--- title: "Record transparency application" method: POST path: "/v1/projects/{project_id}/compliance/systems/{system_id}/transparency-applications" tags: ["compliance"] --- # Record transparency application `POST /v1/projects/{project_id}/compliance/systems/{system_id}/transparency-applications` ## Request - Base URL: `https://api.connic.co` - URL: `https://api.connic.co/v1/projects/{project_id}/compliance/systems/{system_id}/transparency-applications` - Auth: HTTP bearer Record evidence that an AI system's transparency policy was applied. Requires a transparency policy. Repeating a request with the same `idempotency_key` from the same caller returns the original record; different content with the same key returns 409. Required permission: `compliance.manage`. ## Path parameters - `project_id` string, uuid, required - `system_id` string, uuid, required ## Request body - ComplianceTransparencyApplicationCreate: Attested evidence that a disclosure or marking from the system's transparency policy was applied, failed, or could not be confirmed. - `idempotency_key` string, nullable: Retry key, scoped to the caller and system. Repeating a request with the same key and content returns the existing record; reusing the key with different content fails. - `environment_id` string, uuid, nullable: Environment the record documents. Must be linked to the system if the system lists environments. - `deployment_id` string, uuid, nullable: Deployment the record documents. Must be linked to the system if the system lists deployments. - `run_id` string, uuid, nullable: Run the record documents. Its agent, environment, deployment and connector fill in omitted references and must match given ones. - `connector_id` string, uuid, nullable: Connector the record documents. - `agent_name` string, nullable: Agent the record documents. Must be linked to the system if the system lists agents. - `surface` string, nullable: Where the disclosure was delivered, such as a web application or email. - `mode` string, nullable: Free-text label for how the disclosure was delivered. - `disclosure_type` 'direct_interaction' | 'synthetic_content' | 'deepfake' | 'public_interest_text' | 'biometric_emotion', required: Disclosure or marking the record covers. - `status` 'applied' | 'failed' | 'delivery_unknown', required: `applied` when delivery was confirmed; `failed` and `delivery_unknown` require `failure_reason`. - `output_hash` string, nullable: Hex SHA-256 digest of the delivered output. Stored in lowercase. - `failure_reason` string, nullable: Why delivery failed or could not be confirmed. Must be omitted when `status` is `applied`. - `provenance` ComplianceAttestationProvenance, required: Who attests to a transparency record and on what basis. - `source` 'customer_attestation' | 'upstream_attestation', required: `customer_attestation` for a disclosure your application rendered or verified, `upstream_attestation` for evidence from an upstream provider. - `attested_by` string, required: Person or team responsible for the attestation. - `attested_at` string, date-time, required: When the attestation was made. - `evidence_reference` string, required: Reference to the supporting record, such as a ticket, document or provider attestation ID. - `basis` string, required: Facts that support the attestation. - `application_metadata` object: Free-form JSON with additional details. At most 64 KiB when serialized. - `applied_at` string, date-time, nullable: When the disclosure was applied or the attempt ended. Defaults to the time of the request; cannot be in the future. ## Response `201` Successful Response - ComplianceTransparencyApplicationResponse: Immutable, attested evidence that a transparency disclosure was applied, failed, or could not be confirmed. - `id` string, uuid, required - `project_id` string, uuid, required: Project the record belongs to. - `system_id` string, uuid, required: AI system the record belongs to. - `policy_id` string, uuid, required: Transparency policy in effect when the record was created. - `policy_version` integer, required: Version of that policy. - `evidence_source` 'customer_attestation' | 'upstream_attestation', required: Source of the attestation, from `provenance.source`. - `provenance` object, required: Who attested to the record and on what basis, as submitted. - `idempotency_key` string, required: SHA-256 digest derived from the submitted idempotency key, or a random value when none was sent. - `request_digest` string, required: SHA-256 digest of the submitted content, used to detect conflicting retries. - `environment_id` string, uuid, nullable, required: Environment the record documents. - `deployment_id` string, uuid, nullable, required: Deployment the record documents. - `run_id` string, uuid, nullable, required: Run the record documents. - `connector_id` string, uuid, nullable, required: Connector the record documents. - `agent_name` string, nullable, required: Agent the record documents. - `surface` string, nullable, required: Where the disclosure was delivered. - `mode` string, nullable, required: Free-text label for how the disclosure was delivered. - `disclosure_type` 'direct_interaction' | 'synthetic_content' | 'deepfake' | 'public_interest_text' | 'biometric_emotion', required: Disclosure or marking the record covers. - `status` 'applied' | 'failed' | 'delivery_unknown', required: `applied` when delivery was confirmed, otherwise `failed` or `delivery_unknown`. - `output_hash` string, nullable, required: Lowercase hex SHA-256 digest of the delivered output. - `failure_reason` string, nullable, required: Why delivery failed or could not be confirmed. null when applied. - `policy_snapshot` object, required: Copy of the transparency policy at the time of recording. - `policy_hash` string, required: SHA-256 hash of `policy_snapshot`. - `application_metadata` object, required: Additional details submitted with the record. - `applied_at` string, date-time, nullable, required: When the disclosure was applied. null unless `status` is `applied`. - `finalized_at` string, date-time, nullable, required: When the attempt ended. - `recorded_by` string, nullable, required: ID of the user who recorded the evidence. - `created_at` string, date-time, required ## Other responses - `401`: Missing or invalid API key. - `403`: The API key lacks the required permission or access to the environment. - `404`: The resource does not exist in this project. - `422`: Validation Error - `429`: Rate limit exceeded. --- [API](https://skmtc.dev/connic/apis/connic-api.md) · [All operations](https://skmtc.dev/connic/apis/connic-api/llms.txt) · [OpenAPI document](https://skmtc.dev/connic/apis/connic-api/revisions/482932da5fbe?raw)