{
  "schemaVersion": "1.0",
  "service": "HAIEC Assurance API",
  "apiVersion": "v1",
  "baseUrl": "https://www.haiec.com/api/v1",
  "openapi": "https://www.haiec.com/openapi/assurance-v1.yaml",
  "agentGuide": "https://www.haiec.com/docs/agent-integration",
  "authentication": {
    "type": "bearer",
    "credential": "HAIEC_API_KEY",
    "serverSideOnly": true,
    "neverSend": [
      "githubToken",
      "X-GitHub-Token",
      "organizationId"
    ]
  },
  "operations": {
    "discoverSystems": true,
    "discoverEvaluationSources": true,
    "runConnectedRepositoryAssurance": true,
    "submitQualifiedLocalEvidence": true,
    "readRunStatus": true,
    "readEvaluationSummary": true,
    "readEvaluationReport": true,
    "readEvaluationPdf": true,
    "readMasterReport": true,
    "readMasterReportPdf": true,
    "readPassport": true,
    "readAgentAudit": true,
    "readEvidenceBinders": true,
    "ingestStructuredEvidence": true,
    "ingestLogs": true,
    "ingestOtlpTraces": true,
    "ingestOtlpMetrics": true,
    "ingestOtlpLogs": true
  },
  "evidenceIntake": {
    "authentication": "bearer",
    "requiredScope": "evidence:ingest",
    "requiresConfiguredBinder": true,
    "binderDiscovery": "https://www.haiec.com/api/v1/evidence/binders",
    "supported": {
      "structured": true,
      "logs": true,
      "otlpTraces": true,
      "otlpMetrics": true,
      "otlpLogs": true
    },
    "arbitraryFileUpload": false,
    "routes": {
      "structured": "https://www.haiec.com/api/ingest/structured",
      "logs": "https://www.haiec.com/api/ingest/log",
      "otlpTraces": "https://www.haiec.com/api/otlp/v1/traces",
      "otlpMetrics": "https://www.haiec.com/api/otlp/v1/metrics",
      "otlpLogs": "https://www.haiec.com/api/otlp/v1/logs"
    },
    "attachToRun": "Pass receipt.producerRunId as externalEvidenceAttachments[].producerRunId with producerId structured-ingress on a NEW assurance run. Historical evaluations are immutable."
  },
  "mcp": {
    "status": "available",
    "endpoint": "https://www.haiec.com/api/mcp",
    "transport": "streamable_http",
    "mode": "stateless",
    "protocol": {
      "modern": "2026-07-28",
      "legacyStatelessCompatibility": true
    },
    "authentication": "bearer_haiec_api_key",
    "oauth": false,
    "tenantBinding": "api_key.organizationId — caller cannot override",
    "tools": [
      "haiec_bind_github_source",
      "haiec_capability_guide",
      "haiec_compare_scenario_states",
      "haiec_control_assurance",
      "haiec_control_replay",
      "haiec_control_results",
      "haiec_control_test_query",
      "haiec_create_ai_system",
      "haiec_get_agent_audit",
      "haiec_get_agent_trace",
      "haiec_get_capability_declaration",
      "haiec_get_competition_source_readiness",
      "haiec_get_governance",
      "haiec_get_master_report",
      "haiec_get_operating_envelope",
      "haiec_get_package",
      "haiec_get_passport",
      "haiec_get_report",
      "haiec_get_run",
      "haiec_get_runtime_test",
      "haiec_get_scenario_status",
      "haiec_get_summary",
      "haiec_get_supply_chain",
      "haiec_get_system_evidence",
      "haiec_get_telemetry_status",
      "haiec_github_preflight",
      "haiec_ingest_logs",
      "haiec_ingest_structured",
      "haiec_issue_assurance_package",
      "haiec_judgment_day_status",
      "haiec_list_assets",
      "haiec_list_connectors",
      "haiec_list_evidence_binders",
      "haiec_list_github_repositories",
      "haiec_list_investigations",
      "haiec_list_runtime_tests",
      "haiec_list_sources",
      "haiec_list_systems",
      "haiec_preflight",
      "haiec_prepare_scenario",
      "haiec_prepare_scenario_capture",
      "haiec_publish_package",
      "haiec_reconstruct_scenario",
      "haiec_register_asset",
      "haiec_retire_asset",
      "haiec_revoke_package",
      "haiec_run_assurance",
      "haiec_run_runtime_test",
      "haiec_runtime_preflight",
      "haiec_scenario_preflight",
      "haiec_setup_telemetry",
      "haiec_submit_capability_declaration",
      "haiec_submit_local_scan",
      "haiec_submit_operating_envelope",
      "haiec_submit_trace_facts",
      "haiec_verify_source"
    ],
    "evidenceUploadRequiresUserConfirmation": true,
    "runtimeViaMcp": {
      "status": true,
      "consent": "userConfirmedRuntimeTest: true required per call — never inferred",
      "authorization": "authorizationAcknowledged: true — caller asserts they own or are authorized to test the endpoint",
      "safety": "Canonical planRuntimeExecution — held categories never reach an executor",
      "orchestratorAttachOnly": "engines.runtime inside haiec_run_assurance supports mode:\"attach\" only — new-mode runtime is dispatched by haiec_run_runtime_test, then attached to a new Evaluation via attachedTestId"
    },
    "guidedAssurance": "haiec_get_agent_audit returns the canonical agent-audit plus a read-only resolutionGroups projection — deterministic grouping of open verification items; the AI guides, HAIEC determines the evidence state"
  },
  "sourceModes": {
    "githubRemote": {
      "status": "available",
      "authorization": "github_app",
      "coverage": "full_remote"
    },
    "local": {
      "status": "preview",
      "coverage": "limited",
      "distribution": "enterprise_poc"
    },
    "ciLocal": {
      "status": "preview",
      "coverage": "limited",
      "distribution": "enterprise_poc"
    },
    "runtimeEndpoint": {
      "status": "available"
    }
  },
  "rules": [
    "UNKNOWN != PASS",
    "ANALYSIS_LOCATION != ASSURANCE_PIPELINE",
    "EVIDENCE != ASSURANCE",
    "EVIDENCE_INGESTED != EVIDENCE_EVALUATED",
    "NOT_ASSESSED != FAIL",
    "organization is derived from the API key, never from caller input"
  ]
}