connic/apis/connic-api/revisions/482932da5fbe?raw)