> ## Documentation Index > Fetch the complete documentation index at: https://docs.visiqlabs.com/llms.txt > Use this file to discover all available pages before exploring further. # Ingest a record envelope > Append a signed event (with optional artifacts and attestations) to the tamper-evident audit trail. `tenantId` must match the authenticated account. Requires permission `record_records:create` and scope `record:write`. ## OpenAPI ````yaml /api-reference/openapi.yaml post /record/envelopes openapi: 3.1.0 info: title: VisIQ Governance API version: 1.0.0 description: > The VisIQ platform API for governing agentic AI. One rule engine evaluates every governed agent event against your policies and returns a decision (permit, deny, approval-required, redact, mask, or escalate), records a cryptographically-verifiable audit trail, and governs agent-to-agent delegation. All requests are authenticated with a bearer API key. Mint a key in the dashboard under **Connectors -> API Keys**; it is presented as `Authorization: Bearer vq_prod_...`. Keys are scoped: harness/agent keys reach the operational surface (evaluate, rule bundles, telemetry, record ingestion), while management keys and dashboard sessions govern rules, agents, settings, and audit reads through role-based permissions. Decision vocabularies differ per facet. Action governance emits `permit | deny | approval_required | mask`. Retrieval governance emits `allow | deny | redact | escalate`. The unified `POST /evaluate` surface projects both into a single union vocabulary (`permit | deny | approval_required | redact | escalate | mask`). contact: name: VisIQ Labs url: https://docs.visiqlabs.com servers: - url: https://api.visiqlabs.com description: Production security: - bearerAuth: [] tags: - name: Evaluation description: Per-event governance decisions for action, retrieval, and delegation. - name: Action Rules description: Manage the rules that govern agent actions (writes/tool calls). - name: Retrieval Rules description: Manage the rules that govern retrieval and context exposure. - name: Unified Rules description: Operation-native rule management across both facets in one surface. - name: Rule Bundles description: Compiled, cacheable rule bundles the SDK runtime pulls per agent. - name: Agents description: Register and manage the agents whose events you govern. - name: Human-in-the-loop description: The approval queue for events that require a human decision. - name: Settings description: Per-account governance defaults. - name: Delegation description: Govern scoped agent-to-agent hand-offs with signed grant tokens. - name: Records description: Ingest, retrieve, finalize, and verify the tamper-evident audit trail. - name: Audit Log description: Versioned, paginated read APIs over recorded decisions and events. - name: Cognition description: >- Read captured Agent Cortex cognition sessions and beats (dedicated cognition:read scope). paths: /record/envelopes: post: tags: - Records summary: Ingest a record envelope description: > Append a signed event (with optional artifacts and attestations) to the tamper-evident audit trail. `tenantId` must match the authenticated account. Requires permission `record_records:create` and scope `record:write`. operationId: ingestEnvelope requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/RecordEnvelope' responses: '201': description: The created record and event IDs. content: application/json: schema: $ref: '#/components/schemas/EnvelopeIngestResponse' example: record_id: 4b2b8c1e-6f2a-4a1e-9e2b-9d5b0a1c2d3e event_id: 7c1f2a3b-4d5e-6f70-8192-a3b4c5d6e7f8 '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' security: - bearerAuth: [] components: schemas: RecordEnvelope: type: object required: - source - tenantId - correlationId - event properties: source: type: string enum: - execute - browser_proxy - session_events - action - isolate - app - retrieval tenantId: type: string minLength: 1 maxLength: 255 description: Must match the authenticated account. correlationId: type: string minLength: 1 maxLength: 255 authorization: type: object properties: type: type: string maxLength: 100 principal: type: string maxLength: 255 scope: type: string maxLength: 500 actor: $ref: '#/components/schemas/RecordParty' subject: $ref: '#/components/schemas/RecordParty' event: type: object required: - type - occurredAt - payload properties: type: type: string minLength: 1 maxLength: 255 occurredAt: type: string format: date-time payload: type: object additionalProperties: true signature: $ref: '#/components/schemas/Signature' artifacts: type: array items: type: object required: - artifactType - contentHash properties: artifactType: type: string minLength: 1 maxLength: 100 mimeType: type: string maxLength: 255 storageRef: type: string maxLength: 1000 contentHash: type: string minLength: 1 maxLength: 255 metadata: type: object additionalProperties: true attestations: type: array items: type: object required: - attestationType - issuerType - issuerId - statement - hash properties: attestationType: type: string minLength: 1 maxLength: 100 issuerType: type: string minLength: 1 maxLength: 100 issuerId: type: string minLength: 1 maxLength: 255 statement: type: object additionalProperties: true hash: type: string minLength: 1 maxLength: 255 signature: $ref: '#/components/schemas/Signature' EnvelopeIngestResponse: type: object required: - record_id - event_id properties: record_id: type: string format: uuid event_id: type: string format: uuid RecordParty: type: object description: An actor or subject reference. properties: type: type: string maxLength: 100 id: type: string maxLength: 255 name: type: string maxLength: 255 metadata: type: object additionalProperties: true Signature: type: object required: - algorithm - value properties: algorithm: type: string minLength: 1 maxLength: 100 value: type: string minLength: 1 keyId: type: string maxLength: 255 signedAt: type: string format: date-time Error: type: object required: - error description: > The standard error envelope. `details` carries the validation issue list on 400s; authorization failures add fields such as `detail`, `requiredScopes`, or `requiredPermission`. properties: error: type: string detail: type: string code: type: string details: type: array items: type: object additionalProperties: true additionalProperties: true responses: BadRequest: description: The request was malformed or failed validation. content: application/json: schema: $ref: '#/components/schemas/Error' example: error: Invalid request body details: - path: - agent_id message: Required Unauthorized: description: Missing or invalid API key. content: application/json: schema: $ref: '#/components/schemas/Error' example: error: Unauthorized Forbidden: description: The key lacks the required permission or scope. content: application/json: schema: $ref: '#/components/schemas/Error' example: error: insufficient_scope detail: This API key is not authorized for the requested operation. securitySchemes: bearerAuth: type: http scheme: bearer description: > A VisIQ API key presented as `Authorization: Bearer vq_prod_...`. Mint keys under **Connectors -> API Keys** in the dashboard. ````