---
title: "Record the digest of any regulated decision"
method: POST
path: "/api/v2/evidence"
tags: ["Evidence"]
---

# Record the digest of any regulated decision

`POST /api/v2/evidence`

## Request

- Base URL: `https://api.riskrouter.eu`
- URL: `https://api.riskrouter.eu/api/v2/evidence`
- Auth: one of:
  - HTTP bearer
  - API key in header `X-RiskRouter-Key`

The client hashes its own salted record and sends only the SHA-256; the record never reaches RiskRouter. The entry becomes a leaf of an RFC 6962 Merkle tree. A refused write answers 503 with recorded: false, never a success. Specification: https://riskrouter.eu/spec Optionally the client signs its own claim (signer_key_id, claimed_at, client_signature, all three or none): the signature is verified against a registered key before anything is written and then sits inside the leaf (leaf_version 3). See /spec#signed.

## Request body

- object
  - `record_digest` string, required
  - `kind` string, required
  - `signer_key_id` string: Optional, with claimed_at and client_signature: the id of a key registered with POST /api/v2/evidence/keys.
  - `claimed_at` string: The client's own timestamp, exactly as signed.
  - `client_signature` string: ECDSA P-256 over SHA-256 of riskrouter-evidence-claim|v3|kind|record_digest|signer_key_id|claimed_at, IEEE P1363 r||s, base64.
  - `chain_tag` string: Optional, with chain_seq: the completeness chain this record belongs to, 64 hex characters derived from a secret you keep. See /spec#chains.
  - `chain_seq` integer: Optional, with chain_tag: this record's position in its chain, from 1. Out of turn answers 409 CHAIN_OUT_OF_TURN.

## Response `201`

Recorded.

- object
  - `ok` boolean
  - `recorded` true
  - `entry` EvidenceEntry
    - `leaf_index` integer, required
    - `created_at` string, required: UTC, YYYY-MM-DDTHH:MM:SS.ffffffZ, exactly as in the leaf string.
    - `distributor_id` string, uuid, required
    - `kind` string, required
    - `record_digest` string, required
    - `leaf_hash` string, required: SHA-256(0x00 || leaf string); the leaf string is the v2 or the v3 form according to leaf_version. See /spec.
    - `leaf_version` 2 | 3: 2: unsigned leaf. 3: the entry also carries signer_key_id, claimed_at and client_signature, the distributor's own signature over its claim.
    - `signer_key_id` string
    - `claimed_at` string
    - `client_signature` string

## Other responses

- `400`: Every error carries the same envelope with a stable code.
- `401`: Every error carries the same envelope with a stable code.
- `409`: Every error carries the same envelope with a stable code.
- `413`: Every error carries the same envelope with a stable code.
- `429`: Every error carries the same envelope with a stable code.
- `503`: Every error carries the same envelope with a stable code.

---

[API](https://skmtc.dev/riskrouter/apis/riskrouter-api.md) · [All operations](https://skmtc.dev/riskrouter/apis/riskrouter-api/llms.txt) · [OpenAPI document](https://skmtc.dev/riskrouter/apis/riskrouter-api/revisions/5fee45dc6d1f?raw)