Records a distribution agent's attested check-in: it verifies the echoed artifact hash/fingerprint against the distribution record (a mismatch is a HIGH drift finding — tampered or stale artifact), upserts the scope's OBSERVED config (credential-redacted), computes drift against the latest published revision, and audits the whole thing.

POST

/v1/m/claude-policy/{surface}/checkin

curl --request POST \
  --url https://example.com/v1/m/claude-policy/example/checkin \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "artifact_sha256": "example", "key_fingerprint": "example", "observed_content": "example", "revision": 1, "scope": "example" }'

• this engine

Records a distribution agent’s attested check-in: it verifies the echoed artifact hash/fingerprint against the distribution record (a mismatch is a HIGH drift finding — tampered or stale artifact), upserts the scope’s OBSERVED config (credential-redacted), computes drift against the latest published revision, and audits the whole thing.

Authorizations

• bearerAuth

Parameters

Path Parameters

surface

required

string

Path parameter surface.

Header Parameters

X-Olivares-Tenant

string format: uuid

Target tenant id; required when the principal can act in more than one tenant.

Request Body ^required

Media type application/json

object

artifact_sha256

Any of:

string

Optional artifact hash echo; a missing or mismatched value records the check-in unverified.

string

null

null

key_fingerprint

Any of:

string

Optional signer fingerprint echo.

string

null

null

observed_content

Any of:

string

Optional observed document, capped at 262144 UTF-8 bytes and credential-redacted before persistence.

string

null

null

revision

Any of:

integer

Zero records an unattested check-in.

integer

null

null

scope

required

After trimming, must be non-empty, at most 128 UTF-8 bytes and contain no control characters.

string

Example ^generated

{
  "artifact_sha256": "example",
  "key_fingerprint": "example",
  "observed_content": "example",
  "revision": 1,
  "scope": "example"
}

Responses

200

OK

Media type application/json

object

Example ^generated

{}

400

Bad request

Media type application/json

object

Example ^generated

{}

401

Unauthenticated

Media type application/json

object

Example ^generated

{}

403

Forbidden

Media type application/json

object

Example ^generated

{}

404

Not found

Media type application/json

object

Example ^generated

{}

409

Conflict / setup required

Media type application/json

object

Example ^generated

{}

429

Rate limited

Media type application/json

object

Example ^generated

{}