Skip to main content
An evidence bundle is a signed, portable record of what was approved, evaluated, and reported. It remains available when a mandate expires or is revoked before any authorization exists.

​
What the bundle records

After signature verification, the payload contains:
  • The immutable mandate and policy digest
  • The end-user approval event
  • Every proposed action and Attesso decision
  • Reservation, commit, cancellation, revocation, and expiry transitions
  • Source-labelled external reports supplied by your platform

​
Signed envelope

GET /v1/mandates/{mandate_id}/evidence returns a flattened ES256 JWS with media type application/jose+json.
Verify the signature against Attesso’s public JSON Web Key Set before trusting the decoded payload. Pin the expected format and algorithm, resolve the protected kid, and reject any signature or payload mismatch.

​
Evidence boundaries

Attesso distinguishes independently verified protocol events from facts your platform reports about external systems. An external report is an append-only claim with an explicit source. Attesso preserves it but does not present it as independently verified.
Evidence is not a payment receipt, settlement record, or guarantee that an external provider performed the action.

​
Operational guidance

  • Store the original signed envelope when you need a portable audit artifact.
  • Correlate API failures with the safe Attesso-Request-Id response header.
  • Never place payment credentials, personal data, or provider secrets in opaque reference fields.
  • Treat evidence verification failure as a security event.