Evidence Bridge Integration Guide

Human path

1. Sign in to nexart.io.
2. Open Dashboard, then Integrations.
3. Choose AI Execution or Consequential Execution (source formats: Custom JSON or OpenTelemetry).
4. Click Connect.
5. Review the source mapping profile in Evidence Bridge.
6. Preview the mapping using synthetic or sample JSON.
7. Publish the mapping profile.
8. Send an execution payload.
9. Review mapping, eligibility, CER, Node attestation and timestamp status.

Dashboard to Bridge connection

At nexart.io, in Dashboard, then Integrations, a user selects an integration and clicks Connect. The control plane then:

1. verifies the authenticated NexArt user
2. creates a short-lived Bridge handoff token
3. opens bridge.nexart.io with the selected template
4. the Bridge verifies the handoff
5. the Bridge creates a tenant-scoped session
6. the Bridge instantiates or opens the selected draft mapping profile

See Authentication for the token properties.

Machine path

1. Create or use an existing NexArt API key.
2. Create and publish a mapping profile.
3. Keep the API key server-side.
4. POST a source execution payload to the Bridge ingestion endpoint.
5. Supply one stable Idempotency-Key per logical event.
6. Inspect the returned result and evidence status.
7. Independently verify the resulting NexArt evidence.

Ingestion and attestation are separate

POST /api/v1/ingest/{profileId}/{revision}   # create + verify locally
POST /api/v1/results/{resultId}/attest       # optional, separate

Ingestion authenticates, maps, validates, creates the CER, verifies it locally and persists the Bridge result. It does not need to call the Node.

Attestation submits the already-created CER unchanged, preserves certificate identity, applies Public or Private visibility, declares applicable Readable Consequential fields to the Node and verifies the returned Node evidence.

One logical event uses one stable Idempotency-Key. Retries reuse that key. Different events use different keys.

Ingestion endpoint

POST https://bridge.nexart.io/api/v1/ingest/{profileId}/{revision}

The published profile page in Evidence Bridge shows the exact path for your profile and revision.

curl -X POST "https://bridge.nexart.io/api/v1/ingest/$PROFILE_ID/$PROFILE_REVISION" \
  -H "Authorization: Bearer $NEXART_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: execution-run-84729" \
  --data-binary @execution.json

import os
import requests

response = requests.post(
    f"https://bridge.nexart.io/api/v1/ingest/{os.environ['PROFILE_ID']}/{os.environ['PROFILE_REVISION']}",
    headers={
        "Authorization": f"Bearer {os.environ['NEXART_API_KEY']}",
        "Content-Type": "application/json",
        "Idempotency-Key": "execution-run-84729",
    },
    json={
        # source execution payload
    },
)

response.raise_for_status()
print(response.json())

Never place a real API key in documentation, source control or client-side code. Read NEXART_API_KEY from your secret or environment configuration.

Profile and result endpoints

POST /api/v1/profiles/preview
POST /api/v1/profiles
POST /api/v1/profiles/{profileId}/{revision}/publish
GET  /api/v1/profiles
GET  /api/v1/profiles/{profileId}/{revision}
GET  /api/v1/results/{resultId}
POST /api/v1/results/{resultId}/attest
GET  /ready

A Bridge result exposes the mapping, evidence and attestation state for one ingested payload:

{
  "resultId": "res_example_0001",
  "sourceRawDigest": "sha256:1111111111111111111111111111111111111111111111111111111111111111",
  "sourceCanonicalDigest": "sha256:2222222222222222222222222222222222222222222222222222222222222222",
  "profileHash": "sha256:3333333333333333333333333333333333333333333333333333333333333333",
  "selectedTarget": "consequential-execution-v1",
  "targetEligibility": { "eligible": true },
  "mappedEvent": { },
  "provenance": [ ],
  "cer": { "certificateHash": "sha256:4444444444444444444444444444444444444444444444444444444444444444" },
  "localVerification": { },
  "nodeAttestation": { }
}

Field values are fake samples, not real digests. Additional fields may be present depending on the target and attestation state.

Troubleshooting

401. Invalid API key, revoked API key, expired or invalid human handoff, already redeemed handoff, or invalid Bridge session.

403. Missing required write scope, Bridge entitlement unavailable, or account not usable.

404. The resource belongs to another tenant, or the profile or revision does not exist. Cross-tenant resource enumeration is deliberately hidden.

409. The same idempotency key was reused with different source content.

Target ineligible. The mapping succeeded but required evidence semantics are missing.

Node attestation failed. The local CER can remain valid even if Node attestation failed. Retry should reuse the same persisted CER rather than recreating it.

Timestamp PRESENT_NOT_VERIFIED. The Node returned timestamp evidence, but the Bridge verifier does not currently have an approved TSA trust chain configured, or verification did not complete successfully.