Skip to main content

Get release evidence package

GET 
/releases/:id/evidence

Returns a structured, auditable evidence package for a release. The package contains:

  • Release metadata (id, name, version, status, releasedAt, riskLevel)
  • Approval chain: each approval stage with approver, timestamp, and comment
  • Quality checklist completion status
  • Entry summary: count by status plus a list of released/completed entries
  • GitHub evidence: per-entry commits (SHA, author, message, committedAt) and merged PRs
  • CI gate summary: per-commit CI result (passed/failed/pending) and test counts
  • completenessScore (0–100): mean of three fractions — entries with linked commit, entries with passing CI, and checklist completeness

If an evidence signing key is configured for the organization, the response includes:

  • X-Align-Evidence-Signature: sha256=<hex> — HMAC-SHA256 of the canonical JSON body
  • X-Align-Evidence-Key-Prefix — prefix of the key used (for rotation tracking)

Releases in planning/active/in_progress/testing state return status: incomplete. Releases in completed or released state return status: complete.

Not available to project-scoped keys (403 scope_violation).

Permission: read:release.

Request​

Evidence package returned successfully.

Response Headers
    X-Align-Evidence-Signature

    HMAC-SHA256 of the response body (sha256=<hex>). Present only when a signing key is configured.

    X-Align-Evidence-Key-Prefix

    Prefix of the signing key used (e.g. evk_9a3b1c2d). Use to track key rotation.