/DOCS_INDEX
Documentation
Reference material for operators, auditors, and integrators of the Aiudit governance platform.
- [API-v1]→
External Integration API
REST endpoints, scopes, and audit semantics for GRC / SIEM integration.
- [GOV-01]→
AI Governance Framework Guide
Practical implementation notes across NIST AI RMF, ISO/IEC 42001, and the EU AI Act.
- [SEC-02]→
Security & Compliance
Attestations, cryptographic profile, and downloadable readiness receipts.
- [READ-01]→
Readiness Receipt
Generate a signed readiness receipt for auditors and underwriters.
/DOCS_FAQ
Documentation FAQ
How do I get an Aiudit API key?
Authorized operators issue API credentials from the authenticated /integrations console. Credentials are scoped to a strict subset of the issuer's RBAC role and shown once at issuance; secrets are stored only as SHA-256 hashes.
What export formats does Aiudit support for auditors?
Evidence packages export as OSCAL 1.1 SSP/SAP/SAR JSON bundles, structured JSON with a signed manifest, CycloneDX 1.6 SBOM/AIBOM, VEX statements, and a rendered auditor PDF including hash-chain excerpts.
How do external verifiers confirm evidence integrity?
Every package prints its SHA-384 payload hash, Merkle root, and Ed25519 signature. Verifiers post the identifier to /api/v1/verify or resolve the JWKS at /.well-known/aegis-jwks.json to recompute and compare — no Aiudit account required.
Are there SDKs for the Aiudit API?
The API is standard REST + JSON with an OpenAPI 3.1 spec at /api/v1/openapi.json. TypeScript and Python usage examples ship in /docs/api; auto-generated SDKs (openapi-generator, orval) work directly against the spec.
How is the API versioned?
The current major version is v1 and is stable. Breaking changes ship under a new URL prefix (/api/v2/...); additive changes ship under v1 with the change noted in the OpenAPI spec and audit-logged.
Does Aiudit run in air-gapped or sovereign environments?
Yes. The DEPLOYMENT_MODE=airgapped setting disables all outbound calls, switches ledger anchoring to a local HSM-backed Merkle log, and enables signed offline evidence bundles for cross-domain transfer through approved guards.