Prove what crossed the API boundary—without turning raw secrets into a new evidence leak.
Wire Evidence hashes the exact non-empty request and response byte sequences, binds them to a scoped manifest and source-capture hash, and signs a statement covering the manifest hash, signing time, and signer metadata. The receipt contains fingerprints and bounded metadata, not raw credential-bearing payloads, authorization headers, packet captures, or TLS session secrets.
Capture locally. Hash exactly. Sign narrowly.
Capture or export the smallest necessary API exchange under an approved test, incident, transaction, or audit procedure.
Preserve the request and response byte boundaries used for hashing. Do not normalize whitespace, headers, encoding, or body bytes after extraction.
Record byte hashes and lengths, protocol, method, authority, path template, status, TLS metadata, action references, required capture hash, analyzer-report hash, and prior receipt hash.
Sign a canonical statement containing the manifest hash, normalized signing time, and declared signer metadata, then compute a receipt hash that later evidence can link.
A verifier reconstructs the signed statement, validates the signature and chain, recomputes hashes from retained customer-side bytes, and compares the evidence to the target-side outcome.
Auditable without publishing the transaction.
The schema is public so an auditor, customer, integrator, or verifier can understand the manifest bound by the signed statement. Sensitive byte sequences remain in the customer’s controlled evidence store or authorized capture environment.
{
"schema": "trustaccept.wire-evidence.v1",
"evidenceId": "wire_01J_EXAMPLE",
"observedAt": "2026-08-23T15:00:00.000Z",
"exchange": {
"request": {
"sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
"byteLength": 842
},
"response": {
"sha256": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
"byteLength": 418
},
"pairSha256": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc"
},
"transport": {
"protocol": "http/2",
"method": "POST",
"authority": "payments.example.internal",
"path": "/v1/payments/:paymentId/release",
"statusCode": 200,
"tlsVersion": "TLS 1.3"
},
"context": {
"organizationId": "org_example",
"environment": "production",
"actionId": "action_123",
"actorId": "agent_payments",
"targetId": "payment_gateway",
"policyId": "policy_high_value_release"
},
"source": {
"captureSha256": "dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd",
"analyzerReportSha256": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
"frameNumbers": [
184,
201
]
},
"chain": {
"previousReceiptHash": null
},
"redaction": {
"rawRequestStoredInReceipt": false,
"rawResponseStoredInReceipt": false,
"credentialValuesStoredInReceipt": false
},
"claimBoundary": [
"Attests to the signed statement and bound manifest hash, not to human intent.",
"Does not by itself prove capture completeness, target authorization, or business completion.",
"Independent exchange verification requires retained bytes or another authorized source that can reproduce their hashes."
]
}- The signer signed a statement binding the canonical manifest hash, recorded signing time, and declared signer metadata.
- The manifest contains specific request and response byte fingerprints and non-zero lengths.
- The request/response pair hash changes if either byte sequence or length boundary changes.
- The manifest is linked to the stated capture, analyzer report, action references, and prior receipt hashes.
- A later verifier can compare retained bytes and target evidence to the bound manifest.
Where application logs are not enough.
AI-agent actions
Bind a governed action and authorization record to the request and response observed at the enforced execution boundary.
Regulated transactions
Preserve scoped, independently checkable fingerprints for approvals, submissions, payments, changes, and sensitive data exchanges.
Integration disputes
Establish the exact byte fingerprints and response status associated with a contract-sensitive API call without publishing the payload.
Incident evidence
Chain API exchange fingerprints into an investigation timeline while keeping raw captures inside the authorized evidence environment.
Detection before attestation
APIAuth.org provides the free authentication-on-the-wire guides, browser inspector, and local PCAP analyzer. It prepares a redacted report and capture hash. TrustAccept adds the signed, chained evidence receipt.
One consequential API exchange, fully bounded.
Start with a single action path. Define the capture authority, exact byte extraction, context fields, signer, customer-side retention, verifier, target outcome, and evidence handoff before expanding coverage.