Learn · Audit & evidence
Evidence packs
A portable file that carries a framework’s controls, their evidence, and the entries behind them.
Checked against the product on · written for people who need the evidence
A pack is one JSON Lines stream and one manifest. It carries a framework, its controls, the evidence links on each control, and the logbook entries those links point at. Every hash in it can be recomputed from the file alone.
Prove
Export evidence
- Framework
- SOC 2Controls and their evidence links.
- From
- 2026-07-01
- To
- 2026-07-31
- Sign the manifest
- YesAdds authenticity. Integrity needs no key.
Open Records and select Export evidence, then pick the framework and the window.1
Read the format line.2
Integrity needs no key. Signing adds authenticity on top.
Select Build pack.3
The pack downloads as the record stream and the manifest.
The record stream
One JSON object per line, each rendered as canonical JSON. Four record types appear, in this order.
| Type | One per | Carries |
|---|---|---|
| framework | Pack. | The framework key, name, version, authority, and scope. |
| control | Control in the framework. | The reference, the title, the status, the owner, and when it was last tested. |
| evidence | Link from a control to something. | The link id, the kind, the entry it points at, and the entry hash captured when the link was made. |
| ledger_entry | Distinct logbook entry referenced by a link. | The full entry: index, previous hash, payload hash, hash, time, and payload. |
The manifest
| Field | What it holds |
|---|---|
| kind | The format identifier and its version. |
| pack_id | This pack’s identifier. |
| created_at | When the pack was built. |
| framework_id · framework_key · scope_ref | What the pack covers. |
| record_count · ledger_entry_count | How many lines and how many entries to expect. |
| hash_algo · content_hash | SHA-256 over the whole record stream. |
| sig_algo · signature · signing_key_id | Present when the pack was signed. Absent otherwise. |
Build one from code
curl 'https://api.dmzagent.com/v1/compliance/frameworks/FRAMEWORK_ID/export' \
-H 'Authorization: Bearer YOUR_API_KEY' \
-o evidence-pack.json