API reference

Every operation in the Proofline Review API 1.0.0, generated from the same OpenAPI document the SDKs are built from. All paths are under /api/v1/organizations/{org_id} and take a token with the scope shown.

The full document is at /docs/openapi.json.

Each example reads the token, the organization and every other required parameter from an environment variable named after it, such as REVIEW_ID for review_id.

Reviews#

Export reviews#

GET /api/v1/organizations/{org_id}/exports/{dataset}

Export review metadata

Returns one page of a version-1 export dataset (reviews, finding_outcomes, finding_validations, spend or findings) for an RFC3339 window of at most 31 days, as NDJSON by default or CSV. Rows respect the token's repository restriction.

• Scope: analytics:read
• SDKs: no method, because the response is not JSON. Call it over HTTP.
• Returns: 200 as application/x-ndjson or text/csv, one ExportRow per row

const organizationId = process.env.PROOFLINE_ORGANIZATION_ID!;
const dataset = process.env.DATASET!;
const query = new URLSearchParams({ from: process.env.FROM!, to: process.env.TO! });
const response = await fetch(
  `https://proofline.sh/api/v1/organizations/${organizationId}/exports/${dataset}?${query}`,
  { headers: { Authorization: `Bearer ${process.env.PROOFLINE_TOKEN!}` } },
);
if (!response.ok) {
  throw new Error(`Proofline answered ${response.status}: ${await response.text()}`);
}
console.log(await response.text());

import os
import httpx

token = os.environ["PROOFLINE_TOKEN"]
organization_id = os.environ["PROOFLINE_ORGANIZATION_ID"]
dataset = os.environ["DATASET"]
response = httpx.get(
    f"https://proofline.sh/api/v1/organizations/{organization_id}/exports/{dataset}",
    params={"from": os.environ["FROM"], "to": os.environ["TO"]},
    headers={"Authorization": f"Bearer {token}"},
)
response.raise_for_status()
print(response.text)

curl -sS -G "https://proofline.sh/api/v1/organizations/$PROOFLINE_ORGANIZATION_ID/exports/$DATASET" \
  -H "Authorization: Bearer $PROOFLINE_TOKEN" \
  --data-urlencode "from=$FROM" \
  --data-urlencode "to=$TO"

List repositories#

GET /api/v1/organizations/{org_id}/repository-names

List repository names

Returns the ID and full name of each connected repository inside the token's repository restriction, including repositories with no review, so a client can resolve owner/name to an ID.

• Scope: reviews:read
• TypeScript: client.listRepositories()
• Python: client.list_repositories()
• Returns: 200 RepositoryNames

import { ProoflineClient } from "@proofline/sdk";

const client = new ProoflineClient({
  baseUrl: "https://proofline.sh",
  token: process.env.PROOFLINE_TOKEN!,
});
const result = await client.listRepositories({
  path: { org_id: process.env.PROOFLINE_ORGANIZATION_ID! },
});
console.log(result);

import os
from uuid import UUID
from proofline import ProoflineClient

with ProoflineClient(os.environ["PROOFLINE_TOKEN"]) as client:
    result = client.list_repositories(UUID(os.environ["PROOFLINE_ORGANIZATION_ID"]))
    print(result)

curl -sS "https://proofline.sh/api/v1/organizations/$PROOFLINE_ORGANIZATION_ID/repository-names" \
  -H "Authorization: Bearer $PROOFLINE_TOKEN"

List reviews#

GET /api/v1/organizations/{org_id}/reviews

List reviews

Lists the latest run of each pull request in the organization, with filters and cursor pagination. A search equal to a full head commit SHA returns the latest run at that commit instead.

• Scope: reviews:read
• TypeScript: client.listReviews()
• Python: client.list_reviews()
• Returns: 200 ReviewPage

import { ProoflineClient } from "@proofline/sdk";

const client = new ProoflineClient({
  baseUrl: "https://proofline.sh",
  token: process.env.PROOFLINE_TOKEN!,
});
const result = await client.listReviews({
  path: { org_id: process.env.PROOFLINE_ORGANIZATION_ID! },
});
console.log(result);

import os
from uuid import UUID
from proofline import ProoflineClient

with ProoflineClient(os.environ["PROOFLINE_TOKEN"]) as client:
    result = client.list_reviews(UUID(os.environ["PROOFLINE_ORGANIZATION_ID"]))
    print(result)

curl -sS "https://proofline.sh/api/v1/organizations/$PROOFLINE_ORGANIZATION_ID/reviews" \
  -H "Authorization: Bearer $PROOFLINE_TOKEN"

Get review#

GET /api/v1/organizations/{org_id}/reviews/{review_id}

Get a review

Returns a review with its subjects, assessments and open items. An incomplete assessment reports its gaps; an empty finding list from it says nothing about the change.

• Scope: reviews:read
• TypeScript: client.getReview()
• Python: client.get_review()
• Returns: 200 CustomerReviewDetail

import { ProoflineClient } from "@proofline/sdk";

const client = new ProoflineClient({
  baseUrl: "https://proofline.sh",
  token: process.env.PROOFLINE_TOKEN!,
});
const result = await client.getReview({
  path: {
    org_id: process.env.PROOFLINE_ORGANIZATION_ID!,
    review_id: process.env.REVIEW_ID!,
  },
});
console.log(result);

import os
from uuid import UUID
from proofline import ProoflineClient

with ProoflineClient(os.environ["PROOFLINE_TOKEN"]) as client:
    result = client.get_review(
        UUID(os.environ["PROOFLINE_ORGANIZATION_ID"]),
        UUID(os.environ["REVIEW_ID"]),
    )
    print(result)

curl -sS "https://proofline.sh/api/v1/organizations/$PROOFLINE_ORGANIZATION_ID/reviews/$REVIEW_ID" \
  -H "Authorization: Bearer $PROOFLINE_TOKEN"

Get assessment#

GET /api/v1/organizations/{org_id}/reviews/{review_id}/assessments/{assessment_id}

Get an assessment

Returns one assessment of a review with its decision, checks and findings.

• Scope: findings:read
• TypeScript: client.getAssessment()
• Python: client.get_assessment()
• Returns: 200 CustomerAssessmentDetail

import { ProoflineClient } from "@proofline/sdk";

const client = new ProoflineClient({
  baseUrl: "https://proofline.sh",
  token: process.env.PROOFLINE_TOKEN!,
});
const result = await client.getAssessment({
  path: {
    org_id: process.env.PROOFLINE_ORGANIZATION_ID!,
    review_id: process.env.REVIEW_ID!,
    assessment_id: process.env.ASSESSMENT_ID!,
  },
});
console.log(result);

import os
from uuid import UUID
from proofline import ProoflineClient

with ProoflineClient(os.environ["PROOFLINE_TOKEN"]) as client:
    result = client.get_assessment(
        UUID(os.environ["PROOFLINE_ORGANIZATION_ID"]),
        UUID(os.environ["REVIEW_ID"]),
        UUID(os.environ["ASSESSMENT_ID"]),
    )
    print(result)

curl -sS "https://proofline.sh/api/v1/organizations/$PROOFLINE_ORGANIZATION_ID/reviews/$REVIEW_ID/assessments/$ASSESSMENT_ID" \
  -H "Authorization: Bearer $PROOFLINE_TOKEN"

Rerun review#

POST /api/v1/organizations/{org_id}/reviews/{review_id}/rerun

Rerun a review

Creates a new run of the review's original immutable code subject and leaves earlier runs unchanged. A local patch review is not rerun. Requires live GitHub write access; a repeated request can create another run, so clients make one attempt.

• Scope: reviews:rerun
• TypeScript: client.rerunReview()
• Python: client.rerun_review()
• Returns: 200 RerunResponse

import { ProoflineClient } from "@proofline/sdk";

const client = new ProoflineClient({
  baseUrl: "https://proofline.sh",
  token: process.env.PROOFLINE_TOKEN!,
});
const result = await client.rerunReview({
  path: {
    org_id: process.env.PROOFLINE_ORGANIZATION_ID!,
    review_id: process.env.REVIEW_ID!,
  },
});
console.log(result);

import os
from uuid import UUID
from proofline import ProoflineClient

with ProoflineClient(os.environ["PROOFLINE_TOKEN"]) as client:
    result = client.rerun_review(
        UUID(os.environ["PROOFLINE_ORGANIZATION_ID"]),
        UUID(os.environ["REVIEW_ID"]),
    )
    print(result)

curl -sS -X POST "https://proofline.sh/api/v1/organizations/$PROOFLINE_ORGANIZATION_ID/reviews/$REVIEW_ID/rerun" \
  -H "Authorization: Bearer $PROOFLINE_TOKEN"

Get review routing#

GET /api/v1/organizations/{org_id}/reviews/{review_id}/routing

Get review routing

Returns the review's validated routing plan and recorded finding placements. It reports retained routing facts, not model output or a deployment recommendation.

• Scope: reviews:read
• TypeScript: client.getReviewRouting()
• Python: client.get_review_routing()
• Returns: 200 ReviewRoutingView

import { ProoflineClient } from "@proofline/sdk";

const client = new ProoflineClient({
  baseUrl: "https://proofline.sh",
  token: process.env.PROOFLINE_TOKEN!,
});
const result = await client.getReviewRouting({
  path: {
    org_id: process.env.PROOFLINE_ORGANIZATION_ID!,
    review_id: process.env.REVIEW_ID!,
  },
});
console.log(result);

import os
from uuid import UUID
from proofline import ProoflineClient

with ProoflineClient(os.environ["PROOFLINE_TOKEN"]) as client:
    result = client.get_review_routing(
        UUID(os.environ["PROOFLINE_ORGANIZATION_ID"]),
        UUID(os.environ["REVIEW_ID"]),
    )
    print(result)

curl -sS "https://proofline.sh/api/v1/organizations/$PROOFLINE_ORGANIZATION_ID/reviews/$REVIEW_ID/routing" \
  -H "Authorization: Bearer $PROOFLINE_TOKEN"

Get deployment review#

GET /api/v1/organizations/{org_id}/reviews/deployments/{public_key}

Get a deployment review

Returns the deployment review with the given public key.

• Scope: reviews:read
• TypeScript: client.getDeploymentReview()
• Python: client.get_deployment_review()
• Returns: 200 CustomerReviewDetail

import { ProoflineClient } from "@proofline/sdk";

const client = new ProoflineClient({
  baseUrl: "https://proofline.sh",
  token: process.env.PROOFLINE_TOKEN!,
});
const result = await client.getDeploymentReview({
  path: {
    org_id: process.env.PROOFLINE_ORGANIZATION_ID!,
    public_key: process.env.PUBLIC_KEY!,
  },
});
console.log(result);

import os
from uuid import UUID
from proofline import ProoflineClient

with ProoflineClient(os.environ["PROOFLINE_TOKEN"]) as client:
    result = client.get_deployment_review(
        UUID(os.environ["PROOFLINE_ORGANIZATION_ID"]),
        os.environ["PUBLIC_KEY"],
    )
    print(result)

curl -sS "https://proofline.sh/api/v1/organizations/$PROOFLINE_ORGANIZATION_ID/reviews/deployments/$PUBLIC_KEY" \
  -H "Authorization: Bearer $PROOFLINE_TOKEN"

List pull request reviews#

GET /api/v1/organizations/{org_id}/reviews/pr/{repository}/{pull_request_number}

List a pull request's review runs

Lists the review runs of one pull request, addressed by repository name and pull request number.

• Scope: reviews:read
• TypeScript: client.listPullRequestReviews()
• Python: client.list_pull_request_reviews()
• Returns: 200 ReviewPage

import { ProoflineClient } from "@proofline/sdk";

const client = new ProoflineClient({
  baseUrl: "https://proofline.sh",
  token: process.env.PROOFLINE_TOKEN!,
});
const result = await client.listPullRequestReviews({
  path: {
    org_id: process.env.PROOFLINE_ORGANIZATION_ID!,
    repository: process.env.REPOSITORY!,
    pull_request_number: Number(process.env.PULL_REQUEST_NUMBER),
  },
});
console.log(result);

import os
from uuid import UUID
from proofline import ProoflineClient

with ProoflineClient(os.environ["PROOFLINE_TOKEN"]) as client:
    result = client.list_pull_request_reviews(
        UUID(os.environ["PROOFLINE_ORGANIZATION_ID"]),
        os.environ["REPOSITORY"],
        int(os.environ["PULL_REQUEST_NUMBER"]),
    )
    print(result)

curl -sS "https://proofline.sh/api/v1/organizations/$PROOFLINE_ORGANIZATION_ID/reviews/pr/$REPOSITORY/$PULL_REQUEST_NUMBER" \
  -H "Authorization: Bearer $PROOFLINE_TOKEN"

Get pull request review#

GET /api/v1/organizations/{org_id}/reviews/pr/{repository}/{pull_request_number}/runs/{run_number}

Get a pull request review run

Returns one review run of a pull request, addressed by repository name, pull request number and run number.

• Scope: reviews:read
• TypeScript: client.getPullRequestReview()
• Python: client.get_pull_request_review()
• Returns: 200 CustomerReviewDetail

import { ProoflineClient } from "@proofline/sdk";

const client = new ProoflineClient({
  baseUrl: "https://proofline.sh",
  token: process.env.PROOFLINE_TOKEN!,
});
const result = await client.getPullRequestReview({
  path: {
    org_id: process.env.PROOFLINE_ORGANIZATION_ID!,
    repository: process.env.REPOSITORY!,
    pull_request_number: Number(process.env.PULL_REQUEST_NUMBER),
    run_number: Number(process.env.RUN_NUMBER),
  },
});
console.log(result);

import os
from uuid import UUID
from proofline import ProoflineClient

with ProoflineClient(os.environ["PROOFLINE_TOKEN"]) as client:
    result = client.get_pull_request_review(
        UUID(os.environ["PROOFLINE_ORGANIZATION_ID"]),
        os.environ["REPOSITORY"],
        int(os.environ["PULL_REQUEST_NUMBER"]),
        int(os.environ["RUN_NUMBER"]),
    )
    print(result)

curl -sS "https://proofline.sh/api/v1/organizations/$PROOFLINE_ORGANIZATION_ID/reviews/pr/$REPOSITORY/$PULL_REQUEST_NUMBER/runs/$RUN_NUMBER" \
  -H "Authorization: Bearer $PROOFLINE_TOKEN"

Findings#

Get finding#

GET /api/v1/organizations/{org_id}/findings/{finding_id}

Get a finding

Returns one finding with its evidence references, validation state and causal graph.

• Scope: findings:read
• TypeScript: client.getFinding()
• Python: client.get_finding()
• Returns: 200 CustomerFinding

import { ProoflineClient } from "@proofline/sdk";

const client = new ProoflineClient({
  baseUrl: "https://proofline.sh",
  token: process.env.PROOFLINE_TOKEN!,
});
const result = await client.getFinding({
  path: {
    org_id: process.env.PROOFLINE_ORGANIZATION_ID!,
    finding_id: process.env.FINDING_ID!,
  },
});
console.log(result);

import os
from uuid import UUID
from proofline import ProoflineClient

with ProoflineClient(os.environ["PROOFLINE_TOKEN"]) as client:
    result = client.get_finding(
        UUID(os.environ["PROOFLINE_ORGANIZATION_ID"]),
        UUID(os.environ["FINDING_ID"]),
    )
    print(result)

curl -sS "https://proofline.sh/api/v1/organizations/$PROOFLINE_ORGANIZATION_ID/findings/$FINDING_ID" \
  -H "Authorization: Bearer $PROOFLINE_TOKEN"

Repositories#

Request patch review#

POST /api/v1/organizations/{org_id}/repositories/{repo_id}/patch-reviews

Review local changes

Reviews a unified diff against a commit GitHub has in the repository, and returns that patch's review when one exists. The review reads only that commit and the patch, and is never posted to a pull request. Requires live GitHub read access; the same patch on the same base always returns the same review.

• Scope: reviews:request
• TypeScript: client.requestPatchReview()
• Python: client.request_patch_review()
• Returns: 200 PatchReviewResponse

Request body: PatchReviewRequest

import { ProoflineClient } from "@proofline/sdk";

const client = new ProoflineClient({
  baseUrl: "https://proofline.sh",
  token: process.env.PROOFLINE_TOKEN!,
});
const result = await client.requestPatchReview(
  {
    path: {
      org_id: process.env.PROOFLINE_ORGANIZATION_ID!,
      repo_id: process.env.REPO_ID!,
    },
  },
  { base_commit_sha: process.env.BASE_COMMIT_SHA!, patch: process.env.PATCH! },
);
console.log(result);

import os
from uuid import UUID
from proofline import PatchReviewRequest, ProoflineClient

with ProoflineClient(os.environ["PROOFLINE_TOKEN"]) as client:
    result = client.request_patch_review(
        UUID(os.environ["PROOFLINE_ORGANIZATION_ID"]),
        UUID(os.environ["REPO_ID"]),
        body=PatchReviewRequest(base_commit_sha=os.environ["BASE_COMMIT_SHA"], patch=os.environ["PATCH"]),
    )
    print(result)

curl -sS -X POST "https://proofline.sh/api/v1/organizations/$PROOFLINE_ORGANIZATION_ID/repositories/$REPO_ID/patch-reviews" \
  -H "Authorization: Bearer $PROOFLINE_TOKEN" \
  -H "Content-Type: application/json" \
  -d "$(jq -n --arg base_commit_sha "$BASE_COMMIT_SHA" --arg patch "$PATCH" '{"base_commit_sha": $base_commit_sha, "patch": $patch}')"

Request review#

POST /api/v1/organizations/{org_id}/repositories/{repo_id}/pull-requests/{number}/review

Request a pull request review

Returns the active or result-bearing review at the pull request's live head, or creates a withheld one. The FULL mode creates a new review of the whole change unless one is pending or running. Requires live GitHub write access; a repeated request can create another review, so clients make one attempt.

• Scope: reviews:request
• TypeScript: client.requestReview()
• Python: client.request_review()
• Returns: 200 RunNowResponse

Request body: RunNowRequest

import { ProoflineClient } from "@proofline/sdk";

const client = new ProoflineClient({
  baseUrl: "https://proofline.sh",
  token: process.env.PROOFLINE_TOKEN!,
});
const result = await client.requestReview(
  {
    path: {
      org_id: process.env.PROOFLINE_ORGANIZATION_ID!,
      repo_id: process.env.REPO_ID!,
      number: Number(process.env.NUMBER),
    },
  },
  { mode: "EXISTING_OR_NEW" },
);
console.log(result);

import os
from uuid import UUID
from proofline import ProoflineClient, RunNowMode, RunNowRequest

with ProoflineClient(os.environ["PROOFLINE_TOKEN"]) as client:
    result = client.request_review(
        UUID(os.environ["PROOFLINE_ORGANIZATION_ID"]),
        UUID(os.environ["REPO_ID"]),
        int(os.environ["NUMBER"]),
        body=RunNowRequest(mode=RunNowMode.EXISTING_OR_NEW),
    )
    print(result)

curl -sS -X POST "https://proofline.sh/api/v1/organizations/$PROOFLINE_ORGANIZATION_ID/repositories/$REPO_ID/pull-requests/$NUMBER/review" \
  -H "Authorization: Bearer $PROOFLINE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"mode":"EXISTING_OR_NEW"}'

Get review guidance#

GET /api/v1/organizations/{org_id}/repositories/{repo_id}/review-guidance

Get repository review guidance

Returns the review guidance configured for a repository, for tools and coding agents that read it before writing code.

• Scope: guidance:read
• TypeScript: client.getReviewGuidance()
• Python: client.get_review_guidance()
• Returns: 200 RepositoryGuidance

import { ProoflineClient } from "@proofline/sdk";

const client = new ProoflineClient({
  baseUrl: "https://proofline.sh",
  token: process.env.PROOFLINE_TOKEN!,
});
const result = await client.getReviewGuidance({
  path: {
    org_id: process.env.PROOFLINE_ORGANIZATION_ID!,
    repo_id: process.env.REPO_ID!,
  },
});
console.log(result);

import os
from uuid import UUID
from proofline import ProoflineClient

with ProoflineClient(os.environ["PROOFLINE_TOKEN"]) as client:
    result = client.get_review_guidance(
        UUID(os.environ["PROOFLINE_ORGANIZATION_ID"]),
        UUID(os.environ["REPO_ID"]),
    )
    print(result)

curl -sS "https://proofline.sh/api/v1/organizations/$PROOFLINE_ORGANIZATION_ID/repositories/$REPO_ID/review-guidance" \
  -H "Authorization: Bearer $PROOFLINE_TOKEN"

Schemas#

Errors use Problem, an RFC 9457 problem document. The HTTP status is authoritative.

ActionUnavailability#

Type: READ_ONLY, REPOSITORY_UNAVAILABLE, REPOSITORY_WRITE_REQUIRED, PERMISSION_CHECK_UNAVAILABLE

ActorView#

The person behind an action on a review, as the page names them.

AssessmentProjection#

AttributedChange#

How one condition relates to the review's base revision.

Type: string or string or string or string or string

AttributedConditionView#

AttributedRevision#

Type: string or string

AttributionStatus#

Type: string or string or string

AuthorChoice#

Authority#

Type: ADVISORY, DEPLOYMENT_POLICY

Availability#

Type: RECORDED, NOT_RECORDED, LEGACY, OPERATIONAL_FAILURE or string

ChangeAttributionView#

Which conditions behind a check's result the change brought, and which World found at the review's base revision. It sits beside the result and never changes it: a condition already at the base is still a condition.

ChangeCountView#

How many conditions are of one change at one revision.

CheckLifecycle#

World's lifecycle disclosure for the evaluator version that answered, as the receipt recorded it. A deployment gate counts only GATING results (DeterministicCoverage::gate_effective_status), and only when it evaluates a deployment; the lifecycle alone permits or blocks nothing.

Type: string or string or string or string or string

CommentAddressEvaluationView#

One stored post-merge judgment of a finding comment.

CommentAddressOutcome#

Type: ADDRESSED, NOT_ADDRESSED, INCOMPLETE

CommentReaction#

Type: THUMBS_UP, THUMBS_DOWN, LAUGH, HOORAY, CONFUSED, HEART, ROCKET, EYES

CommentReactionView#

One stored reaction on the finding's root comment.

CompleteRecordView#

World's immutable record of the complete answer an omitted list comes from.

CustomerAssessment#

CustomerAssessmentDetail#

CustomerCheck#

CustomerChecks#

CustomerDecision#

CustomerDecisionBasis#

CustomerEvidenceRef#

CustomerFinding#

CustomerFindingValidation#

CustomerReviewDetail#

Dataset#

Type: reviews, finding_outcomes, finding_validations, spend, findings

DomainView#

EvidenceView#

Type: REQUIRED_PROPERTIES_ESTABLISHED, INCOMPLETE, NO_APPLICABLE_OBLIGATIONS

ExportEvidenceKind#

Type: repository_file, repository_file_at_commit, companion_repository_file, commit, workflow_run, world_entity, deterministic_test, recorded_read, text

ExportEvidenceRef#

ExportFindingLifecycle#

Type: NEW, UNCHANGED, RESOLVED, REINTRODUCED

ExportFindingSeverity#

Type: WARNING, SERIOUS

ExportReviewKind#

Type: PULL_REQUEST, DEPLOYMENT, PATCH

ExportReviewStatus#

Type: PENDING, RUNNING, COMPLETED, INCOMPLETE, FAILED, SUPERSEDED, STOPPED, EXCLUDED

ExportRow#

The closed row vocabulary of the existing raw-stream export operation.

Type: ReviewsExportRow or FindingOutcomesExportRow or FindingValidationsExportRow or SpendExportRow or FindingsExportRow

ExportValidation#

Type: UNKNOWN, CONFIRMED, DISMISSED, FIXED, ACCEPTED_RISK, ALREADY_COVERED

ExportValidationSource#

Type: ui, github_comment, proofline

FileProjection#

FilterChoice#

FindingCausalEdgeView#

FindingCausalGraphView#

FindingCausalNodeView#

FindingEvidenceClass#

Type: ANALYZER_BACKED, CODE_ONLY or string or string

FindingOutcomesCount#

FindingOutcomesDrilldown#

FindingOutcomesExportRow#

Exact shared aggregate counts for one admitted group and requested window.

FindingOutcomesGroupBy#

Type: repository, environment, risk_domain, severity, subject_kind

FindingOutcomesOutcome#

Type: FIXED, CONFIRMED, ACCEPTED_RISK, DISMISSED, ALREADY_COVERED, NO_RECORDED_OUTCOME

FindingOutcomesOutcomeCount#

FindingOutcomesPostMergeCount#

FindingOutcomesPostMergeCounts#

FindingOutcomesPostMergeOutcome#

Type: ADDRESSED, NOT_ADDRESSED, INCOMPLETE

FindingOutcomesSelector#

Type: outcome, code_changed, post_merge

FindingOutcomesValidationSources#

FindingSupport#

FindingValidationsExportRow#

One append-only validation, including its recorded actor display metadata. Missing historical actors stay absent; the export does not infer identity.

FindingsExportRow#

One immutable finding occurrence. Reference payloads and evidence values stay private.

GateState#

GateStatus#

Type: REQUESTED, EVALUATING, ALLOWED, BLOCKED, BYPASSED, SUPERSEDED

NotAssessedView#

OpenFindingCounts#

OpenItemEnvironment#

OpenItemsGapReason#

Type: NOT_STARTED, IN_PROGRESS, NOT_CONFIGURED, POLICY_EXCLUDED, EVIDENCE_UNAVAILABLE, HYPOTHESES_UNRESOLVED, MODEL_BUDGET_EXHAUSTED, FAILED, STOPPED, UNKNOWN

OpenItemsHeadState#

Type: CURRENT, OUTDATED, UNKNOWN

OpenItemsReviewStatus#

Type: PENDING, RUNNING, COMPLETED, INCOMPLETE, FAILED, SUPERSEDED, STOPPED, EXCLUDED, UNKNOWN

OpenItemsThreadUnknown#

Type: GITHUB_UNAVAILABLE, READ_LIMIT_EXCEEDED, TRUNCATED, RECORDED_THREAD_MISSING, REPOSITORY_UNAVAILABLE

OpenItemsThreads#

Type: object or object

OpenItemsView#

Recorded unresolved findings, accepted risks and assessment gaps. Coverage and notification suppression do not resolve a finding. These scalar counts make no claim about current heads, evaluated scope or threads.

Outcome#

Type: ALLOW, BLOCK

Override#

PassProjection#

PatchReviewRequest#

Local changes to review: a unified diff against a commit GitHub has.

PatchReviewResponse#

What a patch review request produced.

PermissionView#

Type: PERMIT, BLOCK

PlanProjection#

Problem#

RFC 9457 problem-details body. type is omitted and therefore about:blank: the title/detail pair carries the meaning.

PullRequestMergeGate#

RefusedEnvironment#

An environment a refusal names. external_key is how its pages are addressed.

RelatedReview#

RepositoryGuidance#

RepositoryName#

RepositoryNames#

RerunResponse#

Manual rerun: a new review of the same immutable subjects, under a fresh trigger key so history accumulates instead of overwriting.

ReviewActions#

ReviewDiffStats#

ReviewFilters#

ReviewOpenItems#

ReviewPage#

ReviewRoutingView#

Type: object or object or object

ReviewSummary#

ReviewedTreeCitationView#

One member of a review's declared tree that World cited.

ReviewsExportRow#

The NDJSON row and CSV column contract. Repository names are display data; the stable repository ID and recorded commit identify the reviewed input.

ReviewsMetadataStream#

UTF-8 metadata file. NDJSON contains one ExportRow per line; CSV contains that dataset's named columns and a header. This response is neither a JSON object nor a JSON array.

Type: string

RoutingFindingView#

RunNowMode#

Whether an explicit request may reuse a settled review of the live head.

Type: EXISTING_OR_NEW, FULL

RunNowRefusalView#

Why a run-now request created nothing, each reason with what the page needs to link the setting to change.

Type: object or object or object or object or object or object or object or object or object or object

RunNowRefused#

A run-now request that created nothing, as the 400 it is answered with. The refusal is a configuration fact, not a failure, and it is still sent as an RFC 9457 problem: title, status and detail are what a client that knows only problems shows, and repository_name and refusal are the extension members a client that knows refusals links from. During a rollout a page loaded from the previous bundle keeps working against this server, because a refusal was a 400 with a detail before too.

RunNowRequest#

An empty body keeps the run-now behavior existing clients request.

RunNowResponse#

What a run-now request produced: a review of the live head, created by this request or found already owning the head.

SpendAccountKind#

Type: DEPLOYMENT, TENANT_CREDENTIAL, UNATTRIBUTED

SpendExportRow#

UTC daily debit totals using only the account and transport recorded at charge time.

SubjectAuthorization#

One assessment's authorization of one subject, by identity. The display name is not the answer on its own: an environment's external key is unique within its organization and a display name is mutable metadata, so two environments of one review can carry the same one. Collapsing to it would leave a reader unable to tell which assessment authorized the subject and which one gapped, which is the confusion this field exists to remove.

SubjectView#

ThreadObservationFreshness#

Type: FRESH, STALE

ThreadObservationView#

A read of GitHub's thread state. observed_at is when Proofline read it.

ThreadProviderState#

Type: OPEN, RESOLVED

ThreadReplyEvidence#

Type: RECORDED, NONE_CONFIRMED, INCOMPLETE

UnresolvedReason#

World's reason an executed check did not settle. A gate weighs the three alike, and each asks the reader for a different response.

Type: string or string or string

UntrustedText#

Text that came out of the reviewer model, or out of a repository the model read. It is data, never markup, never a URL, never an instruction. The wrapper exists so the untrustedness cannot be lost on the way to a renderer: there is no field on a turn that carries this text under a name a client could mistake for something safe, and unwrapping it is a deliberate act in the client's own code.