> ## Documentation Index > Fetch the complete documentation index at: https://docs.zespan.com/llms.txt > Use this file to discover all available pages before exploring further. # Re-verify a generated evidence pack > Re-hashes the stored document and re-resolves every citation it made against live data, scoped to the pack's project or organization. Never errors on a data condition — a deleted record, a deleted storage object, or a pack that never finished generating are all reported as *results*, not exceptions. See [Verification](https://docs.zespan.com/compliance/verification) for the full field reference, in particular what `unverifiableRefs` means and why it must be read alongside `evidenceStillPresent` rather than ignored. **Authenticated with a dashboard session (browser cookie), not `x-api-key`**, and requires `compliance:read` plus the Pro plan or above. ## OpenAPI ````yaml /api-reference/openapi.yaml get /v1/projects/{id}/evidence-packs/{packId}/verify openapi: 3.1.0 info: title: Zespan Public API version: 1.0.0 description: > The Zespan Public API covers the endpoints that customers call directly or through the Zespan SDKs: trace ingestion (native and OpenTelemetry), prompt management, datasets and dataset runs, and the runtime guardrails check. All endpoints authenticate with a project API key sent in the `x-api-key` header. Create and manage API keys from the project settings in the Zespan dashboard. servers: - url: https://api.zespan.com description: Zespan production API security: - ApiKeyAuth: [] tags: - name: Ingestion description: Send traces and events to Zespan. - name: OpenTelemetry description: OTLP-compatible ingestion endpoints. - name: Prompts description: Manage versioned prompts and their labels, tags, and folders. - name: Datasets description: Read datasets and manage dataset runs used for experiments and scoring. - name: Guardrails description: Runtime guardrail evaluation. - name: SDK / CLI support description: > Small support endpoints consumed by the SDKs and @zespan/cli rather than called directly by application code. - name: Blast Radius description: > The prompt/agent/model/policy/evaluator/alert dependency graph backing the pre-release impact check and the evaluator-delete gate in the dashboard. Session-authenticated (dashboard cookie), not `x-api-key`. - name: Outcomes description: > Report business outcomes (a deflected ticket, an avoided refund, an SLA met) attributed to a trace, and read them back summarized by agent or model, joined to real trace cost. Backs the Value dashboard page. The ingest endpoint is `x-api-key`-authenticated like the rest of ingestion; the two read endpoints are session-authenticated (dashboard cookie) like Blast Radius. - name: Compliance description: > Generate audit-ready evidence documents (a per-agent Compliance Card, or SOC 2 control evidence) from recorded platform data, and re-verify a generated document's citations against live data. Session-authenticated (dashboard cookie), not `x-api-key`, gated by `compliance:read` / `compliance:generate` permissions and the Pro plan or above (the framework listing is the one exception — no project scope and no plan gate, since a customer deciding whether to upgrade needs to see what they'd get). - name: Models description: > Per-model usage, cost, latency, and error-rate rollups for a project, including the lifecycle overlay described under the Model Lifecycle tag. Session-authenticated (dashboard cookie), not `x-api-key`, gated by `dashboard:read`. - name: Model Lifecycle description: > Findings from the daily model deprecation scan, which matches models a project actually calls against a curated, bundled catalogue of provider-announced deprecation and retirement dates. Every figure on a finding (call volume, cost, affected agents/prompts, cost comparison against a named successor) is measured from real trace data — there is no quality-delta or regression-comparison endpoint, because nothing in this API invokes a model on the caller's behalf. Session-authenticated (dashboard cookie), not `x-api-key`: reading findings and the catalogue requires `dashboard:read`, dismissing a finding requires `alerts:manage`. paths: /v1/projects/{id}/evidence-packs/{packId}/verify: get: tags: - Compliance summary: Re-verify a generated evidence pack description: > Re-hashes the stored document and re-resolves every citation it made against live data, scoped to the pack's project or organization. Never errors on a data condition — a deleted record, a deleted storage object, or a pack that never finished generating are all reported as *results*, not exceptions. See [Verification](https://docs.zespan.com/compliance/verification) for the full field reference, in particular what `unverifiableRefs` means and why it must be read alongside `evidenceStillPresent` rather than ignored. **Authenticated with a dashboard session (browser cookie), not `x-api-key`**, and requires `compliance:read` plus the Pro plan or above. operationId: verifyEvidencePack parameters: - name: id in: path required: true schema: type: string format: uuid description: Project id. - name: packId in: path required: true schema: type: string description: Evidence pack id. responses: '200': description: The verification result. content: application/json: schema: $ref: '#/components/schemas/VerifyResult' '403': description: >- Not authenticated with a dashboard session, lacks `compliance:read`, or plan below Pro. content: application/json: schema: $ref: '#/components/schemas/Error' '404': $ref: '#/components/responses/NotFound' security: [] components: schemas: VerifyResult: type: object properties: sha256Matches: type: boolean description: >- True when the stored document's recomputed hash equals the hash recorded at generation time. storedSha256: type: string nullable: true recomputedSha256: type: string nullable: true evidenceStillPresent: type: boolean description: > True only when zero divergences were found among **checked** citations. Citations counted in `unverifiableRefs` are excluded from this check entirely — they are neither verified nor failed. checkedRefs: type: integer description: Citations actually re-resolved against a live record. unverifiableRefs: type: integer description: > Citations that structurally cannot be re-checked at record level (ClickHouse aggregates, certain change-timeline event kinds). Always read alongside `evidenceStillPresent` — a high `unverifiableRefs` count means most of the document was not re-checked, even if every checkable citation passed. divergences: type: array items: $ref: '#/components/schemas/ComplianceDivergence' objectMissing: type: boolean description: True when the stored document itself could not be read back. required: - sha256Matches - storedSha256 - recomputedSha256 - evidenceStillPresent - checkedRefs - unverifiableRefs - divergences - objectMissing Error: type: object properties: error: type: string description: Human-readable error message. example: Unauthorized code: type: string description: Machine-readable error code, when present. example: rate_limit_exceeded required: - error ComplianceDivergence: type: object properties: source: type: string description: >- The `EvidenceRef` source kind this citation came from (e.g. `guardrail_config`, `audit_log`, `incident`). id: type: string label: type: string reason: type: string enum: - missing - wrong_project description: > `missing` — the record doesn't exist anywhere; it was deleted. `wrong_project` — the record still exists, just no longer under this project. detail: type: string required: - source - id - label - reason - detail responses: NotFound: description: Resource not found. content: application/json: schema: $ref: '#/components/schemas/Error' securitySchemes: ApiKeyAuth: type: apiKey in: header name: x-api-key description: >- Project API key. Manage keys in the Zespan dashboard under project settings. ````