1. API Reference
  2. Conventions
  3. Requests and responses
Website
  • API overview
  • API quickstart
  • Authentication
  • Project scoping
  • Requests and responses
  • Pagination and filtering
  • Errors
  • GETList supported database engines
  • POSTList projects
  • POSTCreate a project
  • GETGet a project
  • DELETEDelete a project
  • PATCHUpdate a project
  • POSTCreate a source
  • POSTList sources
  • GETGet source details
  • DELETEDelete a source
  • PATCHUpdate a source
  • POSTCreate secret metadata
  • POSTList secret metadata
  • GETGet secret metadata
  • DELETEDelete secret metadata
  • PATCHUpdate secret metadata
  • POSTCreate a schedule
  • POSTList schedules
  • POSTSummarize schedule statuses
  • GETGet a schedule
  • DELETEDelete a schedule
  • PATCHUpdate a schedule
  • DELETERemove a schedule gate
  • POSTActivate or pause a schedule
  • POSTQueue a manual check
  • POSTCreate an immutable report
  • POSTList reports
  • GETGet report details
  • DELETEDelete a report
  • POSTDownload a report
  • POSTGet the API-key scope catalog
  • POSTCreate an API key
  • POSTList API-key metadata
  • GETGet API-key metadata
  • DELETEDelete an API key
  • PATCHUpdate API-key metadata
  • POSTCreate a notification channel
  • POSTList notification channels
  • POSTResolve notification channels by ID
  • GETGet notification channel details
  • DELETEDelete a notification channel
  • PATCHUpdate a notification channel
  • POSTSend a test notification
  • POSTCreate a project worker
  • POSTList project workers
  • GETGet worker details
  • DELETEDelete a worker
  • PATCHUpdate a worker
  • POSTRead live worker agent logs
  • POSTList checks
  • POSTSummarize check statuses
  • GETGet check details
  • POSTGet check log sections
  • POSTDownload a check log
  • POSTDownload check audit evidence
  • POSTList notification messages
  • GETGet notification message details

Requests and responses

Use RestoreTrust JSON envelopes, HTTP methods, timestamps, and response headers consistently.

Loading documentation…

Project scoping< PreviousPagination and filteringNext >

Powered by heyo

On this page

Resource methodsSuccess responsesDates, IDs, and nullsResponse headers

All documented endpoints use the /v1 version prefix. Send UTF-8 JSON with Content-Type: application/json unless the endpoint returns a downloadable artifact.

Resource methods

  • POST /{resource} creates a resource.
  • POST /{resource}/list lists resources with body-based filters and pagination.
  • GET /{resource}/{id} gets one resource.
  • PATCH /{resource}/{id} updates only supplied fields.
  • DELETE /{resource}/{id} deletes one resource.
  • Named POST actions, such as /manual-run, perform a documented action.

Unknown request fields are rejected on write operations where the endpoint defines a strict payload. Treat field names and enum values as case-sensitive unless the endpoint says otherwise.

Success responses

JSON success responses wrap the endpoint payload in data:

json
{  "status": "success",  "data": {    "id": "65f0c9bca7d6b4e2c7654321"  }}

List responses add pagination, sort, and filters at the top level:

json
{  "status": "success",  "sort": "created-desc",  "filters": { "status": "active" },  "pagination": {    "limit": 25,    "has_more": false  },  "data": {    "schedules": []  }}

Create operations normally return 201 Created; reads and updates return 200 OK. Download endpoints return their documented media type instead of a JSON envelope.

Dates, IDs, and nulls

  • Resource IDs are 24-character hexadecimal strings.
  • Timestamps in responses are RFC 3339 instants in UTC with a Z suffix and millisecond precision, for example 2026-10-10T10:10:22.316Z. A timestamp the server does not have is null, never an empty string.
  • Timestamps you send (list filters such as created_at_since, created_from and created_to, report time_range, and pagination after_value) must carry an explicit offset or Z. Values without one, and date-only values, are rejected with 400.
  • API-key expiration uses a date-only YYYY-MM-DD value: the key is valid through the end of that day in UTC.
  • Cron expressions are evaluated in UTC.
  • Optional response fields can be omitted or null; clients should tolerate both where the schema permits them.

The console can display the same UTC instant in local time or UTC according to App settings → Time zone. This display choice does not change API values or UTC cron expressions. See Time zones and dates for the effect on filters, reports, and date variables.

Response headers

Every response includes:

Server-Timingstringoptional

Request processing duration, such as app;dur=42.5.

X-Server-Time-UTCdate-timeoptional

The server's UTC response timestamp.

Download responses and live log responses can include Cache-Control: no-store.

Related topics

  • Paginate list responses
  • Handle error envelopes
  • Browse generated endpoint schemas
  • Time zones and dates