curl --request GET \
--url https://api.usenexio.com/api/v1/runs/{run_id}/defensibility-packet \
--header 'Authorization: Bearer <token>'import requests
url = "https://api.usenexio.com/api/v1/runs/{run_id}/defensibility-packet"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.usenexio.com/api/v1/runs/{run_id}/defensibility-packet', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));{
"version": "1",
"run": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"status": "<string>",
"started_at": "2023-11-07T05:31:56Z",
"environment": "<string>",
"cost_rollup": {
"input_tokens": 123,
"output_tokens": 123,
"cost_micros": 123
},
"completed_at": "2023-11-07T05:31:56Z",
"engine_id": "<string>",
"engine_type": "<string>",
"engine_config_version_hash": "<string>",
"trace_id": "<string>",
"submitted_by": "<string>",
"submitted_by_label": "<string>",
"parent_run_id": "<string>",
"triggered_by_run_id": "<string>",
"error_details": {},
"warning_details": "<unknown>"
},
"provenance_coverage": "present",
"model_calls": [
{
"stage": "<string>",
"blob_type": "<string>",
"blob": null
}
],
"external_calls": [
{
"stage": "<string>",
"blob_type": "<string>",
"blob": {}
}
],
"events": [
{}
],
"llm_summary": {},
"redaction": {
"fields_redacted": 1
},
"output": {},
"provenance": {}
}{
"code": "invalid_run_id",
"message": "run id must be a valid UUID"
}{
"code": "unauthorized",
"message": "Missing or invalid API key"
}{
"code": "engine_binding_forbidden",
"message": "API key is not bound to this run's engine"
}{
"code": "run_not_found",
"message": "run not found"
}{
"code": "rate_limited",
"message": "Rate limit exceeded"
}{
"code": "internal_error",
"message": "Internal server error"
}{
"code": "auth_unavailable",
"message": "API key authentication is temporarily unavailable"
}{
"code": "request_timeout",
"message": "Request timed out"
}Get run defensibility packet
Export the evidence behind a run: identity, output, provenance, external calls, timeline and model usage.
curl --request GET \
--url https://api.usenexio.com/api/v1/runs/{run_id}/defensibility-packet \
--header 'Authorization: Bearer <token>'import requests
url = "https://api.usenexio.com/api/v1/runs/{run_id}/defensibility-packet"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.usenexio.com/api/v1/runs/{run_id}/defensibility-packet', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));{
"version": "1",
"run": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"status": "<string>",
"started_at": "2023-11-07T05:31:56Z",
"environment": "<string>",
"cost_rollup": {
"input_tokens": 123,
"output_tokens": 123,
"cost_micros": 123
},
"completed_at": "2023-11-07T05:31:56Z",
"engine_id": "<string>",
"engine_type": "<string>",
"engine_config_version_hash": "<string>",
"trace_id": "<string>",
"submitted_by": "<string>",
"submitted_by_label": "<string>",
"parent_run_id": "<string>",
"triggered_by_run_id": "<string>",
"error_details": {},
"warning_details": "<unknown>"
},
"provenance_coverage": "present",
"model_calls": [
{
"stage": "<string>",
"blob_type": "<string>",
"blob": null
}
],
"external_calls": [
{
"stage": "<string>",
"blob_type": "<string>",
"blob": {}
}
],
"events": [
{}
],
"llm_summary": {},
"redaction": {
"fields_redacted": 1
},
"output": {},
"provenance": {}
}{
"code": "invalid_run_id",
"message": "run id must be a valid UUID"
}{
"code": "unauthorized",
"message": "Missing or invalid API key"
}{
"code": "engine_binding_forbidden",
"message": "API key is not bound to this run's engine"
}{
"code": "run_not_found",
"message": "run not found"
}{
"code": "rate_limited",
"message": "Rate limit exceeded"
}{
"code": "internal_error",
"message": "Internal server error"
}{
"code": "auth_unavailable",
"message": "API key authentication is temporarily unavailable"
}{
"code": "request_timeout",
"message": "Request timed out"
}Behavior
A scoped key needsruns:defensibility:read and a binding to the run’s engine. Model-call bodies are withheld; everything else is returned as recorded and is not redacted, so redaction.fields_redacted is 0. run.status is the stored value in capitals. The event timeline is cut off after about the first 1,000 events, and the packet does not say when it was cut. A daily job deletes runs created more than 90 days ago, with their packet evidence, unless Nexio has flagged the run to be kept indefinitely. See Defensibility and trace.Authorizations
Send the key as Authorization: Bearer <key>. Two kinds of key exist.
Organization keys are issued in the portal (Settings, then API keys),
each bound to one environment, shaped nx_<environment slug>_<64 hex>. They carry
no capabilities and pass every capability check, with one exception:
routes under /records, /actions, /operations,
/api/v1/engines/{id}/opportunities, /api/v1/graph and
/api/v1/catalog/documents accept an
organization key only when its environment is live, and refuse any
other with 403 scoped_key_required. Revocation takes effect within 60
seconds.
Scoped keys are issued by Nexio on request, shaped
nxsk_v1_<24 hex key id>_<43 character secret>. Each is bound to one
org, one environment, a set of engines and a set of capabilities. A
malformed, unknown or revoked nxsk_ key fails with 401 and is never
retried as an organization key. Revocation takes effect on the next
request. A scoped key without a route's capability gets 403
insufficient_capability; a scoped key not bound to the engine gets 403
engine_binding_forbidden.
Key-grantable capabilities: engines:read, runs:write, runs:read,
runs:defensibility:read, runs:test, catalog:read,
catalog:documents:read, webhooks:manage, conversations:use,
conversations:export, records:read, records:opportunities:run,
actions:write, actions:read, graph:read, records:analyze.
Routes that accept organization keys only (every scoped key gets 403
insufficient_capability): environment management, engine create,
update, configuration and publish, and conversation instance
authoring. Each operation description names the capability a scoped
key needs.
Path Parameters
Response
The customer-facing defensibility packet.
"1"
Run identity and lineage.
Hide child attributes
Hide child attributes
The stored status in upper case (PENDING, RUNNING, COMPLETED, DEGRADED, FAILED, CANCELLED), unlike the lower-case status of GET /api/v1/runs/{run_id}.
When the run was created.
A readable label for submitted_by, for example the API key name.
none when the run recorded no provenance map; an absent map must not read as sourced-clean.
present, none The run event timeline in time order, cut off after the first 1,000 events.
Aggregate model cost and token usage for the run.
The run's stored output. Unlike GET /api/v1/runs/{run_id}, the matching operator block is not trimmed and no per-reader field policy is applied.
Per-element provenance map, present when the run recorded one.