Evidence bundle readiness metadata / ZIP download
GET /api/v1/bundles/{bundleId}
GET https://api.trustverify.co.uk/api/v1/bundles/{bundleId}
GET /api/v1/bundles/{bundleId} returns JSON readiness metadata; GET /api/v1/bundles/{bundleId}.zip streams the ZIP. 404 when the bundle was never registered for your account.
Archive layout
{bundleId}.zip
├── report.pdf # bundle cover sheet (RPT-016)
├── reports/RPT-001-{checkId}.pdf # one PDF per included report type
├── evidence.json # machine-readable check record + what is included
└── manifest.json # sha256 + byte length of every other entry (not signed)manifest.json.files[] covers every entry in the archive except manifest.json itself. Bundles are not signed: signature and signatureAlgorithm are null and integrity is sha256_hashes_only. Re-hashing each file against the manifest shows whether anything changed since you downloaded it; it does not prove who produced the archive. manifest.json.unavailableReports[] and evidence.json.unavailableReports[] list any requested type that was not produced, with the reason — a placeholder document is never substituted.
Parameters#
| Field | Type | Description |
|---|---|---|
| bundleId (path)required | string |
Example request#
curl -sS -X GET 'https://api.trustverify.co.uk/api/v1/bundles/bnd_chk_123' \
-H "Authorization: Bearer $TRUSTVERIFY_API_KEY"Responses#
200 Readiness metadata (JSON) or the bundle itself (application/zip with .zip suffix)
| Field | Type | Description |
|---|---|---|
| bundleIdrequired | string | |
| statusrequired | string: "ready" | |
| downloadUrlrequired | string | |
| signatureAlgorithmrequired | null | Always null: bundles are not signed. The manifest carries sha256 hashes only. |
| integrityrequired | string: "sha256_hashes_only" | |
| includeTypesrequired | array of string | Report types the ZIP will really contain |
| unavailableReportsrequired | array of object | |
| unavailableReports[].typerequired | string | |
| unavailableReports[].reasonrequired | string | |
| generatedAtrequired | string |