docs

List a project's evidence metadata

GET /iso/projects/{projectId}/evidence

Scope evidence:read Plan Growth+

Requires the evidence:read scope. Needs the iso27001 plan feature.

Example

curl "https://api.autociso.io/api/v1/iso/projects/<projectId>/evidence" \
  -H "Authorization: Bearer <your-api-token>"

Response 200

{
  "data": [
    {
      "collectedAt": "2026-10-13T04:00:00Z",
      "controlId": "A.5.15",
      "createdAt": "2026-10-13T04:00:03Z",
      "id": "ev_1hk3m2b9r1xd",
      "payloadType": "json",
      "sourceType": "okta",
      "stale": false
    },
    {
      "collectedAt": "2026-06-30T12:00:00Z",
      "controlId": "A.8.13",
      "createdAt": "2026-06-30T12:04:00Z",
      "id": "ev_1hj0w7c3k5qe",
      "payloadType": "pdf",
      "sourceType": "manual",
      "stale": true
    }
  ],
  "error": null,
  "meta": {
    "limit": 25,
    "offset": 0,
    "total": 120
  }
}

Path parameters

  • projectId string required

Query parameters

  • limit integer
    Page size. minimum 1, maximum 100, default 25
  • offset integer
    Rows to skip (offset mode). Cannot be combined with cursor. minimum 0, maximum 10000, default 0
  • cursor string
    An opaque cursor taken from meta.nextCursor of the previous page (cursor mode). Valid for 24 hours and bound to the token and the query; do not parse or construct it.
  • sort[createdAt] string
    Sort direction for createdAt.
    "asc" | "desc"
  • sort[id] string
    Sort direction for id.
    "asc" | "desc"
  • filter[controlId][eq] string
    Filter controlId (eq).
  • filter[controlId][in] string
    Filter controlId (in). Comma-separated, at most 50 values.
  • filter[createdAt][gte] string (date-time)
    Filter createdAt (gte).
  • filter[createdAt][lt] string (date-time)
    Filter createdAt (lt).
  • filter[id][eq] string
    Filter id (eq).
  • filter[id][in] string
    Filter id (in). Comma-separated, at most 50 values.
  • filter[sourceType][eq] string
    Filter sourceType (eq).
  • filter[sourceType][in] string
    Filter sourceType (in). Comma-separated, at most 50 values.

Returns

The data field of the standard { data, error, meta } envelope:

An array of object:

  • collectedAt string (date-time) required
    Collection time (UTC).
  • controlId string required
    Primary Annex A control id.
  • createdAt string (date-time) required
    Creation time (UTC); the sync field (append-only, G-16).
  • id string required
    Evidence id (ev_).
  • payloadType string required
    json, screenshot, pdf or text.
  • sourceType string required
    Collection source, for example aws, okta, manual.
  • stale boolean required
    The evidence is older than the control's maximum age.
  • No other fields.

Errors

Status Code Retry Meaning
400 - no The request is invalid.
401 - no The token is missing, malformed, expired or revoked.
402 - no The organisation’s plan does not include the feature this route needs.
403 - no The token may not use this route.
404 - no The resource does not exist in this organisation.
429 - yes Rate limit or row budget exceeded; retry after the time in Retry-After.
500 - no Unexpected server error.
503 - yes A dependency is temporarily unavailable; retry later.
Last reviewed: 2026-10-13

Was this page helpful?

Esc