EQTY LabDocs

List agent assessments

List an organization's individual-agent assessments, newest first, optionally for one agent, one program version, or one status. A program administrator sees every assessment; anyone else sees those they started and those of programs they currently review, and an API key without full access only those its submit_agent_assessments or review_agent_assessments scope reads. A reviewer's queue is reviewable=true&status=in_review; status=in_review alone also returns in-review assessments the caller started, and to an administrator every in-review assessment

gethttps://localhost:10001/api/v1/organizations/{orgId}/assessments
bash
curl --request GET \
  --url 'https://localhost:10001/api/v1/organizations/{orgId}/assessments' \
  --header 'Authorization: Bearer <token>'
javascript
const response = await fetch("https://localhost:10001/api/v1/organizations/{orgId}/assessments", {
  method: "GET",
  headers: {
    "Authorization": "Bearer <token>"
  }
});

const data = await response.json();
typescript
interface Assessment {
  agentDid?: string;
  agentName?: string;
  agentUrn?: string;
  canCertify?: boolean;
  canEdit?: boolean;
  canReview?: boolean;
  configuration?: Record<string, unknown>;
  configurationPinnedAt?: string;
  configurationPinnedByUserId?: string;
  createdAt?: string;
  createdBy?: string;
  createdByDid?: string;
  createdByUserId?: string;
  draftVersion?: number;
  hasUnsubmittedChanges?: boolean;
  latestSubmission?: Record<string, unknown>;
  observation?: Record<string, unknown>;
  organizationId?: number;
  profile?: Record<string, unknown>;
  profilePinnedAt?: string;
  profilePinnedByUserId?: string;
  programManifestCid?: string;
  programSlug?: string;
  programUuid?: string;
  status?: "draft" | "in_review" | "passed" | "failed";
  uuid?: string;
}

const response = await fetch("https://localhost:10001/api/v1/organizations/{orgId}/assessments", {
  method: "GET",
  headers: {
    "Authorization": "Bearer <token>"
  }
});
if (!response.ok) throw new Error(`${response.status} ${response.statusText}`);

const data: Assessment[] = await response.json();
python
import requests

response = requests.get(
    "https://localhost:10001/api/v1/organizations/{orgId}/assessments",
    headers={
        "Authorization": "Bearer <token>",
    },
)
response.raise_for_status()
print(response.json())
go
package main

import (
	"fmt"
	"io"
	"net/http"
)

func main() {
	req, err := http.NewRequest(http.MethodGet, "https://localhost:10001/api/v1/organizations/{orgId}/assessments", nil)
	if err != nil {
		panic(err)
	}
	req.Header.Set("Authorization", "Bearer <token>")

	res, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer res.Body.Close()

	data, err := io.ReadAll(res.Body)
	if err != nil {
		panic(err)
	}
	fmt.Println(res.Status, string(data))
}
java
import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

public class Example {
    public static void main(String[] args) throws Exception {
        HttpRequest request = HttpRequest.newBuilder()
            .uri(URI.create("https://localhost:10001/api/v1/organizations/{orgId}/assessments"))
            .header("Authorization", "Bearer <token>")
            .method("GET", HttpRequest.BodyPublishers.noBody())
            .build();

        HttpResponse<String> response = HttpClient.newHttpClient()
            .send(request, HttpResponse.BodyHandlers.ofString());
        System.out.println(response.statusCode() + " " + response.body());
    }
}
csharp
using System.Net.Http.Headers;

using var client = new HttpClient();
using var request = new HttpRequestMessage(HttpMethod.Get, "https://localhost:10001/api/v1/organizations/{orgId}/assessments");
request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", "<token>");

using var response = await client.SendAsync(request);
Console.WriteLine($"{(int)response.StatusCode} {await response.Content.ReadAsStringAsync()}");
php
<?php

$ch = curl_init('https://localhost:10001/api/v1/organizations/{orgId}/assessments');
curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'GET',
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer <token>',
    ],
    CURLOPT_RETURNTRANSFER => true,
]);

$response = curl_exec($ch);
$status = curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
echo $status . " " . $response . PHP_EOL;
ruby
require "net/http"

uri = URI("https://localhost:10001/api/v1/organizations/{orgId}/assessments")
request = Net::HTTP::Get.new(uri)
request["Authorization"] = "Bearer <token>"

response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: uri.scheme == "https") do |http|
  http.request(request)
end
puts "#{response.code} #{response.body}"
rust
// Cargo.toml dependencies: reqwest, tokio (features "full")

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    let response = reqwest::Client::new()
        .get("https://localhost:10001/api/v1/organizations/{orgId}/assessments")
        .header("Authorization", "Bearer <token>")
        .send()
        .await?;

    println!("{} {}", response.status(), response.text().await?);
    Ok(())
}

Authorizations

  • BearerAuth · API key in header "Authorization" — Type "Bearer" followed by a space and JWT token.

Parameters

Path parameters

NameTypeDescription
orgId
required
string

Organization ID or UUID (urn:uuid optional)

Query parameters

NameTypeDescription
agentUrnstring

Only assessments of this agent

programIdstring

Only assessments against this program version: UUID (urn:uuid optional), slug:agent-baseline@1.0.0, or urn:cid:<manifest cid>

statusstring (enum)

Only assessments with this status

One ofdraftin_reviewpassedfailed

reviewableboolean

Only assessments the caller may review: those of programs they currently review that they did not start. With status=in_review, the caller's review queue

Responses

200Assessments

application/json

Array of core.Assessment

  • agentDidstringread-only

    The agent key that signed the pinned state; absent until a configuration is pinned

  • agentNamestringread-only

    The name the agent registry gave the agent, read when the assessment was started and on every submission; a label for those who cannot see the agent, never evidence. Absent when the registry gave none

  • agentUrnstringread-only

    The agent's control-plane registry ID, whose UUID is the root of the assessment's integrity graph

  • canCertifybooleanread-only

    Whether the caller may ask for the certification its passed newest submission earned: nothing is recorded for it yet, certified or revoked, they neither started the assessment nor made the submission, and they administer programs, or still review its program and made one of the reviews it rests on. False until the assessment passes. Only a single assessment's response works it out; lists leave it false

  • canEditbooleanread-only

    Whether the caller may change and submit the draft: they started the assessment

  • canReviewbooleanread-only

    Whether the caller may review its submissions: they review its program and did not start it

  • configurationobjectread-only

    Pinned to the draft; a submission keeps its own copy, which a later pin does not change

    Show properties
    • cidstring

      urn:cid of Document, registered with the Integrity Service

    • documentobject

      The AgentConfigurationV1 document, including its coverage. Returned as stored, so its bytes are not canonical: cid is over its JCS (RFC 8785) form, which a verifier recomputes before hashing

    • schemaVersionstring
  • configurationPinnedAtstring<date-time>read-only
  • configurationPinnedByUserIdstringread-only
  • createdAtstring<date-time>read-only
  • createdBystringread-only
  • createdByDidstringread-only
  • createdByUserIdstringread-only

    Who started it, the only member who may change its draft; absent on assessments started before it was recorded

  • draftVersionintegerread-only

    Increases with every change to the draft; submitting with it freezes exactly the draft the caller saw

  • hasUnsubmittedChangesbooleanread-only

    The draft changed since its newest submission, or was never submitted

  • latestSubmissionobjectread-only

    Absent until the first submission

    Show properties
    • controlCountinteger

      The program's controls, each of which is reviewed

    • draftVersioninteger

      The draft version it froze

    • lastReviewedAtstring<date-time>
    • numberinteger
    • reviewedCountinteger

      Controls with at least one review

    • statusobject

      One ofin_reviewpassedfailed

      Show properties

      object (enum) · one of in_review, passed, failed

    • submittedAtstring<date-time>
    • uuidstring

      urn:uuid form

  • observationobjectread-only
    Show properties
    • correlationIdstring

      The exchange's correlation ID

    • observedAtstring<date-time>

      When the gateway verified the exchange carrying it

    • requestobject

      Per-request detail, evidence rather than configuration

      Show properties
      • modelstring
      • providerstring
      • systemPromptCidstring
      • toolsstring[]
    • stateCidstring

      The observed state in the gateway's store

    • subAgentstring

      The custom agent's sub-agent that made the request, /-separated when nested; it shares the agent's configuration

    • viperVersionstring

      The Viper version that captured it

  • organizationIdintegerread-only
  • profileobjectread-only

    Pinned to the draft, optionally; a submission keeps its own copy, which a later pin does not change

    Show properties
    • cidstring

      urn:cid of Document, registered with the Integrity Service

    • documentobject

      The AgentOperatingProfileV1 document, as the agent registry stores it. cid is over its JCS (RFC 8785) form

    • versioninteger

      The agent's version number of it, as the agent registry numbers them

  • profilePinnedAtstring<date-time>read-only
  • profilePinnedByUserIdstringread-only
  • programManifestCidstringread-only

    The requirements the agent is judged against

  • programSlugstringread-only

    The program the version belongs to, which its reviewers are assigned to

  • programUuidstringread-only

    urn:uuid form

  • statusobjectread-only

    One ofdraftin_reviewpassedfailed

    Show properties

    object (enum) · one of draft, in_review, passed, failed

  • uuidstringread-only

    urn:uuid form

Examplejson
[
  {}
]

400Bad request - Invalid organization ID, program ID, status, or reviewable

application/json
  • errorstring
Examplejson
{
  "error": "Invalid request body"
}

401Unauthorized - Authentication required

application/json
  • errorstring
Examplejson
{
  "error": "Invalid request body"
}

403Forbidden - No organization access

application/json
  • errorstring
Examplejson
{
  "error": "Invalid request body"
}

404Program not found

application/json
  • errorstring
Examplejson
{
  "error": "Invalid request body"
}

500Internal server error

application/json
  • errorstring
Examplejson
{
  "error": "Invalid request body"
}