Skip to content
Brutor AI Docs

Assurance API

All under the Control Plane (:5050), admin-authenticated.

Endpoint Purpose
GET /v1/admin/ai-systems Fleet board with governance gaps
GET /v1/admin/ai-systems/{id}/runs Run ledger
GET /v1/admin/ai-systems/{id}/liveness Expectation + current status
GET /v1/admin/ai-systems/{id}/baselines What normal looks like
GET /v1/admin/ai-systems/{id}/drift Findings for one system
GET /v1/admin/drift Tenant-wide drift feed
POST /v1/admin/drift/{id}/{ack,resolve,false-positive} Triage
GET /v1/admin/ai-systems/{id}/contracts Version history + conformance
POST /v1/admin/ai-systems/{id}/contracts Mint from live config
GET /v1/admin/ai-systems/{id}/contracts/{version}/diff Widened vs narrowed
POST /v1/admin/contracts/{id}/{approve,reject,promote} Contract workflow
GET /v1/admin/ai-systems/{id}/lifecycle Transition requirements
POST /v1/admin/ai-systems/{id}/lifecycle Attempt a transition
GET/PUT /v1/admin/ai-systems/{id}/envelope The operating envelope declaration
GET /v1/admin/ai-systems/{id}/contracts/{ver}/export Canonical AI System Contract document
GET /v1/admin/ai-systems/{id}/assurance/history/{rid}/export A snapshot as a signed Assurance Certificate
GET /v1/admin/standards · GET /v1/admin/standards/{slug}/schema The published JSON Schemas both documents validate against
GET /v1/admin/ai-systems/{id}/evidence External evidence artifacts
POST /v1/admin/ai-systems/{id}/evidence Attach one (kind, uri, sha256, assessor, validity)
PATCH /v1/admin/ai-systems/{id}/evidence/{eid} Update an artifact’s metadata
DELETE /v1/admin/ai-systems/{id}/evidence/{eid} Detach (captured report snapshots keep it)
GET /v1/admin/ai-systems/{id}/response-policies Policies applying here, inherited included
POST /v1/admin/ai-systems/{id}/response-policies Arm a policy
POST /v1/admin/ai-systems/{id}/response-policies/preview Blast radius + what it would do
GET /v1/admin/ai-systems/{id}/responses What fired, and what was refused
POST /v1/admin/ai-systems/{id}/restore Undo an automatic tightening
GET /v1/admin/ai-systems/{id}/replay Suite state and what the gate makes of it
POST /v1/admin/ai-systems/{id}/replay/suite Freeze a stratified suite from recent traffic
POST /v1/admin/ai-systems/{id}/replay/run Request a replay run
GET /v1/admin/ai-systems/{id}/health Worst-of score with its components
GET /v1/admin/ai-systems/{id}/assurance The live Assurance Report
POST /v1/admin/ai-systems/{id}/assurance Capture an immutable snapshot
GET /v1/admin/ai-systems/{id}/assurance/history Captured snapshots

Detection itself — run finalization, liveness and drift sweeps — runs in the Core Proxy alongside the request path, not in the Control Plane.

Outcome feedback (Core Proxy)

Section titled “Outcome feedback (Core Proxy)”

One assurance write does not live on the Control Plane. Ratings come from end users, not admins, so they are collected by the portal API on the Core Proxy (:8100) under the end user’s own portal session:

Endpoint Purpose
POST /v1/portal/runs/{run_id}/feedback Rate the run that produced an answer
Request
{ "score": 1, "comment": "optional" }
Response 200
{ "run_id": "01JBRUTORRUNROOT0000000000", "score": 1 }

score is 1 (up), -1 (down) or 0 (withdraw a rating — the response then carries "score": null). run_id is the value the gateway returned in the x-brutor-run-id response header.

Ratings are stored per user per run, so re-rating replaces that user’s own rating and leaves everyone else’s alone. A run the caller did not take part in returns 404 — “this run exists but is not yours” is itself a fact about someone else’s traffic.

Section titled “Related”