Evidence Export

Evidence export packages audit events, policy versions, eval reports, and residency attestations into a signed bundle. Hand the bundle to an examiner or ingest it into your SIEM. The pack is scoped to a project and a time window. It does not include raw prompts under ZDR.

Create an Export

POST /v1/audit/exports
Authorization: Bearer eridian_sk_...
Content-Type: application/json
Idempotency-Key: exam-2026-09-legal-001

{
  "project_id": "prj_legal_001",
  "start": "2026-09-01T00:00:00Z",
  "end": "2026-09-30T23:59:59Z",
  "include": [
    "audit_events",
    "policy_snapshots",
    "eval_reports",
    "residency_attestation",
    "key_inventory",
    "risk_cases",
    "risk_evidence_manifest",
    "risk_control_maps"
  ],
  "format": "zip"
}

Required scope: audit:read. Large windows are asynchronous. Poll until status is ready.

Export Object

{
  "id": "exp_91ab",
  "object": "eridian.evidence.export",
  "status": "ready",
  "sha256": "b7c1...",
  "signature": "eridian_sig_...",
  "download_url": "https://api.geteridian.com/v1/audit/exports/exp_91ab/content",
  "expires_at": 1718668800
}

download_url is short-lived (15 minutes). It requires the same eridian_sk_ key. Do not send the URL to an examiner without the accompanying signature file.

Verify

The zip contains:

Verify with the Eridian evidence public key published for your tenant:

eridian evidence verify ./exp_91ab.zip --tenant tnt_renedor

Python

export = client.audit.exports.create(
    project_id="prj_legal_001",
    start="2026-09-01T00:00:00Z",
    end="2026-09-30T23:59:59Z",
    include=["audit_events", "policy_snapshots", "residency_attestation"],
)
client.audit.exports.wait(export.id)

SIEM

For continuous ingest, stream GET /v1/audit/events with starting_after rather than daily zips. Use Webhook Signing if you subscribe to inference.completed at the SIEM collector.

Download URLs, pack hashes, and the requesting actor are themselves audit events (evidence.export.created).

Risk tenants should include risk_cases, risk_evidence_manifest, and risk_control_maps so examiners can follow control_id to a SHA-256. Raw case files are omitted unless the order form sets raw_files: true. See Case Evidence and Control Evidence.

See Audit Log and Runbooks.