---
title: "Export the run's evidence bundle"
method: POST
path: "/v1/runs/{runId}/evidence"
tags: ["Events"]
---

# Export the run's evidence bundle

`POST /v1/runs/{runId}/evidence`

## Request

- Base URL: `https://api.ironfang.com/rig`
- URL: `https://api.ironfang.com/rig/v1/runs/{runId}/evidence`
- Auth: one of:
  - HTTP bearer
  - HTTP bearer

Builds the run's evidence bundle from what it recorded and returns it: a ZIP holding `manifest.json` (the run, counts, and every file's size and SHA-256), `events.json` (the whole timeline in sequence order), `expectations.json` (each expectation with its verdict once the run is finished), `faults.json`, `resources.json`, `definition.json`, every message under `messages/` and every request body under `requests/`, named by sequence and event id. Bounded at 10,000 events and 256 MiB of payloads; the manifest says when a bound bit or when retention had already taken some bytes. With `Accept: application/json` the manifest alone is returned. Read-only: the bundle is what the caller can already read event by event.

## Response `200`

The bundle, or its manifest

- object
  - `download` string, required: The path that returns the bundle itself.
  - `manifest` object, required

## Other responses

- `401`: No credential, an invalid one, or a delegated token where none is accepted (`unauthorized`, `invalid_api_key`, `delegated_not_allowed`).
- `403`: The credential lacks the permission or scope, or names another organisation (`forbidden`, `insufficient_scope`).
- `404`: No such object in this organisation (`not_found`).

---

[API](https://skmtc.dev/ironfang/apis/ironfang-rig-api.md) · [All operations](https://skmtc.dev/ironfang/apis/ironfang-rig-api/llms.txt) · [OpenAPI document](https://skmtc.dev/ironfang/apis/ironfang-rig-api/revisions/3e86a312dad1?raw)