V77 TrustDevelopers
Get an API key

API reference

Base URL https://v77trust.com/api/v1. Authenticate with Authorization: Bearer v77_…. Generated from the OpenAPI 3.1 spec.

Account

Check your key and workspace.

Check your API key

get/api/v1/meKey role: auditor or higher

Returns the workspace and key behind the request. Use it to confirm a key works.

Responses

  • 200Success.
  • 401Missing or invalid API key.
  • 403The API key's role isn't allowed to do this.
  • 429Rate limited (120 requests/minute per key). See Retry-After.
curl "https://v77trust.com/api/v1/me" \
  -H "Authorization: Bearer $V77_API_KEY"
{
  "object": "api_context",
  "workspace": {
    "id": "…",
    "name": "EuroBank AG"
  },
  "apiKey": {
    "id": "…",
    "name": "CI pipeline",
    "prefix": "v77_Ab12Cd34",
    "role": "ai_owner"
  },
  "apiVersion": "2026-11-01"
}

AI systems

Your AI inventory (EU AI Act Art. 49 / Art. 26).

List AI systems

get/api/v1/systemsKey role: auditor or higher

Your AI inventory, newest first.

Parameters

  • limitqueryinteger

    Items per page, 1–100.

  • cursorquerystring

    next_cursor from the previous page.

  • riskTierqueryprohibited | high_risk | limited | minimal | gpai | unclassified

    Filter by tier, or unclassified.

  • lifecycleStatusquerydiscovered | pilot | production | retired

    Filter by stage.

  • sectorquerystring

    Filter by sector id.

  • qquerystring

    Search name and intended purpose.

Responses

  • 200Success.
  • 400Invalid request (validation_failed, invalid_parameter, invalid_json…).
  • 401Missing or invalid API key.
  • 403The API key's role isn't allowed to do this.
  • 429Rate limited (120 requests/minute per key). See Retry-After.
curl "https://v77trust.com/api/v1/systems" \
  -H "Authorization: Bearer $V77_API_KEY"
{
  "object": "list",
  "data": [
    {
      "object": "ai_system",
      "id": "…",
      "name": "…",
      "description": "…",
      "intendedPurpose": "…",
      "roleInValueChain": "provider",
      "sector": "…",
      "riskTier": "prohibited",
      "gpai": false,
      "classificationNotes": "…",
      "lifecycleStatus": "discovered",
      "businessUnit": "…",
      "vendor": "…",
      "version": "…"
    }
  ],
  "has_more": false,
  "next_cursor": "…"
}

Add an AI system

post/api/v1/systemsKey role: ai_owner or higher

Adds a system to the inventory. Classify it next to set its risk tier.

Parameters

  • Idempotency-Keyheaderstring

    Unique value (e.g. a UUID) per operation. Retrying with the same key returns the original response for 24 hours.

Body

  • namestringrequired
  • descriptionstring
  • intendedPurposestring
  • roleInValueChainprovider | deployer | importer | distributor
  • sectorstring
  • lifecycleStatusdiscovered | pilot | production | retired
  • businessUnitstring
  • vendorstring
  • versionstring
  • euDatabaseIdstring

Responses

  • 201Success.
  • 400Invalid request (validation_failed, invalid_parameter, invalid_json…).
  • 401Missing or invalid API key.
  • 402Your plan's limit has been reached.
  • 403The API key's role isn't allowed to do this.
  • 429Rate limited (120 requests/minute per key). See Retry-After.
curl -X POST "https://v77trust.com/api/v1/systems" \
  -H "Authorization: Bearer $V77_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Retail credit scoring",
    "intendedPurpose": "Assess creditworthiness of consumers applying for loans",
    "roleInValueChain": "provider",
    "sector": "banking_credit",
    "lifecycleStatus": "production",
    "businessUnit": "Retail Banking",
    "vendor": "In-house (XGBoost)"
  }'
{
  "object": "ai_system",
  "id": "…",
  "name": "…",
  "description": "…",
  "intendedPurpose": "…",
  "roleInValueChain": "provider",
  "sector": "…",
  "riskTier": "prohibited",
  "gpai": false,
  "classificationNotes": "…",
  "lifecycleStatus": "discovered",
  "businessUnit": "…",
  "vendor": "…",
  "version": "…"
}

Get an AI system

get/api/v1/systems/{id}Key role: auditor or higher

Parameters

  • idpathstringrequired

    AI system id.

Responses

  • 200Success.
  • 401Missing or invalid API key.
  • 403The API key's role isn't allowed to do this.
  • 404Not found in this workspace.
  • 429Rate limited (120 requests/minute per key). See Retry-After.
curl "https://v77trust.com/api/v1/systems/$SYSTEM_ID" \
  -H "Authorization: Bearer $V77_API_KEY"
{
  "object": "ai_system",
  "id": "…",
  "name": "…",
  "description": "…",
  "intendedPurpose": "…",
  "roleInValueChain": "provider",
  "sector": "…",
  "riskTier": "prohibited",
  "gpai": false,
  "classificationNotes": "…",
  "lifecycleStatus": "discovered",
  "businessUnit": "…",
  "vendor": "…",
  "version": "…"
}

Update an AI system

patch/api/v1/systems/{id}Key role: ai_owner or higher

Only the fields you send change. The risk tier changes only through classification. Send markReviewed: true to record a periodic review.

Parameters

  • idpathstringrequired

    AI system id.

Body

  • namestring
  • descriptionstring
  • intendedPurposestring
  • roleInValueChainprovider | deployer | importer | distributor
  • sectorstring
  • lifecycleStatusdiscovered | pilot | production | retired
  • businessUnitstring
  • vendorstring
  • versionstring
  • euDatabaseIdstring
  • markReviewedboolean

Responses

  • 200Success.
  • 400Invalid request (validation_failed, invalid_parameter, invalid_json…).
  • 401Missing or invalid API key.
  • 403The API key's role isn't allowed to do this.
  • 404Not found in this workspace.
  • 429Rate limited (120 requests/minute per key). See Retry-After.
curl -X PATCH "https://v77trust.com/api/v1/systems/$SYSTEM_ID" \
  -H "Authorization: Bearer $V77_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "…",
    "description": "…",
    "intendedPurpose": "…",
    "roleInValueChain": "provider",
    "sector": "…",
    "lifecycleStatus": "discovered",
    "businessUnit": "…",
    "vendor": "…",
    "version": "…",
    "euDatabaseId": "…",
    "markReviewed": false
  }'
{
  "object": "ai_system",
  "id": "…",
  "name": "…",
  "description": "…",
  "intendedPurpose": "…",
  "roleInValueChain": "provider",
  "sector": "…",
  "riskTier": "prohibited",
  "gpai": false,
  "classificationNotes": "…",
  "lifecycleStatus": "discovered",
  "businessUnit": "…",
  "vendor": "…",
  "version": "…"
}

Classification

Risk tier and obligations under the EU AI Act.

List classification questions

get/api/v1/classification/questionsKey role: auditor or higher

The EU AI Act screening questionnaire (prohibited practices, Annex I/III high-risk, Art. 50 transparency, GPAI).

Responses

  • 200Success.
  • 401Missing or invalid API key.
  • 403The API key's role isn't allowed to do this.
  • 429Rate limited (120 requests/minute per key). See Retry-After.
curl "https://v77trust.com/api/v1/classification/questions" \
  -H "Authorization: Bearer $V77_API_KEY"
{
  "object": "list",
  "data": [
    {
      "object": "classification_question",
      "id": "…",
      "section": "prohibited",
      "prompt": "…",
      "help": "…",
      "weight": "hard"
    }
  ],
  "has_more": false,
  "next_cursor": "…"
}

Get a system's classification

get/api/v1/systems/{id}/classificationKey role: auditor or higher

Parameters

  • idpathstringrequired

    AI system id.

Responses

  • 200Success.
  • 401Missing or invalid API key.
  • 403The API key's role isn't allowed to do this.
  • 404Not found in this workspace.
  • 429Rate limited (120 requests/minute per key). See Retry-After.
curl "https://v77trust.com/api/v1/systems/$SYSTEM_ID/classification" \
  -H "Authorization: Bearer $V77_API_KEY"
{
  "object": "classification",
  "systemId": "…",
  "riskTier": "prohibited",
  "gpai": false,
  "systemicRisk": false,
  "art6_3ExemptionClaimed": false,
  "art25ProviderEscalation": false,
  "reasons": [
    "…"
  ],
  "answers": {},
  "assessmentId": "…",
  "dryRun": false,
  "disclaimer": "…"
}

Classify a system

post/api/v1/systems/{id}/classificationKey role: ai_owner or higher

Answers each question id with yes, no or na (unanswered = no). Stores the tier and opens an assessment with the controls that apply. Use dryRun to preview without saving.

Parameters

  • idpathstringrequired

    AI system id.

Body

  • answersobjectrequired
  • createAssessmentboolean
  • dryRunboolean

Responses

  • 200Success.
  • 400Invalid request (validation_failed, invalid_parameter, invalid_json…).
  • 401Missing or invalid API key.
  • 402Your plan's limit has been reached.
  • 403The API key's role isn't allowed to do this.
  • 404Not found in this workspace.
  • 429Rate limited (120 requests/minute per key). See Retry-After.
curl -X POST "https://v77trust.com/api/v1/systems/$SYSTEM_ID/classification" \
  -H "Authorization: Bearer $V77_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "answers": {
      "hr_annex_iii_credit": "yes",
      "lim_interaction": "no"
    }
  }'
{
  "object": "classification",
  "riskTier": "high_risk",
  "gpai": false,
  "reasons": [
    "High-risk Annex III indicator (hr_annex_iii_credit)."
  ],
  "assessmentId": "…"
}

List a system's obligations

get/api/v1/systems/{id}/obligationsKey role: auditor or higher

EU AI Act obligations for the system's tier and your role in the value chain (provider, deployer…).

Parameters

  • idpathstringrequired

    AI system id.

Responses

  • 200Success.
  • 401Missing or invalid API key.
  • 403The API key's role isn't allowed to do this.
  • 404Not found in this workspace.
  • 409Conflict (state doesn't allow this, or Idempotency-Key reused).
  • 429Rate limited (120 requests/minute per key). See Retry-After.
curl "https://v77trust.com/api/v1/systems/$SYSTEM_ID/obligations" \
  -H "Authorization: Bearer $V77_API_KEY"
{
  "object": "list",
  "data": [
    {
      "object": "obligation",
      "id": "…",
      "title": "…",
      "article": "…",
      "detail": "…",
      "appliesTo": "…"
    }
  ],
  "has_more": false,
  "next_cursor": "…"
}

Controls & evidence

Controls crosswalked to the AI Act, NIST AI RMF, ISO 42001, GDPR, DORA; tamper-evident evidence.

List the control library

get/api/v1/controlsKey role: auditor or higher

Controls with their crosswalk to the EU AI Act, NIST AI RMF, ISO/IEC 42001, GDPR, DORA and ISO/IEC 27001.

Parameters

  • riskTierqueryprohibited | high_risk | limited | minimal | gpai

    Only controls that apply to this tier.

Responses

  • 200Success.
  • 401Missing or invalid API key.
  • 403The API key's role isn't allowed to do this.
  • 429Rate limited (120 requests/minute per key). See Retry-After.
curl "https://v77trust.com/api/v1/controls" \
  -H "Authorization: Bearer $V77_API_KEY"
{
  "object": "list",
  "data": [
    {
      "object": "control",
      "id": "…",
      "code": "…",
      "title": "…",
      "description": "…",
      "area": "…",
      "appliesTo": [
        null
      ],
      "references": {
        "euAiAct": null,
        "nistAiRmf": null,
        "iso42001": null,
        "gdpr": null,
        "dora": null,
        "iso27001": null
      }
    }
  ],
  "has_more": false,
  "next_cursor": "…"
}

List a system's controls

get/api/v1/systems/{id}/controlsKey role: auditor or higher

Controls on the system's latest assessment, with status and a readiness summary.

Parameters

  • idpathstringrequired

    AI system id.

Responses

  • 200Success.
  • 401Missing or invalid API key.
  • 403The API key's role isn't allowed to do this.
  • 404Not found in this workspace.
  • 429Rate limited (120 requests/minute per key). See Retry-After.
curl "https://v77trust.com/api/v1/systems/$SYSTEM_ID/controls" \
  -H "Authorization: Bearer $V77_API_KEY"
{
  "object": "list",
  "data": [
    {
      "object": "system_control",
      "controlId": "…",
      "code": "…",
      "title": "…",
      "area": "…",
      "status": "not_started",
      "notes": "…",
      "references": {
        "euAiAct": null,
        "nistAiRmf": null,
        "iso42001": null,
        "gdpr": null,
        "dora": null,
        "iso27001": null
      }
    }
  ],
  "has_more": false,
  "next_cursor": "…"
}

Update a control's status

patch/api/v1/systems/{id}/controls/{code}Key role: ai_owner or higher

Marking a control implemented needs at least one evidence item linked to it (422 evidence_required otherwise).

Parameters

  • idpathstringrequired

    AI system id.

  • codepathstringrequired

    Control code, e.g. V77-DOC-01.

Body

  • statusnot_started | in_progress | implemented | not_applicable | waived
  • notesstring

Responses

  • 200Success.
  • 400Invalid request (validation_failed, invalid_parameter, invalid_json…).
  • 401Missing or invalid API key.
  • 403The API key's role isn't allowed to do this.
  • 404Not found in this workspace.
  • 409Conflict (state doesn't allow this, or Idempotency-Key reused).
  • 422Request understood but refused by a compliance rule.
  • 429Rate limited (120 requests/minute per key). See Retry-After.
curl -X PATCH "https://v77trust.com/api/v1/systems/$SYSTEM_ID/controls/V77-RMS-01" \
  -H "Authorization: Bearer $V77_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "status": "implemented",
    "notes": "Risk register approved by the model risk committee."
  }'
{
  "object": "system_control",
  "controlId": "…",
  "code": "…",
  "title": "…",
  "area": "…",
  "status": "not_started",
  "notes": "…",
  "references": {
    "euAiAct": "…",
    "nistAiRmf": "…",
    "iso42001": "…",
    "gdpr": "…",
    "dora": "…",
    "iso27001": "…"
  }
}

List evidence

get/api/v1/evidenceKey role: auditor or higher

Parameters

  • limitqueryinteger

    Items per page, 1–100.

  • cursorquerystring

    next_cursor from the previous page.

  • systemIdquerystring

    Filter by system.

  • controlCodequerystring

    Filter by control code.

Responses

  • 200Success.
  • 400Invalid request (validation_failed, invalid_parameter, invalid_json…).
  • 401Missing or invalid API key.
  • 403The API key's role isn't allowed to do this.
  • 429Rate limited (120 requests/minute per key). See Retry-After.
curl "https://v77trust.com/api/v1/evidence" \
  -H "Authorization: Bearer $V77_API_KEY"
{
  "object": "list",
  "data": [
    {
      "object": "evidence",
      "id": "…",
      "systemId": "…",
      "controlId": "…",
      "title": "…",
      "filename": "…",
      "contentType": "…",
      "sha256": "…",
      "prevSha256": "…",
      "createdAt": "2026-11-08T09:30:00.000Z"
    }
  ],
  "has_more": false,
  "next_cursor": "…"
}

Upload evidence

post/api/v1/evidenceKey role: ai_owner or higher

multipart/form-data, up to 25 MB. The file is SHA-256 hashed and chained to the previous item.

Parameters

  • Idempotency-Keyheaderstring

    Unique value (e.g. a UUID) per operation. Retrying with the same key returns the original response for 24 hours.

Body (multipart/form-data)

  • filestring (binary)required
  • titlestring
  • systemIdstring
  • controlCodestring

Responses

  • 201Success.
  • 400Invalid request (validation_failed, invalid_parameter, invalid_json…).
  • 401Missing or invalid API key.
  • 402Your plan's limit has been reached.
  • 403The API key's role isn't allowed to do this.
  • 404Not found in this workspace.
  • 429Rate limited (120 requests/minute per key). See Retry-After.
curl -X POST "https://v77trust.com/api/v1/evidence" \
  -H "Authorization: Bearer $V77_API_KEY" \
  -F file=@report.pdf -F title="Validation report" -F systemId=$SYSTEM_ID -F controlCode=V77-DOC-01
{
  "object": "evidence",
  "id": "…",
  "systemId": "…",
  "controlId": "…",
  "title": "…",
  "filename": "…",
  "contentType": "…",
  "sha256": "…",
  "prevSha256": "…",
  "createdAt": "2026-11-08T09:30:00.000Z"
}

Get evidence metadata

get/api/v1/evidence/{id}Key role: auditor or higher

Parameters

  • idpathstringrequired

    Evidence id.

Responses

  • 200Success.
  • 401Missing or invalid API key.
  • 403The API key's role isn't allowed to do this.
  • 404Not found in this workspace.
  • 429Rate limited (120 requests/minute per key). See Retry-After.
curl "https://v77trust.com/api/v1/evidence/$EVIDENCE_ID" \
  -H "Authorization: Bearer $V77_API_KEY"
{
  "object": "evidence",
  "id": "…",
  "systemId": "…",
  "controlId": "…",
  "title": "…",
  "filename": "…",
  "contentType": "…",
  "sha256": "…",
  "prevSha256": "…",
  "createdAt": "2026-11-08T09:30:00.000Z"
}

Download an evidence file

get/api/v1/evidence/{id}/contentKey role: auditor or higher

The X-V77-SHA256 header carries the hash recorded at upload, so you can verify the file.

Parameters

  • idpathstringrequired

    Evidence id.

Responses

  • 200Success.
  • 401Missing or invalid API key.
  • 403The API key's role isn't allowed to do this.
  • 404Not found in this workspace.
  • 429Rate limited (120 requests/minute per key). See Retry-After.
curl "https://v77trust.com/api/v1/evidence/$EVIDENCE_ID/content" \
  -H "Authorization: Bearer $V77_API_KEY"
"…"

Findings & incidents

Issues and serious-incident reporting (Art. 73, DORA, GDPR Art. 33).

List findings

get/api/v1/findingsKey role: auditor or higher

Parameters

  • limitqueryinteger

    Items per page, 1–100.

  • cursorquerystring

    next_cursor from the previous page.

  • systemIdquerystring

    Filter by system.

  • statusqueryopen | in_progress | resolved | accepted

    Filter by status.

  • severityquerylow | medium | high | critical

    Filter by severity.

Responses

  • 200Success.
  • 400Invalid request (validation_failed, invalid_parameter, invalid_json…).
  • 401Missing or invalid API key.
  • 403The API key's role isn't allowed to do this.
  • 429Rate limited (120 requests/minute per key). See Retry-After.
curl "https://v77trust.com/api/v1/findings" \
  -H "Authorization: Bearer $V77_API_KEY"
{
  "object": "list",
  "data": [
    {
      "object": "finding",
      "id": "…",
      "systemId": "…",
      "assessmentId": "…",
      "title": "…",
      "description": "…",
      "severity": "low",
      "status": "open",
      "frameworkRef": "…",
      "createdAt": "2026-11-08T09:30:00.000Z",
      "updatedAt": "2026-11-08T09:30:00.000Z"
    }
  ],
  "has_more": false,
  "next_cursor": "…"
}

Open a finding

post/api/v1/findingsKey role: ai_owner or higher

Record an issue from a model test, pen test or audit. Open high or critical findings block the compliance gate.

Parameters

  • Idempotency-Keyheaderstring

    Unique value (e.g. a UUID) per operation. Retrying with the same key returns the original response for 24 hours.

Body

  • systemIdstringrequired
  • titlestringrequired
  • descriptionstring
  • severitylow | medium | high | critical
  • frameworkRefstring

Responses

  • 201Success.
  • 400Invalid request (validation_failed, invalid_parameter, invalid_json…).
  • 401Missing or invalid API key.
  • 403The API key's role isn't allowed to do this.
  • 404Not found in this workspace.
  • 429Rate limited (120 requests/minute per key). See Retry-After.
curl -X POST "https://v77trust.com/api/v1/findings" \
  -H "Authorization: Bearer $V77_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "systemId": "…",
    "title": "Approval rate gap above 4/5ths rule",
    "severity": "high",
    "frameworkRef": "EU AI Act Art. 10(2)(f)"
  }'
{
  "object": "finding",
  "id": "…",
  "systemId": "…",
  "assessmentId": "…",
  "title": "…",
  "description": "…",
  "severity": "low",
  "status": "open",
  "frameworkRef": "…",
  "createdAt": "2026-11-08T09:30:00.000Z",
  "updatedAt": "2026-11-08T09:30:00.000Z"
}

Get a finding

get/api/v1/findings/{id}Key role: auditor or higher

Parameters

  • idpathstringrequired

    Finding id.

Responses

  • 200Success.
  • 401Missing or invalid API key.
  • 403The API key's role isn't allowed to do this.
  • 404Not found in this workspace.
  • 429Rate limited (120 requests/minute per key). See Retry-After.
curl "https://v77trust.com/api/v1/findings/$FINDING_ID" \
  -H "Authorization: Bearer $V77_API_KEY"
{
  "object": "finding",
  "id": "…",
  "systemId": "…",
  "assessmentId": "…",
  "title": "…",
  "description": "…",
  "severity": "low",
  "status": "open",
  "frameworkRef": "…",
  "createdAt": "2026-11-08T09:30:00.000Z",
  "updatedAt": "2026-11-08T09:30:00.000Z"
}

Update a finding

patch/api/v1/findings/{id}Key role: ai_owner or higher

Parameters

  • idpathstringrequired

    Finding id.

Body

  • titlestring
  • descriptionstring
  • severitylow | medium | high | critical
  • statusopen | in_progress | resolved | accepted
  • frameworkRefstring

Responses

  • 200Success.
  • 400Invalid request (validation_failed, invalid_parameter, invalid_json…).
  • 401Missing or invalid API key.
  • 403The API key's role isn't allowed to do this.
  • 404Not found in this workspace.
  • 429Rate limited (120 requests/minute per key). See Retry-After.
curl -X PATCH "https://v77trust.com/api/v1/findings/$FINDING_ID" \
  -H "Authorization: Bearer $V77_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "title": "…",
    "description": "…",
    "severity": "low",
    "status": "open",
    "frameworkRef": "…"
  }'
{
  "object": "finding",
  "id": "…",
  "systemId": "…",
  "assessmentId": "…",
  "title": "…",
  "description": "…",
  "severity": "low",
  "status": "open",
  "frameworkRef": "…",
  "createdAt": "2026-11-08T09:30:00.000Z",
  "updatedAt": "2026-11-08T09:30:00.000Z"
}

List incidents

get/api/v1/incidentsKey role: auditor or higher

Parameters

  • limitqueryinteger

    Items per page, 1–100.

  • cursorquerystring

    next_cursor from the previous page.

  • systemIdquerystring

    Filter by system.

  • statusquerystring

    Filter by status.

  • seriousqueryboolean

    true for serious incidents only.

Responses

  • 200Success.
  • 400Invalid request (validation_failed, invalid_parameter, invalid_json…).
  • 401Missing or invalid API key.
  • 403The API key's role isn't allowed to do this.
  • 429Rate limited (120 requests/minute per key). See Retry-After.
curl "https://v77trust.com/api/v1/incidents" \
  -H "Authorization: Bearer $V77_API_KEY"
{
  "object": "list",
  "data": [
    {
      "object": "incident",
      "id": "…",
      "systemId": "…",
      "title": "…",
      "description": "…",
      "severity": "low",
      "status": "open",
      "seriousIncident": false,
      "euArticleRef": "Art. 73(2)",
      "awareAt": "2026-11-08T09:30:00.000Z",
      "occurredAt": "2026-11-08T09:30:00.000Z",
      "impactSummary": "…",
      "rootCause": "…",
      "correctiveActions": "…"
    }
  ],
  "has_more": false,
  "next_cursor": "…"
}

Report an incident

post/api/v1/incidentsKey role: ai_owner or higher

Logs an incident and computes its reporting deadlines from awareAt: EU AI Act Art. 73 (15 days, 10 days for a death, 2 days for widespread or critical-infrastructure harm), DORA major-incident reports, GDPR Art. 33 (72 hours).

Parameters

  • Idempotency-Keyheaderstring

    Unique value (e.g. a UUID) per operation. Retrying with the same key returns the original response for 24 hours.

Body

  • systemIdstring
  • titlestringrequired
  • descriptionstring
  • severitylow | medium | high | critical
  • statusopen | investigating | mitigated | closed
  • seriousIncidentboolean
  • euArticleRefArt. 73(2) | Art. 73(3) | Art. 73(4)
  • awareAtstring (date-time)
  • occurredAtstring (date-time)
  • impactSummarystring
  • doraMajorboolean
  • gdprBreachboolean

Responses

  • 201Success.
  • 400Invalid request (validation_failed, invalid_parameter, invalid_json…).
  • 401Missing or invalid API key.
  • 403The API key's role isn't allowed to do this.
  • 404Not found in this workspace.
  • 429Rate limited (120 requests/minute per key). See Retry-After.
curl -X POST "https://v77trust.com/api/v1/incidents" \
  -H "Authorization: Bearer $V77_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "systemId": "…",
    "title": "Scoring model rejected eligible applicants",
    "severity": "high",
    "seriousIncident": true,
    "euArticleRef": "Art. 73(2)",
    "awareAt": "2026-11-01T09:00:00Z",
    "gdprBreach": false
  }'
{
  "object": "incident",
  "id": "…",
  "systemId": "…",
  "title": "…",
  "description": "…",
  "severity": "low",
  "status": "open",
  "seriousIncident": false,
  "euArticleRef": "Art. 73(2)",
  "awareAt": "2026-11-08T09:30:00.000Z",
  "occurredAt": "2026-11-08T09:30:00.000Z",
  "impactSummary": "…",
  "rootCause": "…",
  "correctiveActions": "…"
}

Get an incident

get/api/v1/incidents/{id}Key role: auditor or higher

Parameters

  • idpathstringrequired

    Incident id.

Responses

  • 200Success.
  • 401Missing or invalid API key.
  • 403The API key's role isn't allowed to do this.
  • 404Not found in this workspace.
  • 429Rate limited (120 requests/minute per key). See Retry-After.
curl "https://v77trust.com/api/v1/incidents/$INCIDENT_ID" \
  -H "Authorization: Bearer $V77_API_KEY"
{
  "object": "incident",
  "id": "…",
  "systemId": "…",
  "title": "…",
  "description": "…",
  "severity": "low",
  "status": "open",
  "seriousIncident": false,
  "euArticleRef": "Art. 73(2)",
  "awareAt": "2026-11-08T09:30:00.000Z",
  "occurredAt": "2026-11-08T09:30:00.000Z",
  "impactSummary": "…",
  "rootCause": "…",
  "correctiveActions": "…"
}

Update an incident

patch/api/v1/incidents/{id}Key role: ai_owner or higher

Send authorityNotifiedAt, gdprNotifiedAt or doraInitialAt / doraIntermediateAt / doraFinalAt to record that a report was filed; the matching deadline becomes done.

Parameters

  • idpathstringrequired

    Incident id.

Body

  • titlestring
  • descriptionstring
  • severitylow | medium | high | critical
  • statusopen | investigating | mitigated | closed
  • impactSummarystring
  • rootCausestring
  • correctiveActionsstring
  • authorityNotifiedAtstring (date-time)
  • gdprNotifiedAtstring (date-time)
  • doraInitialAtstring (date-time)
  • doraIntermediateAtstring (date-time)
  • doraFinalAtstring (date-time)

Responses

  • 200Success.
  • 400Invalid request (validation_failed, invalid_parameter, invalid_json…).
  • 401Missing or invalid API key.
  • 403The API key's role isn't allowed to do this.
  • 404Not found in this workspace.
  • 429Rate limited (120 requests/minute per key). See Retry-After.
curl -X PATCH "https://v77trust.com/api/v1/incidents/$INCIDENT_ID" \
  -H "Authorization: Bearer $V77_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "title": "…",
    "description": "…",
    "severity": "low",
    "status": "open",
    "impactSummary": "…",
    "rootCause": "…",
    "correctiveActions": "…",
    "authorityNotifiedAt": "2026-11-08T09:30:00.000Z",
    "gdprNotifiedAt": "2026-11-08T09:30:00.000Z",
    "doraInitialAt": "2026-11-08T09:30:00.000Z",
    "doraIntermediateAt": "2026-11-08T09:30:00.000Z",
    "doraFinalAt": "2026-11-08T09:30:00.000Z"
  }'
{
  "object": "incident",
  "id": "…",
  "systemId": "…",
  "title": "…",
  "description": "…",
  "severity": "low",
  "status": "open",
  "seriousIncident": false,
  "euArticleRef": "Art. 73(2)",
  "awareAt": "2026-11-08T09:30:00.000Z",
  "occurredAt": "2026-11-08T09:30:00.000Z",
  "impactSummary": "…",
  "rootCause": "…",
  "correctiveActions": "…"
}

Testing

Adversarial red-team testing (Art. 15, OWASP LLM Top 10).

List red-team runs

get/api/v1/systems/{id}/redteam-runsKey role: auditor or higher

Parameters

  • idpathstringrequired

    AI system id.

  • limitqueryinteger

    Items per page, 1–100.

  • cursorquerystring

    next_cursor from the previous page.

Responses

  • 200Success.
  • 401Missing or invalid API key.
  • 403The API key's role isn't allowed to do this.
  • 404Not found in this workspace.
  • 429Rate limited (120 requests/minute per key). See Retry-After.
curl "https://v77trust.com/api/v1/systems/$SYSTEM_ID/redteam-runs" \
  -H "Authorization: Bearer $V77_API_KEY"
{
  "object": "list",
  "data": [
    {
      "object": "redteam_run",
      "id": "…",
      "systemId": "…",
      "provider": "…",
      "summary": {
        "total": null,
        "passed": null,
        "failed": null,
        "needsReview": null
      },
      "results": [
        null
      ],
      "createdAt": "2026-11-08T09:30:00.000Z"
    }
  ],
  "has_more": false,
  "next_cursor": "…"
}

Run the red-team suite

post/api/v1/systems/{id}/redteam-runsKey role: ai_owner or higher

Sends 16 adversarial scenarios (jailbreaks, prompt injection, data leaks, harmful content, tool misuse; mapped to OWASP LLM Top 10 and EU AI Act Art. 15) to a configured provider or your own HTTPS chat endpoint. Runs synchronously (typically 10–60 s). targetAuthToken is used for this run only and never stored.

Parameters

  • idpathstringrequired

    AI system id.

  • Idempotency-Keyheaderstring

    Unique value (e.g. a UUID) per operation. Retrying with the same key returns the original response for 24 hours.

Body

  • providerstring

    mock, openai, anthropic, azure, workers_ai (if configured).

  • systemPromptstring

    Your production system prompt, to test your guardrails.

  • targetEndpointUrlstring

    HTTPS endpoint accepting {messages:[…]} and returning {content} or OpenAI-style choices.

  • targetAuthTokenstring

    Sent as Bearer token to targetEndpointUrl.

Responses

  • 201Success.
  • 400Invalid request (validation_failed, invalid_parameter, invalid_json…).
  • 401Missing or invalid API key.
  • 403The API key's role isn't allowed to do this.
  • 404Not found in this workspace.
  • 429Rate limited (120 requests/minute per key). See Retry-After.
  • 502The model under test failed to respond.
curl -X POST "https://v77trust.com/api/v1/systems/$SYSTEM_ID/redteam-runs" \
  -H "Authorization: Bearer $V77_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "targetEndpointUrl": "https://ai.example.eu/v1/chat",
    "targetAuthToken": "…",
    "systemPrompt": "You are a banking assistant…"
  }'
{
  "object": "redteam_run",
  "id": "…",
  "systemId": "…",
  "provider": "…",
  "summary": {
    "total": 0,
    "passed": 0,
    "failed": 0,
    "needsReview": 0
  },
  "results": [
    {
      "scenarioId": "…",
      "category": "jailbreak",
      "name": "…",
      "verdict": "pass",
      "reason": "…",
      "prompt": "…",
      "response": "…",
      "reviewedBy": {
        "name": null,
        "at": null,
        "passed": null
      },
      "owaspLlmRef": "…",
      "euAiActRef": "…"
    }
  ],
  "createdAt": "2026-11-08T09:30:00.000Z"
}

Get a red-team run

get/api/v1/redteam-runs/{id}Key role: auditor or higher

Parameters

  • idpathstringrequired

    Run id.

Responses

  • 200Success.
  • 401Missing or invalid API key.
  • 403The API key's role isn't allowed to do this.
  • 404Not found in this workspace.
  • 429Rate limited (120 requests/minute per key). See Retry-After.
curl "https://v77trust.com/api/v1/redteam-runs/$RUN_ID" \
  -H "Authorization: Bearer $V77_API_KEY"
{
  "object": "redteam_run",
  "id": "…",
  "systemId": "…",
  "provider": "…",
  "summary": {
    "total": 0,
    "passed": 0,
    "failed": 0,
    "needsReview": 0
  },
  "results": [
    {
      "scenarioId": "…",
      "category": "jailbreak",
      "name": "…",
      "verdict": "pass",
      "reason": "…",
      "prompt": "…",
      "response": "…",
      "reviewedBy": {
        "name": null,
        "at": null,
        "passed": null
      },
      "owaspLlmRef": "…",
      "euAiActRef": "…"
    }
  ],
  "createdAt": "2026-11-08T09:30:00.000Z"
}

Release gate

Block deployments that aren't ready.

Check the compliance gate

get/api/v1/compliance-gateKey role: auditor or higher

Should this AI system ship? Checks control readiness (default ≥70%), open high/critical findings, Annex IV documentation and the latest red-team run. With strict=true a blocked gate returns 422 so your CI step fails.

Parameters

  • systemIdquerystringrequired

    AI system id.

  • minReadinessqueryinteger

    Required readiness percent, 0–100.

  • strictqueryboolean

    Return 422 when blocked.

Responses

  • 200Success.
  • 400Invalid request (validation_failed, invalid_parameter, invalid_json…).
  • 401Missing or invalid API key.
  • 403The API key's role isn't allowed to do this.
  • 404Not found in this workspace.
  • 422Gate blocked (strict=true).
  • 429Rate limited (120 requests/minute per key). See Retry-After.
curl "https://v77trust.com/api/v1/compliance-gate?systemId=$SYSTEMID" \
  -H "Authorization: Bearer $V77_API_KEY"
{
  "object": "compliance_gate",
  "passed": false,
  "status": "blocked",
  "readinessPercent": 54,
  "blockers": [
    "2 open high/critical finding(s) must be remediated before release.",
    "High-risk control readiness is 54%, below required gate threshold of 70%."
  ],
  "warnings": []
}

Audit trail

Hash-chained record for auditors and regulators.

List audit events

get/api/v1/audit-logKey role: auditor or higher

Append-only, SHA-256 hash-chained record of every change in the workspace, newest first.

Parameters

  • limitqueryinteger

    Items per page, 1–100.

  • cursorquerystring

    next_cursor from the previous page.

  • actionquerystring

    e.g. system.classified

  • entityTypequerystring

    e.g. ai_system

  • entityIdquerystring

    Entity id.

Responses

  • 200Success.
  • 400Invalid request (validation_failed, invalid_parameter, invalid_json…).
  • 401Missing or invalid API key.
  • 403The API key's role isn't allowed to do this.
  • 429Rate limited (120 requests/minute per key). See Retry-After.
curl "https://v77trust.com/api/v1/audit-log" \
  -H "Authorization: Bearer $V77_API_KEY"
{
  "object": "list",
  "data": [
    {
      "object": "audit_event",
      "id": "…",
      "action": "…",
      "entityType": "…",
      "entityId": "…",
      "actor": {
        "type": null,
        "email": null,
        "id": null
      },
      "detail": {},
      "prevSha256": "…",
      "sha256": "…",
      "createdAt": "2026-11-08T09:30:00.000Z"
    }
  ],
  "has_more": false,
  "next_cursor": "…"
}

Verify the audit chain

get/api/v1/audit-log/verifyKey role: auditor or higher

Recomputes every hash and reports whether any entry was altered, removed or reordered.

Responses

  • 200Success.
  • 401Missing or invalid API key.
  • 403The API key's role isn't allowed to do this.
  • 429Rate limited (120 requests/minute per key). See Retry-After.
curl "https://v77trust.com/api/v1/audit-log/verify" \
  -H "Authorization: Bearer $V77_API_KEY"
{
  "object": "audit_chain_verification",
  "valid": false,
  "entries": 0,
  "firstBrokenEntryId": "…",
  "reason": "…",
  "headSha256": "…",
  "verifiedAt": "2026-11-08T09:30:00.000Z"
}

Webhooks

Get notified when things change.

List event types

get/api/v1/webhook-eventsKey role: auditor or higher

Responses

  • 200Success.
  • 401Missing or invalid API key.
  • 403The API key's role isn't allowed to do this.
  • 429Rate limited (120 requests/minute per key). See Retry-After.
curl "https://v77trust.com/api/v1/webhook-events" \
  -H "Authorization: Bearer $V77_API_KEY"
{}

List webhook endpoints

get/api/v1/webhook-endpointsKey role: admin or higher

Responses

  • 200Success.
  • 401Missing or invalid API key.
  • 403The API key's role isn't allowed to do this.
  • 429Rate limited (120 requests/minute per key). See Retry-After.
curl "https://v77trust.com/api/v1/webhook-endpoints" \
  -H "Authorization: Bearer $V77_API_KEY"
{
  "object": "list",
  "data": [
    {
      "object": "webhook_endpoint",
      "id": "…",
      "url": "…",
      "events": [
        null
      ],
      "active": false,
      "createdAt": "2026-11-08T09:30:00.000Z",
      "secret": "…"
    }
  ],
  "has_more": false,
  "next_cursor": "…"
}

Create a webhook endpoint

post/api/v1/webhook-endpointsKey role: admin or higher

The signing secret is in this response only.

Parameters

  • Idempotency-Keyheaderstring

    Unique value (e.g. a UUID) per operation. Retrying with the same key returns the original response for 24 hours.

Body

  • urlstringrequired

    Public HTTPS URL.

  • eventsstring[]required

Responses

  • 201Success.
  • 400Invalid request (validation_failed, invalid_parameter, invalid_json…).
  • 401Missing or invalid API key.
  • 403The API key's role isn't allowed to do this.
  • 429Rate limited (120 requests/minute per key). See Retry-After.
curl -X POST "https://v77trust.com/api/v1/webhook-endpoints" \
  -H "Authorization: Bearer $V77_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://grc.example.eu/hooks/v77",
    "events": [
      "system.tier_changed",
      "incident.created"
    ]
  }'
{
  "object": "webhook_endpoint",
  "id": "…",
  "url": "…",
  "events": [
    "…"
  ],
  "active": false,
  "createdAt": "2026-11-08T09:30:00.000Z",
  "secret": "…"
}

Delete a webhook endpoint

delete/api/v1/webhook-endpoints/{id}Key role: admin or higher

Parameters

  • idpathstringrequired

    Endpoint id.

Responses

  • 200Success.
  • 401Missing or invalid API key.
  • 403The API key's role isn't allowed to do this.
  • 404Not found in this workspace.
  • 429Rate limited (120 requests/minute per key). See Retry-After.
curl -X DELETE "https://v77trust.com/api/v1/webhook-endpoints/$ENDPOINT_ID" \
  -H "Authorization: Bearer $V77_API_KEY"
{
  "object": "webhook_endpoint",
  "id": "…",
  "deleted": true
}