Create a Flow

A Flow is a template that defines the required compliance checks for a type of release.

curl -s -X POST http://localhost:8080/api/v1/flows \
  -H "Content-Type: application/json" \
  -d '{
    "name": "standard-release",
    "description": "Standard production release checks",
    "requiredAttestations": ["security-scan", "code-review", "qa-signoff"]
  }' | jq .

Start a Trail

A Trail is a per-release evidence collection linked to a specific artifact (e.g., a container image).

curl -s -X POST http://localhost:8080/api/v1/trails \
  -H "Content-Type: application/json" \
  -d '{
    "flowId": "<flow-id-from-step-1>",
    "artifactName": "my-service",
    "artifactVersion": "1.4.2",
    "artifactDigest": "sha256:abc123..."
  }' | jq .

Record an Attestation

Attestations are individual evidence records. Record your security scan result:

curl -s -X POST http://localhost:8080/api/v1/trails/<trail-id>/attestations \
  -H "Content-Type: application/json" \
  -d '{
    "type": "security-scan",
    "passed": true,
    "details": "Trivy scan: 0 critical, 2 medium (accepted)",
    "attestedBy": "pipeline-bot"
  }' | jq .

Check Compliance

Evaluate whether the trail satisfies all flow requirements and is cleared for deployment:

curl -s http://localhost:8080/api/v1/trails/<trail-id>/compliance | jq .

When all required attestations are recorded and policies pass, the response will show "compliant": true and the artifact is cleared for deployment.

Evaluate the Deployment Gate

Use the deployment gate to get a binary deploy/block decision:

curl -s -X POST http://localhost:8080/api/v1/gate/evaluate \
  -H "Content-Type: application/json" \
  -d '{
    "trailId": "<trail-id>",
    "targetEnvironment": "production"
  }' | jq .