JSON-Transkript abrufen
# Fetch a JSON transcript (default algorithm: HMAC-SHA256)
curl "https://api.knogin.com/v1/evidence/ev_abc123/provenance" \
-H "Authorization: Bearer $TOKEN"
# 200 OK
# {
# "evidence_id": "ev_abc123",
# "tenant_id": "tnt_123",
# "records": [
# {
# "id": "01HFXY...",
# "operation": "evidence.create",
# "actor_id": "user_42",
# "actor_kind": "user",
# "content_hash": "sha256:b94d...",
# "parent_hash": null,
# "signature": "<hex>",
# "signature_alg": "hmac-sha256",
# "signed_at": "2026-05-08T10:00:00Z",
# "trace_id": "0af7651916cd43dd8448eb211c80319c",
# "job_id": null
# }
# ],
# "merkle_root": "sha256:...",
# "root_signature": "<hex>",
# "root_signature_alg": "hmac-sha256",
# "format": "json",
# "version": "2026.4"
# }
# Same transcript, post-quantum signatures:
curl "https://api.knogin.com/v1/evidence/ev_abc123/provenance?algorithm=ml-dsa-65" \
-H "Authorization: Bearer $TOKEN"
PROV-O JSON-LD-Transkript abrufen
# Fetch the same transcript as PROV-O JSON-LD
curl "https://api.knogin.com/v1/evidence/ev_abc123/provenance?format=jsonld" \
-H "Authorization: Bearer $TOKEN"
# 200 OK
# {
# "@context": [
# "https://www.w3.org/ns/prov",
# { "argus": "https://schema.knogin.com/argus/v1#" }
# ],
# "@type": "prov:Bundle",
# "@id": "argus:evidence/ev_abc123/provenance",
# "argus:tenant_id": "tnt_123",
# "argus:merkle_root": "sha256:...",
# "argus:root_signature": "<hex>",
# "argus:root_signature_alg": "hmac-sha256",
# "@graph": [
# {
# "@id": "argus:provenance/01HFXY",
# "@type": "prov:Activity",
# "prov:startedAtTime": "2026-05-08T10:00:00Z",
# "argus:operation": "evidence.create",
# "argus:content_hash": "sha256:b94d...",
# "argus:signature": "<hex>",
# "argus:signature_alg": "hmac-sha256",
# "argus:trace_id": "0af7651916cd43dd8448eb211c80319c",
# "prov:wasGeneratedBy": { "@id": "argus:agent/user_42", "@type": "prov:Agent" },
# "prov:wasDerivedFrom": null
# }
# ]
# }
Transkript server-seitig verifizieren
# Server-side verification of a transcript fetched earlier.
curl -X POST https://api.knogin.com/v1/evidence/ev_abc123/provenance/verify \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
-d "{\"transcript\": $(cat transcript.json)}"
# 200 OK (intact)
# {
# "valid": true,
# "evidence_id": "ev_abc123",
# "broken_links": [],
# "checked_records": 5,
# "merkle_root_verified": true
# }
# 200 OK (tampered: a single byte changed in record 01HFXY)
# {
# "valid": false,
# "evidence_id": "ev_abc123",
# "broken_links": [
# { "record_id": "01HFXY...", "reason": "content_hash_mismatch" }
# ],
# "checked_records": 5,
# "merkle_root_verified": false
# }
Offline-Verifikation (TypeScript-SDK)
// Offline verification with @argus/client (TypeScript).
// HMAC verification stays server-side; ML-DSA-65 transcripts can be verified
// locally using the public verify keys from /v1/.well-known/provenance-keys.
import { ArgusClient } from "@argus/client";
const argus = new ArgusClient({
baseUrl: "https://api.knogin.com",
token: process.env.ARGUS_TOKEN!,
});
const transcript = await argus.evidence.getProvenance("ev_abc123", {
format: "json",
algorithm: "ml-dsa-65",
});
// No network round-trip; the helper fetches /v1/.well-known/provenance-keys
// once per kid, caches the result, and verifies signatures + Merkle root.
const result = await argus.evidence.verifyProvenanceLocal(transcript);
if (!result.valid) {
console.error("Tampered transcript", result.brokenLinks);
process.exit(1);
}
console.log("Verified", result.checkedRecords, "records");
Offline-Verifikation (Python-SDK)
# Offline verification with argus-client (Python).
# Same shape as the TypeScript helper; suitable for evidence packages
# stored in court archives long after the case opens.
from argus_client import ArgusClient
argus = ArgusClient(base_url="https://api.knogin.com", token=os.environ["ARGUS_TOKEN"])
transcript = argus.evidence.get_provenance(
"ev_abc123",
format="json",
algorithm="ml-dsa-65",
)
result = argus.evidence.verify_provenance_local(transcript)
if not result.valid:
raise SystemExit(f"Tampered transcript: {result.broken_links}")
print(f"Verified {result.checked_records} records; merkle_root_verified={result.merkle_root_verified}")
