Rensei docs
API ReferenceAudit

Retrieve an exact retained privileged-verification artifact.

Returns the retained canonical JSON bytes addressed by the complete org, invocation, claim, kind, and SHA-256 identity. The caller must authenticate into the addressed org and, for project-scoped credentials, the invocation project. The response is the unmodified authority bytes with `Digest`, strong SHA-256 `ETag`, and immutable private caching. Cross-org, cross-project, and absent artifacts are concealed as 404.

GET
/api/cli/audit/privileged-verification/artifacts/{orgId}/{invocationId}/{claimId}/{kind}/{sha256}

Authorization

headerAuthorizationBearer <rsk_live_*>

Rensei API key presented as Authorization: Bearer rsk_live_. Required API-key scopes are recorded per operation in x-rensei-required-scopes.

Path Parameters

orgId*string
Match^[A-Za-z0-9][A-Za-z0-9._:-]{0,255}$
invocationId*string
Match^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$
claimId*string
Match^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$
kind*string
Value in"request""result""manifest""confirmation"
sha256*string
Match^[0-9a-f]{64}$

Response Body

Exact retained canonical bytes, streamed unchanged as application/json without content encoding.

response?fileapplication/json
Formatbinary
Example Request
curl -X GET 'https://app.rensei.ai/api/cli/audit/privileged-verification/artifacts/string/string/string/request/string'
Example Response
"string"

List tamper-evident audit events

Returns hash-chain audit events for the authenticated org. Events include a `prevHash` / `entryHash` linkage for integrity verification. Accepts optional filters by `entityId` and/or `entityType`.

List agent cards visible to the caller (system + org + optional project).

Returns agent cards resolved by scope (system + the caller org + an optional project scope). `format=full` returns rich `cards`; the default `format=autocomplete` returns lightweight `options`. Bearer-reachable for human principals (user token or browser session) - rsk_* API keys and BYOA OAuth-agent tokens are rejected 403; never surfaces another org's cards. This is also the read backing the tenant Marketplace screen (format=full, scope=all).