Review, audits and evidence¶

26 endpoints. Every path below is served by contractide-backend behind the gateway at https://api.trilocore.ai.

GET `/api/v1/ide/annotations`¶

List Annotations

Property	Value
Authentication	`Authorization: Bearer` (`jns_` key or SSO session)
Idempotency-Key	not required
Success	`200`
Upstream	`contractide-backend`

curl

curl -X GET https://api.trilocore.ai/api/v1/ide/annotations \
  -H "Authorization: Bearer $TRILOCORE_API_KEY"

GET `/api/v1/ide/annotations/{uuid}/comments`¶

List Comments

Property	Value
Authentication	`Authorization: Bearer` (`jns_` key or SSO session)
Idempotency-Key	not required
Success	`200`
Upstream	`contractide-backend`

curl

curl -X GET https://api.trilocore.ai/api/v1/ide/annotations/{uuid}/comments \
  -H "Authorization: Bearer $TRILOCORE_API_KEY"

POST `/api/v1/ide/annotations/{uuid}/comments`¶

Add Comment

Property	Value
Authentication	`Authorization: Bearer` (`jns_` key or SSO session)
Idempotency-Key	not required
Success	`200`
Upstream	`contractide-backend`

Request body

Field	Type	Required	Constraints
`body`	string	yes	—

curl

curl -X POST https://api.trilocore.ai/api/v1/ide/annotations/{uuid}/comments \
  -H "Authorization: Bearer $TRILOCORE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"body": "…"}'

PATCH `/api/v1/ide/annotations/{uuid}/status`¶

Set Status

Property	Value
Authentication	`Authorization: Bearer` (`jns_` key or SSO session)
Idempotency-Key	not required
Success	`200`
Upstream	`contractide-backend`

Request body

Field	Type	Required	Constraints
`fixed_in_commit_oid`	one of	no	—
`status`	string	yes	—

curl

curl -X PATCH https://api.trilocore.ai/api/v1/ide/annotations/{uuid}/status \
  -H "Authorization: Bearer $TRILOCORE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"status": "…"}'

GET `/api/v1/ide/audits/{uuid}`¶

Get Engagement

Property	Value
Authentication	`Authorization: Bearer` (`jns_` key or SSO session)
Idempotency-Key	not required
Success	`200`
Upstream	`contractide-backend`

curl

curl -X GET https://api.trilocore.ai/api/v1/ide/audits/{uuid} \
  -H "Authorization: Bearer $TRILOCORE_API_KEY"

POST `/api/v1/ide/audits/{uuid}/annotations`¶

Create Audit Annotation

Property	Value
Authentication	`Authorization: Bearer` (`jns_` key or SSO session)
Idempotency-Key	not required
Success	`200`
Upstream	`contractide-backend`

Request body

Field	Type	Required	Constraints
`body`	string	no	—
`category`	one of	no	—
`commit_oid`	string	yes	—
`end_line`	integer	yes	—
`kind`	string	no	—
`path`	string	yes	—
`severity`	one of	no	—
`start_line`	integer	yes	—

curl

curl -X POST https://api.trilocore.ai/api/v1/ide/audits/{uuid}/annotations \
  -H "Authorization: Bearer $TRILOCORE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"commit_oid": "…", "path": "…", "start_line": 0, "end_line": 0}'

GET `/api/v1/ide/audits/{uuid}/blob`¶

Get Engagement Blob

Property	Value
Authentication	`Authorization: Bearer` (`jns_` key or SSO session)
Idempotency-Key	not required
Success	`200`
Upstream	`contractide-backend`

curl

curl -X GET https://api.trilocore.ai/api/v1/ide/audits/{uuid}/blob \
  -H "Authorization: Bearer $TRILOCORE_API_KEY"

POST `/api/v1/ide/audits/{uuid}/close`¶

Close Engagement

Property	Value
Authentication	`Authorization: Bearer` (`jns_` key or SSO session)
Idempotency-Key	not required
Success	`200`
Upstream	`contractide-backend`

Request body not published

This endpoint accepts a body, but no machine-readable schema for it is published yet, so none is shown. The example below is therefore incomplete — do not read it as "send no body".

curl

curl -X POST https://api.trilocore.ai/api/v1/ide/audits/{uuid}/close \
  -H "Authorization: Bearer $TRILOCORE_API_KEY"

GET `/api/v1/ide/audits/{uuid}/evidence`¶

List Evidence Bundles

Property	Value
Authentication	`Authorization: Bearer` (`jns_` key or SSO session)
Idempotency-Key	not required
Success	`200`
Upstream	`contractide-backend`

curl

curl -X GET https://api.trilocore.ai/api/v1/ide/audits/{uuid}/evidence \
  -H "Authorization: Bearer $TRILOCORE_API_KEY"

POST `/api/v1/ide/audits/{uuid}/evidence`¶

Seal Evidence Bundle

Property	Value
Authentication	`Authorization: Bearer` (`jns_` key or SSO session)
Idempotency-Key	not required
Success	`200`
Upstream	`contractide-backend`

Request body not published

This endpoint accepts a body, but no machine-readable schema for it is published yet, so none is shown. The example below is therefore incomplete — do not read it as "send no body".

curl

curl -X POST https://api.trilocore.ai/api/v1/ide/audits/{uuid}/evidence \
  -H "Authorization: Bearer $TRILOCORE_API_KEY"

GET `/api/v1/ide/audits/{uuid}/findings.sarif`¶

Engagement Findings Sarif

Property	Value
Authentication	`Authorization: Bearer` (`jns_` key or SSO session)
Idempotency-Key	not required
Success	`200`
Upstream	`contractide-backend`

curl

curl -X GET https://api.trilocore.ai/api/v1/ide/audits/{uuid}/findings.sarif \
  -H "Authorization: Bearer $TRILOCORE_API_KEY"

PATCH `/api/v1/ide/audits/{uuid}/status`¶

Set Engagement Status

Property	Value
Authentication	`Authorization: Bearer` (`jns_` key or SSO session)
Idempotency-Key	not required
Success	`200`
Upstream	`contractide-backend`

Request body

Field	Type	Required	Constraints
`remediation_commit_oid`	one of	no	—
`status`	string	yes	—

curl

curl -X PATCH https://api.trilocore.ai/api/v1/ide/audits/{uuid}/status \
  -H "Authorization: Bearer $TRILOCORE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"status": "…"}'

GET `/api/v1/ide/audits/{uuid}/tree`¶

Get Engagement Tree

Property	Value
Authentication	`Authorization: Bearer` (`jns_` key or SSO session)
Idempotency-Key	not required
Success	`200`
Upstream	`contractide-backend`

curl

curl -X GET https://api.trilocore.ai/api/v1/ide/audits/{uuid}/tree \
  -H "Authorization: Bearer $TRILOCORE_API_KEY"

GET `/api/v1/ide/evidence/{uuid}`¶

Get Evidence Bundle

Property	Value
Authentication	`Authorization: Bearer` (`jns_` key or SSO session)
Idempotency-Key	not required
Success	`200`
Upstream	`contractide-backend`

curl

curl -X GET https://api.trilocore.ai/api/v1/ide/evidence/{uuid} \
  -H "Authorization: Bearer $TRILOCORE_API_KEY"

PATCH `/api/v1/ide/evidence/{uuid}/retention`¶

Patch Evidence Retention

Property	Value
Authentication	`Authorization: Bearer` (`jns_` key or SSO session)
Idempotency-Key	not required
Success	`200`
Upstream	`contractide-backend`

Request body

Field	Type	Required	Constraints
`legal_hold`	one of	no	—
`retention_class`	one of	no	—

curl

curl -X PATCH https://api.trilocore.ai/api/v1/ide/evidence/{uuid}/retention \
  -H "Authorization: Bearer $TRILOCORE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"retention_class": "…", "legal_hold": false}'

POST `/api/v1/ide/evidence/{uuid}/sign`¶

Sign Evidence Bundle

Property	Value
Authentication	`Authorization: Bearer` (`jns_` key or SSO session)
Idempotency-Key	not required
Success	`200`
Upstream	`contractide-backend`

Request body not published

This endpoint accepts a body, but no machine-readable schema for it is published yet, so none is shown. The example below is therefore incomplete — do not read it as "send no body".

curl

curl -X POST https://api.trilocore.ai/api/v1/ide/evidence/{uuid}/sign \
  -H "Authorization: Bearer $TRILOCORE_API_KEY"

GET `/api/v1/ide/evidence/{uuid}/verify`¶

Verify Evidence Bundle

Property	Value
Authentication	`Authorization: Bearer` (`jns_` key or SSO session)
Idempotency-Key	not required
Success	`200`
Upstream	`contractide-backend`

curl

curl -X GET https://api.trilocore.ai/api/v1/ide/evidence/{uuid}/verify \
  -H "Authorization: Bearer $TRILOCORE_API_KEY"

GET `/api/v1/ide/merge-requests/{uuid}`¶

Get Merge Request

Property	Value
Authentication	`Authorization: Bearer` (`jns_` key or SSO session)
Idempotency-Key	not required
Success	`200`
Upstream	`contractide-backend`

curl

curl -X GET https://api.trilocore.ai/api/v1/ide/merge-requests/{uuid} \
  -H "Authorization: Bearer $TRILOCORE_API_KEY"

PATCH `/api/v1/ide/merge-requests/{uuid}`¶

Patch Merge Request

Property	Value
Authentication	`Authorization: Bearer` (`jns_` key or SSO session)
Idempotency-Key	not required
Success	`200`
Upstream	`contractide-backend`

Request body

Field	Type	Required	Constraints
`description`	one of	no	—
`status`	one of	no	—
`title`	one of	no	—

curl

curl -X PATCH https://api.trilocore.ai/api/v1/ide/merge-requests/{uuid} \
  -H "Authorization: Bearer $TRILOCORE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"title": "…", "description": "…", "status": "…"}'

GET `/api/v1/ide/merge-requests/{uuid}/comments`¶

List Comments

Property	Value
Authentication	`Authorization: Bearer` (`jns_` key or SSO session)
Idempotency-Key	not required
Success	`200`
Upstream	`contractide-backend`

curl

curl -X GET https://api.trilocore.ai/api/v1/ide/merge-requests/{uuid}/comments \
  -H "Authorization: Bearer $TRILOCORE_API_KEY"

POST `/api/v1/ide/merge-requests/{uuid}/comments`¶

Create Comment

Property	Value
Authentication	`Authorization: Bearer` (`jns_` key or SSO session)
Idempotency-Key	not required
Success	`200`
Upstream	`contractide-backend`

Request body

Field	Type	Required	Constraints
`body`	string	yes	—
`commit_oid`	string	yes	—
`diff_hunk`	one of	no	—
`end_line`	one of	no	—
`file_path`	one of	no	—
`review_id`	one of	no	—
`start_line`	one of	no	—

curl

curl -X POST https://api.trilocore.ai/api/v1/ide/merge-requests/{uuid}/comments \
  -H "Authorization: Bearer $TRILOCORE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"commit_oid": "…", "body": "…"}'

POST `/api/v1/ide/merge-requests/{uuid}/merge`¶

Merge Merge Request

Property	Value
Authentication	`Authorization: Bearer` (`jns_` key or SSO session)
Idempotency-Key	not required
Success	`200`
Upstream	`contractide-backend`

Request body not published

This endpoint accepts a body, but no machine-readable schema for it is published yet, so none is shown. The example below is therefore incomplete — do not read it as "send no body".

curl

curl -X POST https://api.trilocore.ai/api/v1/ide/merge-requests/{uuid}/merge \
  -H "Authorization: Bearer $TRILOCORE_API_KEY"

GET `/api/v1/ide/merge-requests/{uuid}/reviews`¶

List Reviews

Property	Value
Authentication	`Authorization: Bearer` (`jns_` key or SSO session)
Idempotency-Key	not required
Success	`200`
Upstream	`contractide-backend`

curl

curl -X GET https://api.trilocore.ai/api/v1/ide/merge-requests/{uuid}/reviews \
  -H "Authorization: Bearer $TRILOCORE_API_KEY"

POST `/api/v1/ide/merge-requests/{uuid}/reviews`¶

Create Review

Property	Value
Authentication	`Authorization: Bearer` (`jns_` key or SSO session)
Idempotency-Key	not required
Success	`200`
Upstream	`contractide-backend`

Request body

Field	Type	Required	Constraints
`body`	one of	no	—
`state`	string	yes	—

curl

curl -X POST https://api.trilocore.ai/api/v1/ide/merge-requests/{uuid}/reviews \
  -H "Authorization: Bearer $TRILOCORE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"state": "…"}'

GET `/api/v1/ide/merge-requests/{uuid}/status-checks`¶

List Status Checks

Property	Value
Authentication	`Authorization: Bearer` (`jns_` key or SSO session)
Idempotency-Key	not required
Success	`200`
Upstream	`contractide-backend`

curl

curl -X GET https://api.trilocore.ai/api/v1/ide/merge-requests/{uuid}/status-checks \
  -H "Authorization: Bearer $TRILOCORE_API_KEY"

POST `/api/v1/ide/merge-requests/{uuid}/status-checks`¶

Create Status Check

Property	Value
Authentication	`Authorization: Bearer` (`jns_` key or SSO session)
Idempotency-Key	not required
Success	`200`
Upstream	`contractide-backend`

Request body

Field	Type	Required	Constraints
`commit_oid`	string	yes	—
`name`	string	yes	—
`state`	string	no	—
`target_url`	one of	no	—

curl

curl -X POST https://api.trilocore.ai/api/v1/ide/merge-requests/{uuid}/status-checks \
  -H "Authorization: Bearer $TRILOCORE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"commit_oid": "…", "name": "…"}'

Review, audits and evidence¶

GET /api/v1/ide/annotations¶

GET /api/v1/ide/annotations/{uuid}/comments¶

POST /api/v1/ide/annotations/{uuid}/comments¶

PATCH /api/v1/ide/annotations/{uuid}/status¶

GET /api/v1/ide/audits/{uuid}¶

POST /api/v1/ide/audits/{uuid}/annotations¶

GET /api/v1/ide/audits/{uuid}/blob¶

POST /api/v1/ide/audits/{uuid}/close¶

GET /api/v1/ide/audits/{uuid}/evidence¶

POST /api/v1/ide/audits/{uuid}/evidence¶

GET /api/v1/ide/audits/{uuid}/findings.sarif¶

PATCH /api/v1/ide/audits/{uuid}/status¶

GET /api/v1/ide/audits/{uuid}/tree¶

GET /api/v1/ide/evidence/{uuid}¶

PATCH /api/v1/ide/evidence/{uuid}/retention¶

POST /api/v1/ide/evidence/{uuid}/sign¶

GET /api/v1/ide/evidence/{uuid}/verify¶

GET /api/v1/ide/merge-requests/{uuid}¶

PATCH /api/v1/ide/merge-requests/{uuid}¶

GET /api/v1/ide/merge-requests/{uuid}/comments¶

POST /api/v1/ide/merge-requests/{uuid}/comments¶

POST /api/v1/ide/merge-requests/{uuid}/merge¶

GET /api/v1/ide/merge-requests/{uuid}/reviews¶

POST /api/v1/ide/merge-requests/{uuid}/reviews¶

GET /api/v1/ide/merge-requests/{uuid}/status-checks¶

POST /api/v1/ide/merge-requests/{uuid}/status-checks¶

GET `/api/v1/ide/annotations`¶

GET `/api/v1/ide/annotations/{uuid}/comments`¶

POST `/api/v1/ide/annotations/{uuid}/comments`¶

PATCH `/api/v1/ide/annotations/{uuid}/status`¶

GET `/api/v1/ide/audits/{uuid}`¶

POST `/api/v1/ide/audits/{uuid}/annotations`¶

GET `/api/v1/ide/audits/{uuid}/blob`¶

POST `/api/v1/ide/audits/{uuid}/close`¶

GET `/api/v1/ide/audits/{uuid}/evidence`¶

POST `/api/v1/ide/audits/{uuid}/evidence`¶

GET `/api/v1/ide/audits/{uuid}/findings.sarif`¶

PATCH `/api/v1/ide/audits/{uuid}/status`¶

GET `/api/v1/ide/audits/{uuid}/tree`¶

GET `/api/v1/ide/evidence/{uuid}`¶

PATCH `/api/v1/ide/evidence/{uuid}/retention`¶

POST `/api/v1/ide/evidence/{uuid}/sign`¶

GET `/api/v1/ide/evidence/{uuid}/verify`¶

GET `/api/v1/ide/merge-requests/{uuid}`¶

PATCH `/api/v1/ide/merge-requests/{uuid}`¶

GET `/api/v1/ide/merge-requests/{uuid}/comments`¶

POST `/api/v1/ide/merge-requests/{uuid}/comments`¶

POST `/api/v1/ide/merge-requests/{uuid}/merge`¶

GET `/api/v1/ide/merge-requests/{uuid}/reviews`¶

POST `/api/v1/ide/merge-requests/{uuid}/reviews`¶

GET `/api/v1/ide/merge-requests/{uuid}/status-checks`¶

POST `/api/v1/ide/merge-requests/{uuid}/status-checks`¶