Get evidence

Returns one evidence record including requirement text, mappings, authorship, and revision metadata. Optional expansions via fields: mappedTests, gaps, attachments, tickets. attachments is empty when status is not_uploaded. File download URLs hosted by Scrut are never returned. Requires scope evidence:read or evidence:write.

curl -X GET "https://api.scrut.io/v1/evidence/92af7e7f-b18e-495b-bf92-61c23ebd34a7?fields=mappedTests%2Cgaps%2Cattachments" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer YOUR_API_TOKEN (JWT)"

import requests
import json

url = "https://api.scrut.io/v1/evidence/92af7e7f-b18e-495b-bf92-61c23ebd34a7?fields=mappedTests%2Cgaps%2Cattachments"
headers = {
  "Content-Type": "application/json",
  "Authorization": "Bearer YOUR_API_TOKEN (JWT)"
}

response = requests.get(url, headers=headers)
print(response.json())

const response = await fetch("https://api.scrut.io/v1/evidence/92af7e7f-b18e-495b-bf92-61c23ebd34a7?fields=mappedTests%2Cgaps%2Cattachments", {
  method: "GET",
  headers: {
  "Content-Type": "application/json",
  "Authorization": "Bearer YOUR_API_TOKEN (JWT)"
}
});

const data = await response.json();
console.log(data);

package main

import (
    "fmt"
    "net/http"
)

func main() {

    req, err := http.NewRequest("GET", "https://api.scrut.io/v1/evidence/92af7e7f-b18e-495b-bf92-61c23ebd34a7?fields=mappedTests%2Cgaps%2Cattachments", nil)
    if err != nil {
        panic(err)
    }

    req.Header.Set("Content-Type", "application/json")
    req.Header.Set("Authorization", "Bearer YOUR_API_TOKEN (JWT)")

    client := &http.Client{}
    resp, err := client.Do(req)
    if err != nil {
        panic(err)
    }
    defer resp.Body.Close()

    fmt.Println("Response Status:", resp.Status)
}

require 'net/http'
require 'json'

uri = URI('https://api.scrut.io/v1/evidence/92af7e7f-b18e-495b-bf92-61c23ebd34a7?fields=mappedTests%2Cgaps%2Cattachments')
http = Net::HTTP.new(uri.host, uri.port)
http.use_ssl = true

request = Net::HTTP::Get.new(uri)
request['Content-Type'] = 'application/json'
request['Authorization'] = 'Bearer YOUR_API_TOKEN (JWT)'

response = http.request(request)
puts response.body

{
  "data": {
    "evidenceId": "92af7e7f-b18e-495b-bf92-61c23ebd34a7",
    "evidenceName": "Identity Verification Procedure and Records",
    "status": "not_uploaded",
    "department": "Security",
    "assignees": [
      {
        "name": "Alex Rivera",
        "email": "alex@example.com",
        "isPrimary": true
      }
    ],
    "approvers": [
      {
        "name": "Alex Rivera",
        "email": "alex@example.com"
      }
    ],
    "isRelevant": true,
    "nextReviewDate": 1704067200000,
    "entities": [
      {
        "entityId": "8fa88e7b-eb16-4999-854a-2f407958740a",
        "entityName": "Organization Wide"
      }
    ],
    "mappedFrameworks": [
      {
        "frameworkId": "14c4c45d-6c31-4097-a02a-ad9cfd04850e",
        "frameworkName": "SOC 2"
      }
    ],
    "mappedControls": [
      {
        "controlId": "2aa1b21e-4705-47cd-b1a7-e74ed4808bc9",
        "controlCode": "DCH-14.2",
        "controlName": "Transfer Authorizations"
      }
    ],
    "mappedRequirements": [
      {
        "frameworkId": "14c4c45d-6c31-4097-a02a-ad9cfd04850e",
        "frameworkName": "SOC 2",
        "requirementId": "b7e1c4a2-6f30-4d8a-9c15-2a8e4f1b0d63",
        "requirementCode": "CC6.1",
        "requirementName": "Logical Access Security"
      }
    ],
    "gapStatus": "no_gaps",
    "evidenceRequirementText": "Retain identity verification records for each access review period.",
    "notRelevantReason": "Covered by the parent information security policy.",
    "effortEstimate": "low",
    "recurrence": "annually",
    "source": "Scrut",
    "addedBy": {
      "name": "Alex Rivera",
      "email": "alex@example.com"
    },
    "addedOn": 1704067200000,
    "lastModifiedBy": {
      "name": "Alex Rivera",
      "email": "alex@example.com"
    },
    "modifiedOn": 1704067200000,
    "revisionRequestedBy": {
      "name": "Alex Rivera",
      "email": "alex@example.com"
    },
    "revisionRequestedOn": 1704067200000,
    "rejectionReason": "The uploaded file does not cover the requested period.",
    "mappedTests": [
      {
        "testId": "test_authorized-users-access-tracked-log-sinks-gcp",
        "testName": "Authorized users' access to log sinks is tracked (GCP)",
        "status": "fix_required"
      }
    ],
    "gaps": [
      "Missing reviewer sign-off"
    ],
    "attachments": [
      {
        "displayName": "access-review.pdf",
        "type": "File",
        "url": "https://intranet.example.com/policies/isp-v3",
        "note": "Approved by the security lead.",
        "addedBy": {
          "name": "Alex Rivera",
          "email": "alex@example.com"
        },
        "addedOn": 1704067200000,
        "updatedBy": {
          "name": "Alex Rivera",
          "email": "alex@example.com"
        },
        "updatedOn": 1704067200000,
        "evidenceDate": 1704067200000,
        "isCurrentPeriod": true,
        "periodStart": 1704067200000,
        "periodEnd": 1704067200000
      }
    ],
    "tickets": [
      {
        "ticketId": "SEC-104",
        "source": "jira",
        "url": "https://jira.example/browse/SEC-104"
      }
    ]
  },
  "meta": {
    "requestId": "550e8400-e29b-41d4-a716-446655440000"
  }
}

{
  "error": {
    "code": "validation_failed",
    "message": "Request validation failed.",
    "details": [
      {
        "field": "status",
        "message": "status contains unknown value(s): unknown"
      }
    ]
  },
  "meta": {
    "requestId": "550e8400-e29b-41d4-a716-446655440000"
  }
}

{
  "error": {
    "code": "unauthorized",
    "message": "Missing, malformed, or invalid Bearer token.",
    "details": []
  },
  "meta": {
    "requestId": "550e8400-e29b-41d4-a716-446655440000"
  }
}

{
  "error": {
    "code": "token_stale",
    "message": "The access token is stale; obtain a new token.",
    "details": []
  },
  "meta": {
    "requestId": "550e8400-e29b-41d4-a716-446655440000"
  }
}

{
  "error": {
    "code": "rate_limit_exceeded",
    "message": "Rate limit exceeded.",
    "details": [
      {
        "retryAfterSec": 12
      }
    ]
  },
  "meta": {
    "requestId": "550e8400-e29b-41d4-a716-446655440000"
  }
}

{
  "error": {
    "code": "upstream_unavailable",
    "message": "Upstream service is unavailable.",
    "details": [
      {
        "dependency": "frameworks",
        "issue": "Failed to process frameworks."
      }
    ]
  },
  "meta": {
    "requestId": "550e8400-e29b-41d4-a716-446655440000"
  }
}

GET

/v1/evidence/{evidenceId}

GET

Base URLstring

Target server for requests. Edit to use your own host.

Bearer Token (JWT)

Bearer Tokenstring

Required

Machine access token from POST /oauth/token. Send Authorization: Bearer $SCRUT_ACCESS_TOKEN on every /v1 request.

path

evidenceIdstring

Required

Evidence identifier returned by list and get endpoints.

query

fieldsstring

Optional expansions. Default get response already includes core metadata; use this to add mappedTests, gaps, attachments, or tickets. Pass a comma-separated list (no spaces required). Allowed values: mappedTests, gaps, attachments, tickets.