{
  "service": "SelfCheck",
  "api_version": "v1",
  "description": "Assesses whether a correspondence artefact supports a stated claim. Returns a three-state decision with the substantive outcome, reason codes, supported scope and — always — what the result does not establish.",
  "authentication": {
    "scheme": "Bearer",
    "header": "Authorization: Bearer sc_v1_…",
    "how_to_obtain": "A person creates a workspace in the web interface and issues a token under Settings. Tokens are not self-service: every token is attributable to the human who issued it.",
    "scopes": {
      "read": "Read records and reports. Cannot upload or grant access.",
      "write": "Read, upload messages, and issue access links."
    }
  },
  "reading_the_result": {
    "decision": "RELY, INCONCLUSIVE or DO_NOT_RELY. Three values only.",
    "warning": "RELY is scoped. It is never a general statement that a message, sender or account is authentic. A caller that acts on `decision` without reading `supported_scope`, `limitations` and `not_established` is misusing this API.",
    "inconclusive": "INCONCLUSIVE is a lawful answer, not an error and not a soft negative. It means the material available cannot settle the question — a degraded source, an unavailable key, a missing original. A caller that treats it as a failure, or collapses it into DO_NOT_RELY, is misreporting the result.",
    "never_infer": "DO_NOT_RELY is not an allegation. It is reached only where a defined signal fails over a source of sufficient fidelity to carry it, and it says nothing about the intent of any person. Everything that cannot be settled returns INCONCLUSIVE instead.",
    "technical_failure": "substantive_outcome TECHNICAL_FAILURE means nothing was assessed. It carries no information about the message and must not be reported as a negative finding."
  },
  "endpoints": [
    {
      "method": "GET",
      "path": "https://selfcheck.34.142.21.221.sslip.io/api/v1",
      "auth": false,
      "description": "This document."
    },
    {
      "method": "GET",
      "path": "https://selfcheck.34.142.21.221.sslip.io/api/v1/whoami",
      "auth": "read",
      "description": "Confirm a token and its scope."
    },
    {
      "method": "POST",
      "path": "https://selfcheck.34.142.21.221.sslip.io/api/v1/assess",
      "auth": "write",
      "description": "Assess a message. Body is the raw file bytes (.eml or Outlook .msg). Optional headers: X-SelfCheck-Label, X-SelfCheck-Filename.",
      "limits": {
        "max_bytes": 26214400
      }
    },
    {
      "method": "GET",
      "path": "https://selfcheck.34.142.21.221.sslip.io/api/v1/records",
      "auth": "read",
      "description": "List records for the organisation."
    },
    {
      "method": "GET",
      "path": "https://selfcheck.34.142.21.221.sslip.io/api/v1/records/{id}",
      "auth": "read",
      "description": "One record."
    },
    {
      "method": "GET",
      "path": "https://selfcheck.34.142.21.221.sslip.io/api/v1/records/{id}/report.pdf",
      "auth": "read",
      "description": "Deterministic PDF for a record."
    },
    {
      "method": "POST",
      "path": "https://selfcheck.34.142.21.221.sslip.io/api/v1/records/{id}/grants",
      "auth": "write",
      "description": "Issue time-limited access. JSON body: recipients (array of email), disclosure (decision|evidence|message), window (24h|7d|30d|90d), purpose. Returns one link per recipient, shown once."
    },
    {
      "method": "POST",
      "path": "https://selfcheck.34.142.21.221.sslip.io/api/v1/grants/{id}/revoke",
      "auth": "write",
      "description": "Withdraw a grant."
    }
  ],
  "errors": {
    "shape": {
      "error": "machine_readable_code",
      "message": "human sentence",
      "retryable": "boolean"
    },
    "codes": [
      "unauthorised — token missing, unknown or revoked",
      "forbidden — token scope insufficient",
      "not_found — no such record in this organisation",
      "too_large — body exceeds the size limit",
      "empty_body — no bytes supplied",
      "upstream_unavailable — the forensic worker could not be reached; retryable"
    ]
  },
  "schema": "/schemas/decision-result.schema.json"
}