---
title: "Evidence bundle"
method: GET
path: "/v1/domains/{domain}/bundle"
---

# Evidence bundle

`GET /v1/domains/{domain}/bundle`

## Request

- Base URL: `https://domaindrift.io`
- URL: `https://domaindrift.io/v1/domains/{domain}/bundle`
- Auth: API key in header `X-DomainDrift-Key`

Self-contained signed evidence bundle for offline verification, read from the signed archive. TWO LANES. `window=short` (the default) covers the last 7 days and is included in your plan's monthly bundle allowance. `window=deep` covers 90 days, is included in no plan, and is bought per export with DRM3 credits. A paid lane requires `pay=credits` in so many words: without it you get a 402 stating the price and the URL that pays it, and NOTHING is debited. A purchase is idempotent per account, lane, domain and UTC day, so a retried download never debits twice. Two modes: full (every receipt) or compact (Merkle rollup).

## Path parameters

- `domain` string, required

## Query parameters

- `window` 'short' | 'deep'
- `pay` 'credits'
- `mode` 'full' | 'compact'

## Response `200`

JSON evidence bundle (Content-Disposition: attachment). A purchased export also carries X-DRM3-Charged-Credits, plus X-DRM3-Charge-Replay when the debit was a replay of an earlier identical purchase and X-DRM3-Credits-Overdraft when it drew the purse negative.

## Other responses

- `402`: Payment required, and nothing was charged: the monthly allowance is spent, the deep export needs consent, or the credit purse is empty. The body states the price in credits and money, and the URL that pays it.
- `403`: This account has no bundle entitlement
- `404`: Domain not tracked
- `502`: The credit ledger could not be reached. Nothing was charged.
- `503`: The signed archive could not be read, or credit purchases are not configured. Nothing was charged.

---

[API](https://skmtc.dev/domaindrift/apis/domaindrift-continuous-internet-telemetry-api.md) · [All operations](https://skmtc.dev/domaindrift/apis/domaindrift-continuous-internet-telemetry-api/llms.txt) · [OpenAPI document](https://skmtc.dev/domaindrift/apis/domaindrift-continuous-internet-telemetry-api/revisions/eb8e3f45736c?raw)