Archigov · docs
  1. Docs
  2. Reference

Exports and Verification

The signed evidence pack, OSCAL assessment results, the DORA register of information, ArchiMate Open Exchange, and how a third party verifies what you hand them.

Exports are available to authors, auditors, board seats and the platform admin (capability export_evidence). Every export states that it is evidence, not an assurance of compliance.

#Evidence Pack

HTTP
GET /api/evidence-pack
GET /api/evidence-pack?application=<id>

A JSON document with the model (provenance, verification, content hashes, imported evidence), decisions and their links, reviews with positions, resolutions, conditions and assessments, catalogue artefacts with control references, closed sessions with minutes hashes, findings, and the audit trail. Alongside the content it carries:

FieldMeaning
hashSHA-256 (hex) over the canonical JSON of the content — every field except hash, signed_at, chain_head, chain_rows, signature and public_key
chain_headThe hash of the latest audit row when the pack was generated, tying the pack to a point in the audit chain
signatureEd25519 signature (base64) over the canonical JSON of everything except signature and public_key
public_keyThe instance's Ed25519 public key (PEM)

Canonical JSON here means: object keys sorted, no whitespace, undefined members dropped (in arrays they become null), values serialised as by JSON.stringify. Every pack is persisted under DATA_DIR/evidence-packs/ and its export is audited.

#Verifying a Pack

On the instance that produced it:

HTTP
GET /api/evidence-pack/verify?hash=<sha256>

returns found, hash_ok (the persisted pack still hashes to that value), signature_ok, key_is_current (signed by the instance's current key) and chain_ok (the audit chain still verifies up to the recorded head).

Independently, a third party needs only the pack and the instance's public key, which is published on the Audit Log page and under Settings. Check that it matches the public_key inside the pack, then:

  1. Remove the six meta fields, canonicalise, SHA-256 → must equal hash.
  2. Remove signature and public_key, canonicalise → verify signature over those bytes with the public key, using any Ed25519 library.

#Verifying the Audit Chain

HTTP
GET /api/audit/verify

recomputes every row's hash from its content and the previous row's hash and returns ok, the number of rows, the head, and broken_at — the first row that does not fit, if any.

#OSCAL

HTTP
GET /api/exports/oscal
GET /api/exports/oscal?application=<id>

NIST OSCAL 1.1.2 assessment results in JSON: an observation per rule evaluation and per imported assessment, and one finding per checkable artefact (its objective id is the artefact's code) linked to its observations. The disclaimer travels in the metadata remarks. Use it to feed GRC tooling that speaks OSCAL.

#DORA Register of Information

HTTP
GET /api/exports/dora-roi.csv

A simplified CSV of ICT third-party dependencies in the shape of the DORA register of information templates. It is clearly labelled as such:

  • Column codes follow the implementing technical standard's annex as reproduced in the EBA draft; confirm them against the Official Journal text before submitting anything.
  • Values a human must supply — such as legal entity identifiers and service-type codes — are left blank.

#ArchiMate Open Exchange

HTTP
GET /api/exports/archimate
GET /api/exports/archimate?application=<id>

The generated views as ArchiMate 3 Open Exchange XML, validated against the schema, opening in Archi with the same Carbon colours and orthogonal connection routes the UI shows. The views cover the physical and technology layer; see The derived model.

#Session Minutes

HTTP
GET /api/sessions/<id>/minutes

The derived minutes of a closed session as JSON, their SHA-256 hash (also in the audit chain and the evidence pack), and a rendered Markdown version.