# Get a milestone's evidence

`GET /api/v1/milestones/{id}/evidence`

Why a contractor's milestone was paid, or why it is not paid yet, as one signed document: what was agreed, what was delivered and how it was verified, who decided, and the payment, each fact citing the ledger entries it rests on, which the document carries in full with the workspace's public keys. The format is a payable's, `vestiarion-evidence/1`, with members named by user id.

An id this workspace does not hold, including another workspace's, answers `404`. Text that came from outside, such as a pull request's title or a contractor's name, is carried as data.

Send a [workspace API key](https://www.vestiarion.xyz/docs/get-started/authentication) as `Authorization: Bearer <key>`.

## Parameters

| Name | In | Type | Required | Default | Allowed values | Description |
| --- | --- | --- | --- | --- | --- | --- |
| `id` | path | string | Required | — | — | The milestone's id, as `GET /api/v1/milestones` lists it. |

## Code samples

```bash
curl "https://www.vestiarion.xyz/api/v1/milestones/<id>/evidence" \
  -H "Authorization: Bearer $VESTIARION_API_KEY"
```

## Response

Example, `200` `application/json`:

```json
{
  "data": {
    "format": "vestiarion-evidence/1",
    "exportedAt": "2026-10-25T09:00:00.000Z",
    "workspace": {
      "slug": "northstar-studio",
      "name": "Northstar Studio"
    },
    "network": {
      "id": "arc-testnet",
      "label": "Arc testnet"
    },
    "subject": {
      "kind": "milestone",
      "id": "7d1e4c2a-5b3f-4e8a-9c61-2f0a8b3d4f61",
      "title": "Checkout page redesign",
      "payee": "Lumen Dev",
      "amount": 800,
      "paidAmount": null,
      "currency": "USDC",
      "status": "paid",
      "paid": true,
      "closed": false,
      "simulated": false,
      "onChain": true
    },
    "labels": {
      "checked": {
        "words": "Checked by code",
        "meaning": "A rule Vestiarion runs computed it: the three-way match, the guardrails, a signature, the written policy.",
        "facts": 4
      },
      "verified": {
        "words": "Verified outside",
        "meaning": "Someone outside Vestiarion answered: the chain's record of the transaction, GitHub, the screening service.",
        "facts": 3
      },
      "stated": {
        "words": "Stated by a person",
        "meaning": "A member or the payee entered it. The page names who, and when.",
        "facts": 3
      },
      "inferred": {
        "words": "Inferred",
        "meaning": "Read, not recorded: the model's judgement, sample data, or a setting as it is today.",
        "facts": 1
      },
      "missing": {
        "words": "Missing",
        "meaning": "Nothing records it. Where it can still be added, the page says how.",
        "facts": 0
      },
      "unreachable": {
        "words": "Could not open",
        "meaning": "A check got no answer, or a link can't be opened (deleted, private, refused or expired): it never counts as verified.",
        "facts": 0
      },
      "contradicted": {
        "words": "Does not match",
        "meaning": "A check answered, and its answer contradicts the record.",
        "facts": 0
      }
    },
    "steps": [
      {
        "id": "agreed",
        "title": "What was agreed",
        "label": "Stated by a person",
        "kind": "stated",
        "facts": [
          {
            "label": "Stated by a person",
            "kind": "stated",
            "text": "“Checkout page redesign”, 800.00 USDC for Lumen Dev, added on Contractors.",
            "who": "4b7e0c1a-2d3f-4e5a-8b6c-7d8e9f0a1b01",
            "at": "2026-10-03T16:00:00.000Z",
            "entries": [
              5611
            ]
          }
        ]
      },
      {
        "id": "delivered",
        "title": "What was delivered",
        "label": "Verified outside",
        "kind": "verified",
        "facts": [
          {
            "label": "Verified outside",
            "kind": "verified",
            "text": "GitHub reported pull request northstar-studio/site#48 merged.",
            "who": null,
            "at": "2026-10-08T09:00:00.000Z",
            "notes": [
              "Vestiarion asked GitHub on Oct 8, 2026, 09:10 UTC."
            ],
            "link": {
              "href": "https://github.com/northstar-studio/site/pull/48",
              "label": "northstar-studio/site#48",
              "state": "checked",
              "given": true
            },
            "entries": [
              5613
            ]
          }
        ]
      },
      {
        "id": "payee",
        "title": "The payee",
        "label": "Stated by a person",
        "kind": "stated",
        "facts": [
          {
            "label": "Stated by a person",
            "kind": "stated",
            "text": "0x3e7d…9e01 was given on Counterparties.",
            "who": "4b7e0c1a-2d3f-4e5a-8b6c-7d8e9f0a1b01",
            "at": "2026-10-01T08:30:00.000Z",
            "entries": [
              5603
            ]
          },
          {
            "label": "Stated by a person",
            "kind": "stated",
            "text": "The address was confirmed on Counterparties.",
            "who": "4b7e0c1a-2d3f-4e5a-8b6c-7d8e9f0a1b02",
            "at": "2026-10-01T09:05:00.000Z",
            "entries": [
              5604
            ]
          },
          {
            "label": "Verified outside",
            "kind": "verified",
            "text": "Lumen Dev was screened clear by OpenSanctions.",
            "who": null,
            "at": "2026-10-01T08:31:00.000Z",
            "entries": []
          }
        ]
      },
      {
        "id": "decision",
        "title": "The decision",
        "label": "Inferred",
        "kind": "inferred",
        "facts": [
          {
            "label": "Inferred",
            "kind": "inferred",
            "text": "Claude decided to release it, as the written policy would.",
            "who": null,
            "at": "2026-10-08T09:11:00.000Z",
            "notes": [
              "The model's judgement, from the facts it was given."
            ],
            "entries": [
              5614
            ]
          },
          {
            "label": "Checked by code",
            "kind": "checked",
            "text": "Code checked it before anything was sent.",
            "who": null,
            "at": "2026-10-08T09:11:00.000Z",
            "notes": [
              "✓ The work verified",
              "✓ Counterparty screened clear",
              "✓ 800.00 USDC within its 1,000.00 USDC limit"
            ],
            "entries": [
              5614
            ]
          }
        ]
      },
      {
        "id": "people",
        "title": "People",
        "label": "Checked by code",
        "kind": "checked",
        "facts": [
          {
            "label": "Checked by code",
            "kind": "checked",
            "text": "No person approved it: code let the agent pay it within the workspace's rules.",
            "who": null,
            "at": null,
            "entries": [
              5614
            ]
          }
        ]
      },
      {
        "id": "payment",
        "title": "The payment",
        "label": "Checked by code",
        "kind": "checked",
        "facts": [
          {
            "label": "Verified outside",
            "kind": "verified",
            "text": "Paid 800.00 USDC to 0x3e7d…9e01 on Arc testnet.",
            "who": null,
            "at": "2026-10-08T09:11:06.000Z",
            "notes": [
              "Block 4388902 on Arc testnet holds a transfer of 800.00 USDC to the payee in this transaction."
            ],
            "link": {
              "href": "https://explorer.testnet.arc.io/tx/0xaa4864c775958bc6f6fd541460df2a351093dd600e37329351639dd191f2030c",
              "label": "The transaction",
              "state": "checked"
            },
            "entries": []
          },
          {
            "label": "Checked by code",
            "kind": "checked",
            "text": "Entry #5614 records this transaction.",
            "who": null,
            "at": "2026-10-08T09:11:00.000Z",
            "entries": [
              5614
            ]
          }
        ]
      },
      {
        "id": "signatures",
        "title": "Signatures",
        "label": "Checked by code",
        "kind": "checked",
        "caveat": "A signed entry proves who recorded what, and when. It does not prove the goods were good or the work was done.",
        "facts": [
          {
            "label": "Checked by code",
            "kind": "checked",
            "text": "5 entries verify: each is signed with the workspace's key, and its hash follows from its content, its signature and the hash before it.",
            "who": null,
            "at": null,
            "notes": [
              "The Audit log checks the whole chain, entry after entry."
            ],
            "entries": [
              5603,
              5604,
              5611,
              5613,
              5614
            ]
          }
        ]
      }
    ],
    "signedEntryProves": "A signed entry proves who recorded what, and when. It does not prove the goods were good or the work was done.",
    "checkAnEntry": [
      "body_hash = sha256(canonical JSON of { actor, domain, action, summary, detail }, keys sorted)",
      "signature = Ed25519 over the 32 bytes of body_hash, by the key signing_key_id names",
      "hash = sha256(prev_hash || body_hash || signature), the hex strings joined"
    ],
    "keys": [
      {
        "id": "36e3209ae2e6a600",
        "status": "active",
        "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEAhXbIpeLpKB5bbwxtRVDFBlWIDaY3sitQ9KiQ0xCR7No=\n-----END PUBLIC KEY-----\n"
      }
    ],
    "entries": [
      {
        "seq": 5603,
        "id": "b546c398-0533-46f3-bd08-f4616db95c2c",
        "ts": "2026-10-01T08:30:00.000Z",
        "actor": "human",
        "domain": "compliance",
        "action": "create_counterparty",
        "summary": "Added Lumen Dev as a contractor",
        "detail": {
          "by": "4b7e0c1a-2d3f-4e5a-8b6c-7d8e9f0a1b01",
          "counterpartyId": "7d1e4c2a-5b3f-4e8a-9c61-2f0a8b3d4c02",
          "name": "Lumen Dev",
          "role": "contractor",
          "address": "0x3e7d9c1b5a2f4e6d8c0b1a2f3e4d5c6b7a8f9e01",
          "chain": "ARC-TESTNET"
        },
        "body_hash": "e2ccbd8cdd6456350288c1f13d3571f64f76645ff2838676d50a8a2e7c9c07d6",
        "signature": "c91c53067e8c830328533a50e3953214eacd8275acab44914cd3afe94145495f4dfde94cee390caad3e8f0865ccb99fc316863af556363381a50c40d1838840f",
        "prev_hash": "0a40c77a63ada232560e392c2e6b2a0ba790cd489c98dbf1e51856fc0c2e0af4",
        "hash": "09c9fc837135aa8c1570b36ab1dc22a6cf727dccc9d3364978b6c293db7b8144",
        "signing_key_id": "36e3209ae2e6a600",
        "check": {
          "ok": true
        }
      },
      {
        "seq": 5604,
        "id": "893c07ed-20c4-44c8-9af6-2c01c57d5188",
        "ts": "2026-10-01T09:05:00.000Z",
        "actor": "human",
        "domain": "compliance",
        "action": "counterparty_address_confirmed",
        "summary": "Confirmed Lumen Dev's payout address",
        "detail": {
          "by": "4b7e0c1a-2d3f-4e5a-8b6c-7d8e9f0a1b02",
          "counterpartyId": "7d1e4c2a-5b3f-4e8a-9c61-2f0a8b3d4c02",
          "address": "0x3e7d9c1b5a2f4e6d8c0b1a2f3e4d5c6b7a8f9e01",
          "chain": "ARC-TESTNET",
          "via": "confirm",
          "payeeLock": {
            "coolingHours": 24
          }
        },
        "body_hash": "ce8d26688d5e5e11714bd759bdfce422f27e29eb30f5c81e0e8a3db1ba9868db",
        "signature": "db01ada362a26c4d8dab8528cae2cb0961fc9fcb1d81fa5266504f2fa989b21ee43d3d4efcdfddf8f892a23e158ded92a601562d12b52fc5b4755fa63e9a9306",
        "prev_hash": "09c9fc837135aa8c1570b36ab1dc22a6cf727dccc9d3364978b6c293db7b8144",
        "hash": "7890fd259c2a528efe9e2a57ff9b2d79385a4e7a684bcd2b12a1f93de96853d9",
        "signing_key_id": "36e3209ae2e6a600",
        "check": {
          "ok": true
        }
      },
      {
        "seq": 5611,
        "id": "a85a44cf-3b4c-46e0-a700-2f5f69baeb00",
        "ts": "2026-10-03T16:00:00.000Z",
        "actor": "human",
        "domain": "contractor",
        "action": "create_milestone",
        "summary": "Added a milestone for Lumen Dev: Checkout page redesign, 800 USDC",
        "detail": {
          "by": "4b7e0c1a-2d3f-4e5a-8b6c-7d8e9f0a1b01",
          "milestoneId": "7d1e4c2a-5b3f-4e8a-9c61-2f0a8b3d4f61",
          "counterpartyId": "7d1e4c2a-5b3f-4e8a-9c61-2f0a8b3d4c02",
          "counterpartyName": "Lumen Dev",
          "amount": 800,
          "verificationSource": "https://github.com/northstar-studio/site/pull/48"
        },
        "body_hash": "a6c87fb49341cf5cac1db041ef3b707aa1e6292ee79c759486bb48c8a561c984",
        "signature": "bff59cdb1df88107c19201024c97d9eb21a78a2a10449f38377f24a4af3edc9abca146874511813b9d03360845656921afe09b14594fe7707f9fe24ecac1c903",
        "prev_hash": "1bd91f4c85872fe824fc18dfb7409f1ce3bbe63728fe993d070a4e14ef03c070",
        "hash": "655b287db5c7d17fdf9f87425bd3a434555a89ea8dbc71125b319d7569dfd785",
        "signing_key_id": "36e3209ae2e6a600",
        "check": {
          "ok": true
        }
      },
      {
        "seq": 5613,
        "id": "78398ac1-68ee-49b5-bdd6-ac91c8efd46a",
        "ts": "2026-10-08T09:10:00.000Z",
        "actor": "system",
        "domain": "contractor",
        "action": "verify_milestone_github",
        "summary": "GitHub reported northstar-studio/site#48 merged",
        "detail": {
          "milestoneId": "7d1e4c2a-5b3f-4e8a-9c61-2f0a8b3d4f61",
          "verificationSource": "https://github.com/northstar-studio/site/pull/48",
          "verificationStatus": "verified",
          "pullRequest": "https://github.com/northstar-studio/site/pull/48",
          "mergedAt": "2026-10-08T09:00:00.000Z"
        },
        "body_hash": "02cda18d117ee8a85b545b2f763e98c76da513ae29cd6c5be13edddcb7e521e9",
        "signature": "476786c4a530c5812390de35db83f990bea1da69a5da3830d38b46df99dbcba6de19c61901ec410c2c959292b6dd5731d65181403668b6ed9577cf87a8bf6a0c",
        "prev_hash": "b2687ac1ce1ae6f949ccd43e446e22fe7b36dc6dda1eebaa66d40afdca2fba81",
        "hash": "913a2752c8857418c9c9cfdf90c1066d64c2385b162b53f33daf2a6e9fb1ead8",
        "signing_key_id": "36e3209ae2e6a600",
        "check": {
          "ok": true
        }
      },
      {
        "seq": 5614,
        "id": "b35a5cdd-fbc9-43eb-8fc4-88bdfcf580c1",
        "ts": "2026-10-08T09:11:00.000Z",
        "actor": "agent",
        "domain": "contractor",
        "action": "milestone_release",
        "summary": "Released 800 USDC to Lumen Dev for Checkout page redesign",
        "detail": {
          "milestoneId": "7d1e4c2a-5b3f-4e8a-9c61-2f0a8b3d4f61",
          "counterpartyId": "7d1e4c2a-5b3f-4e8a-9c61-2f0a8b3d4c02",
          "decision": {
            "action": "release"
          },
          "decisionMode": "anthropic",
          "agreedWithReference": true,
          "guardrailBlocked": false,
          "observed": {
            "amount": 800,
            "paymentLimit": 1000,
            "riskLevel": "clear",
            "verification": {
              "verified": true,
              "method": "github",
              "source": "https://github.com/northstar-studio/site/pull/48",
              "note": null
            }
          },
          "execution": {
            "txRef": "0xaa4864c775958bc6f6fd541460df2a351093dd600e37329351639dd191f2030c",
            "resultingStatus": "paid"
          }
        },
        "body_hash": "40a6a70c89faeecaea30c2e9375a532f7a4d1c0384cc158119f1219678dfeefb",
        "signature": "fbf6d5a4cda2134e5d946f23774303f56c359b60b2006bacb1a37c74ef0c8c83ff3ac20bce50b29ec74756fa41fc8e06fc200b6894d7de8f642d3325dae5a703",
        "prev_hash": "913a2752c8857418c9c9cfdf90c1066d64c2385b162b53f33daf2a6e9fb1ead8",
        "hash": "fb8324e5ec87a4b8073032fb05e1d44a2773a714e317a4e5909943d6cc5b1c61",
        "signing_key_id": "36e3209ae2e6a600",
        "check": {
          "ok": true
        }
      }
    ]
  }
}
```

**Fields**

- `data` (object, required): One payable's or milestone's evidence, `vestiarion-evidence/1`: the chain its evidence page shows, each fact citing the signed entries it rests on, which it carries in full.
  - `format` (string, required) One of `vestiarion-evidence/1`.
  - `exportedAt` (string, required)
  - `workspace` (object, required): The workspace the document is of.
    - `slug` (string, required)
    - `name` (string, required)
  - `network` (object, required): The workspace's network.
    - `id` (string, required) One of `arc-testnet`, `arc-mainnet`.
    - `label` (string, required): The network's name, as the workspace's pages write it.
  - `subject` (object, required): The payable or milestone the evidence is of.
    - `kind` (string, required) One of `invoice`, `milestone`.
    - `id` (string, required)
    - `title` (string, required)
    - `payee` (string, required)
    - `amount` (number, required): The bill's or the milestone's amount.
    - `paidAmount` (number, nullable, required): What was paid, when an early-payment discount took part of the bill off; null when the whole amount was paid, and for anything not paid.
    - `currency` (string, required)
    - `status` (string, required)
    - `paid` (boolean, required)
    - `closed` (boolean, required): Rejected by a person, or closed without paying: it will not be paid.
    - `simulated` (boolean, required): Marked paid by a simulated transfer: nothing moved on chain.
    - `onChain` (boolean, required): Paid by a transaction on chain the chain shows.
  - `labels` (object, required): The seven words a fact is labelled with, what each means, and how many facts each holds.
  - `steps` (array of object, required)
    - `id` (string, required) One of `agreed`, `delivered`, `bill`, `payee`, `decision`, `people`, `payment`, `books`, `receipt`, `signatures`.
    - `title` (string, required)
    - `label` (string, required): The step's label in words.
    - `kind` (string, required) One of `checked`, `verified`, `stated`, `inferred`, `missing`, `unreachable`, `contradicted`.
    - `caveat` (string, optional)
    - `facts` (array of object, required)
      - `label` (string, required): The fact's label in words.
      - `kind` (string, required) One of `checked`, `verified`, `stated`, `inferred`, `missing`, `unreachable`, `contradicted`.
      - `text` (string, required)
      - `who` (string, nullable, required): Who stated it: a member by user id, "a former member", "a member" when the members could not be read, "the payee", "@<login> on GitHub" for a GitHub bounty; null when the ledger names no one.
      - `at` (string, nullable, required)
      - `fill` (string, optional): For a missing fact: what would fill it.
      - `notes` (array of string, optional)
      - `link` (object, optional): A link a fact points to, and what its check found.
        - `href` (string, required)
        - `label` (string, required)
        - `state` (string, required) One of `checked`, `not_opened`, `unreachable`, `contradicted`, `cannot_open`.
        - `reason` (string, optional)
        - `given` (boolean, optional): A link a person, a payee or GitHub gave, rather than one Vestiarion built. One of `true`.
      - `warn` (boolean, optional): What it says is bad news, however well it is known. One of `true`.
      - `entries` (array of integer, required): The signed entries it rests on, by `seq`.
  - `signedEntryProves` (string, required): What a signed entry proves, and what it does not.
  - `checkAnEntry` (array of string, required): How to check one entry alone: its body hash, its signature and its chain hash.
  - `keys` (array of object, required): The workspace's public keys, active and retired, each under its id: what the entries were signed with.
    - `id` (string, required): The first 16 hex characters of the SHA-256 of the key's public SPKI: a key counts only under this id.
    - `status` (string, required) One of `active`, `retired`.
    - `publicKeyPem` (string, required)
  - `entries` (array of object, required): Every entry the document cites, oldest first, in full, each with the server's check.
    - `seq` (integer, required)
    - `id` (string, nullable, required)
    - `ts` (string, required)
    - `actor` (string, required)
    - `domain` (string, required)
    - `action` (string, required)
    - `summary` (string, required)
    - `detail` (object, required)
    - `body_hash` (string, required)
    - `signature` (string, required)
    - `prev_hash` (string, required)
    - `hash` (string, required)
    - `signing_key_id` (string, nullable, required)
    - `check` (any, nullable, required): The server's check of this entry alone. A checker re-checks it rather than trust this field.

## Errors

| Status | Code | When |
| --- | --- | --- |
| 401 | `unauthorized` | No key, or a malformed, unknown or revoked one: "A valid API key is required." |
| 403 | `forbidden` | The key's scopes do not cover this route: "This key cannot do that." Or, on a write, the person who created the key can no longer add records: "This key's issuer can no longer add records in this workspace." |
| 404 | `not_found` | The requested resource does not exist in the key's workspace. |
| 429 | `rate_limited` | Too many requests; wait as long as `Retry-After` says before trying again. |
| 500 | `internal` | An unexpected server error. Implementation details are not exposed. |