Attach evidence to one CertOps job
POST/api/v1/certops/jobs/:jobId/evidence
Machine-token route for attaching sanitized evidence to the path jobId. Requires certops:evidence:write. Workspace identity is derived from the authenticated CertOps API token; body workspaceId cannot override it. Private key material is rejected with 422, generic secrets are redacted, and optional output is limited to 65,536 UTF-8 bytes and stored only as redacted output.
Request
Responses
- 202
- 400
- 401
- 403
- 404
- 409
- 413
- 422
- 429
- 500
- 503
Evidence accepted
Bad request
Unauthorized
Forbidden
CertOps is disabled or the certificate job was not found in the authenticated workspace
Executor event idempotency key conflicts with a different sanitized payload
The machine request body exceeded the dedicated 4 MiB pre-auth boundary (CERTOPS_EXECUTOR_EVENT_BODY_TOO_LARGE), or normalized evidence output exceeded 65,536 UTF-8 bytes (CERTOPS_EVIDENCE_OUTPUT_TOO_LARGE). The payload is not echoed.
Request rejected because it contained private key material
CertOps machine-token rate limit exceeded
Internal server error
The security audit sink was unavailable while recording a private-key-material rejection. The endpoint fails closed; the payload is neither persisted nor echoed and no executor-event side effects occur.