Case Evidence

Evidence items are the source material a case stands on: files, screening hits, metric extracts, interview notes. Each item has a SHA-256. Model output is not evidence unless you explicitly promote a published brief as kind: workpaper after human sign-off.

Attach

POST /v1/risk/cases/cse_0912/evidence
Authorization: Bearer eridian_sk_...
Content-Type: multipart/form-data

Fields: file or json, kind, source_system, captured_at.

{
  "id": "evd_01",
  "object": "eridian.risk.evidence",
  "kind": "file",
  "sha256": "b7c1...",
  "bytes": 220441,
  "region": "eu-west-1",
  "retention": "case"
}

kind: file | screening_hit | metric_extract | note | workpaper | other.

JSON screening hits:

POST /v1/risk/cases/cse_0912/evidence
Content-Type: application/json

{
  "kind": "screening_hit",
  "source_system": "watchlist_v3",
  "body": {
    "list": "internal_pep",
    "score": 0.81,
    "decision_ref": "scr_441"
  }
}

List and get

GET /v1/risk/cases/cse_0912/evidence
GET /v1/risk/evidence/evd_01

GET of bytes: GET /v1/risk/evidence/evd_01/content. Same key. ZDR projects may 404 the bytes and still return the hash.

Holds

POST /v1/risk/cases/cse_0912/hold

{
  "reason": "regulator_request",
  "until": null
}

Hold pauses the retention clock on the case and its evidence. Lifting a hold requires dual control.

Relationship to evidence export

Case evidence is operational. Evidence Export is the signed bundle for examiners and SIEM. Include risk_cases and risk_evidence_manifest in include to pack hashes and maps without necessarily packing raw files (order form option raw_files: false).

Integrity

If a file changes, attach a new item. Do not PATCH bytes. 409 evidence_immutable on mutate.

See Control Evidence to point controls at these ids, and Risk Limits for size caps.