---
title: "A company's public evidence rollup"
method: GET
path: "/api/public-mesh/{handle}"
---

# A company's public evidence rollup

`GET /api/public-mesh/{handle}`

## Request

- Base URL: `https://trooth.co`
- URL: `https://trooth.co/api/public-mesh/{handle}`
- Auth: none required

The buyer-facing projection of a company's evidence: the witnessed state per area (the pillars key), provider status with the time each connected system was last read. Framework rollups were retired on 2026-09-26 and the frameworks array is always empty. Individual control rows, owners and internal notes are never returned here. Each pillar carries observedAt and sourceRef, null when Trooth holds no per-area read time or reference, or when the area is restricted: null reads as unknown and is never filled from another area, a provider sync or the company's last edit. Responds 404 when the company has no public record, which is a privacy-preserving answer rather than an error. This is the read the embeddable badge performs. Cached at the edge for 300 seconds. Readable cross-origin: the response carries Access-Control-Allow-Origin: * and never Access-Control-Allow-Credentials, so a browser on any site may read it without cookies.

## Path parameters

- `handle` string, required

## Response `200`

The rollup, with framework percentages retired (empty) since 2026-09-26.

- PublicMesh
  - `sample` boolean
  - `company` object, required
    - `name` string, required
    - `handle` string, required
    - `updatedAt` string, required: The last edit to the company. Not an observation time.
  - `frameworks` unknown[], required: Retired 2026-09-26; always empty.
    - unknown
  - `pillars` object[], required: One entry per area, on /api/public-mesh/{handle} (lib/public-pillars.ts).
    - `id` string, required
    - `label` string, required
    - `status` string, required
    - `restricted` boolean: Present, and true, only when the area is held behind access controls. Restricted is not the same as not published.
    - `observedAt` string, nullable, required: Added 2026-10-04; always present since 2026-10-09. When Trooth last read this area, as the upstream states it for the area. null when no per-area read time is recorded or the area is restricted: an unrecorded date reads as unknown, never borrowed from another area, a provider's lastSync or company.updatedAt.
    - `sourceRef` string, nullable, required: Added 2026-10-04; always present since 2026-10-09. The upstream's reference to the reading behind this area. null when it gives none or the area is restricted.
  - `providers` object[], required
    - `id` string, required
    - `label` string, required
    - `status` string, required
    - `lastSync` string: Kept for older readers. Since 2026-10-04 it dates no area and no badge: the newest provider read says nothing about the age of an unrelated area.
  - `rollup` object[]: Added 2026-10-04. Every area as one fact, held to its own category window (lib/evidence.ts FRESHNESS_POLICY). observedAt is null and freshness unknown when no per-area read time is published; unknown is never shown as current.
    - `pillarId` string, required
    - `label` string, required
    - `status` 'witnessed' | 'attention' | 'failing' | 'not_started' | 'restricted', required
    - `counted` boolean, required
    - `evidenceClass` 'trooth_observation' | 'no_evidence' | 'restricted', required
    - `observation` string, required
    - `sourceRef` string, nullable, required
    - `observedAt` string, nullable, required
    - `validity` object, required
      - `category` string, required
      - `windowDays` integer, required
      - `validUntil` string, nullable, required
    - `freshness` 'current' | 'due' | 'stale' | 'unknown', required
    - `scope` object, required
      - `subject` string, required
      - `scope` 'company', required
      - `area` string, required
    - `unknown` string[], required
  - `badge` object: Added 2026-10-04. The state and the two lines the badge script and the badge image print, derived from rollup.
    - `kind` 'witnessed' | 'partial' | 'listed', required
    - `line` string, required
    - `detail` string, required
    - `asOf` string, nullable, required: The oldest read of the witnessed areas, only when every one is dated.
    - `counted` integer, required
    - `witnessed` integer, required
    - `staleAreas` string[], required
    - `undatedAreas` string[], required
    - `restrictedAreas` string[], required
  - `controls` unknown[], required
    - unknown
  - `freshness30d` integer
  - `disclaimer` string
  - `retired` object

## Other responses

- `404`: No public record for this handle.
- `503`: The record could not be read. Not a statement about the company.

---

[API](https://skmtc.dev/trooth/apis/trooth-public-api.md) · [All operations](https://skmtc.dev/trooth/apis/trooth-public-api/llms.txt) · [OpenAPI document](https://skmtc.dev/trooth/apis/trooth-public-api/revisions/e4d4e92641d9?raw)