> ## Documentation Index
> Fetch the complete documentation index at: https://docs.attesso.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Evidence

> Verify the signed, portable record of approval and authorization decisions.

An evidence bundle is a signed, portable record of what was approved, evaluated, and reported. It remains available when a mandate expires or is revoked before any authorization exists.

## What the bundle records

After signature verification, the payload contains:

* The immutable mandate and policy digest
* The end-user approval event
* Every proposed action and Attesso decision
* Reservation, commit, cancellation, revocation, and expiry transitions
* Source-labelled external reports supplied by your platform

## Signed envelope

`GET /v1/mandates/{mandate_id}/evidence` returns a flattened ES256 JWS with media type `application/jose+json`.

```json theme={null}
{
  "format": "attesso.evidence.v1",
  "protected": "base64url-encoded-header",
  "payload": "base64url-encoded-evidence",
  "signature": "base64url-encoded-signature"
}
```

Verify the signature against Attesso's public JSON Web Key Set before trusting the decoded payload. Pin the expected format and algorithm, resolve the protected `kid`, and reject any signature or payload mismatch.

## Evidence boundaries

Attesso distinguishes independently verified protocol events from facts your platform reports about external systems.

| Evidence source | Examples                                                                               |
| --------------- | -------------------------------------------------------------------------------------- |
| Attesso         | Mandate creation, passkey approval, policy decision, reservation, state transition     |
| Your platform   | Provider reference, reported executor acceptance time, external credential disposition |

An external report is an append-only claim with an explicit source. Attesso preserves it but does not present it as independently verified.

<Note>
  Evidence is not a payment receipt, settlement record, or guarantee that an external provider performed the action.
</Note>

## Operational guidance

* Store the original signed envelope when you need a portable audit artifact.
* Correlate API failures with the safe `Attesso-Request-Id` response header.
* Never place payment credentials, personal data, or provider secrets in opaque reference fields.
* Treat evidence verification failure as a security event.