Skip to content
Codevidence Docs

Reference In preview

The portal & evidence API

Evidence records are portable JSON in your build output first. When you configure an API key, the build plugins also publish them to the hosted Codevidence API, and your team reviews them in the tenant portal.

The tenant portal

Sign in at app.codevidence.com. Users belong to a tenant; everything is scoped to that tenant. Each control opens to:

  • the code that implements and verifies it — every call site, mapped to the control and to the lifecycle stage it covers;
  • a record-of-processing view — lifecycle stages, descriptive fields, and an implementation-coverage read of where code is linked and where the gaps are;
  • the raw evidence records — the exact Declared and Verified JSON your build posted, each openable standalone.

The control views are available in preview with representative data. Persisting and rendering each tenant’s own published evidence is the piece rolling out now.

The evidence API

One endpoint: POST /api/v1/evidence. It accepts a single Declared or Verified record, authenticates it, and acknowledges with 202. Interactive reference (with “try it out”): app.codevidence.com/api-docs; the spec is at /api/openapi.json.

request 
POST https://app.codevidence.com/api/v1/evidence
Authorization: Bearer cev_acme_xxxxxxxx
Content-Type: application/json

{ "schemaVersion": "0.1", "kind": "declared", ... }
response 
202 Accepted
{
  "status": "accepted",
  "tenant": "acme",
  "kind": "declared",
  "receivedAt": "2026-09-07T01:12:07.336Z"
}

Authentication

  • Per-tenant API key, sent as Authorization: Bearer <key> (or X-Api-Key). Keys look like cev_<tenant>_…; only hashes are stored server-side, and a tenant can hold several for rotation.
  • An optional per-tenant IP allowlist (CIDR ranges) as defense-in-depth — off by default, since hosted CI runners egress from rotating addresses.

Self-hosting ingestion

Point the plugin’s evidenceEndpoint at any service that accepts the same request (see build plugin configuration). The record JSON is the entire payload — never source.