Skip to main content
GET
Get Run Defensibility Packet

Behavior

A scoped key needs runs:defensibility:read and a binding to the run’s engine. Model-call bodies are withheld; everything else is returned as recorded and is not redacted, so redaction.fields_redacted is 0. run.status is the stored value in capitals. The event timeline is cut off after about the first 1,000 events, and the packet does not say when it was cut. A daily job deletes runs created more than 90 days ago, with their packet evidence, unless Nexio has flagged the run to be kept indefinitely. See Defensibility and trace.

Authorizations

Authorization
string
header
required

Send the key as Authorization: Bearer <key>. Two kinds of key exist.

Organization keys are issued in the portal (Settings, then API keys), each bound to one environment, shaped nx_<environment slug>_<64 hex>. They carry no capabilities and pass every capability check, with one exception: routes under /records, /actions, /operations, /api/v1/engines/{id}/opportunities, /api/v1/graph and /api/v1/catalog/documents accept an organization key only when its environment is live, and refuse any other with 403 scoped_key_required. Revocation takes effect within 60 seconds.

Scoped keys are issued by Nexio on request, shaped nxsk_v1_<24 hex key id>_<43 character secret>. Each is bound to one org, one environment, a set of engines and a set of capabilities. A malformed, unknown or revoked nxsk_ key fails with 401 and is never retried as an organization key. Revocation takes effect on the next request. A scoped key without a route's capability gets 403 insufficient_capability; a scoped key not bound to the engine gets 403 engine_binding_forbidden.

Key-grantable capabilities: engines:read, runs:write, runs:read, runs:defensibility:read, runs:test, catalog:read, catalog:documents:read, webhooks:manage, conversations:use, conversations:export, records:read, records:opportunities:run, actions:write, actions:read, graph:read, records:analyze.

Routes that accept organization keys only (every scoped key gets 403 insufficient_capability): environment management, engine create, update, configuration and publish, and conversation instance authoring. Each operation description names the capability a scoped key needs.

Path Parameters

run_id
string<uuid>
required

Response

The customer-facing defensibility packet.

version
string
required
Example:

"1"

run
object
required

Run identity and lineage.

provenance_coverage
enum<string>
required

none when the run recorded no provenance map; an absent map must not read as sourced-clean.

Available options:
present,
none
model_calls
object[]
required

Stage attestation that a model call ran, without the prompt or completion body.

external_calls
object[]
required

Enrichment calls that fed the run, with their payloads.

events
object[]
required

The run event timeline in time order, cut off after the first 1,000 events.

llm_summary
object
required

Aggregate model cost and token usage for the run.

redaction
object
required
output
object

The run's stored output. Unlike GET /api/v1/runs/{run_id}, the matching operator block is not trimmed and no per-reader field policy is applied.

provenance
object

Per-element provenance map, present when the run recorded one.

Last modified on September 25, 2026