The Evidence API allows you to push compliance evidence directly to your Strike Graph evidence repository using secure API calls. This integration enables you to streamline evidence collection by connecting your existing systems and workflows to your GRC, reducing manual effort and ensuring your evidence stays current.

With the Evidence API, you can send evidence to any evidence item in your Strike Graph instance. The API accepts JSON data and file uploads (PDFs, Office documents, images, and more), making it suitable for automated testing by Verify AI, continuous control monitoring, and integration with your existing compliance tools.

Getting Started

Prerequisites

• An active Strike Graph account with API access enabled

• Appropriate permissions to manage integrations in your Strike Graph instance

• The external ID of the evidence item you want to upload to

Step 1: Set up API credentials

To get your API credentials, navigate to the Integration Manager and find the "Public Evidence API" card. After opening this card, click the "Connect" button to generate credentials.

Please note: once created, you will not be able to re-retrieve your Client Secret, so make sure you store it in a secure location (such as your password manager).

Your credentials will include:

• Client ID

• Client Secret

• Auth0 Domain

• API Audience (typically urn:sg:public-api)

Step 2: Obtain an access token

Before making API calls, you'll need to obtain an access token using your M2M credentials:

POST https://login.grc.strikegraph.com/oauth/token 
Content-Type: application/json 

BODY 
{ 
  "grant_type": "client_credentials",
  "client_id": "{your-client-id}",
  "client_secret": "{your-client-secret}",
  "audience": "urn:sg:public-api"
}

The response will include an access_token that you'll use for subsequent API calls. Tokens are valid for 2 hours by default.

Using the Evidence API

Finding the API Route for Your Evidence

To upload evidence to a specific item, you'll need its API route (which contains the evidence's external ID). You can find this in Strike Graph by:

1. Navigate to the evidence item in your Evidence Repository

2. Click on the evidence item to open its details page

3. Look for the "API Route" button in the evidence details

4. Click on the button to copy the route

Note: External IDs are unique within your organization and remain stable across evidence updates.

Attach JSON data via API

To attach JSON evidence, send a POST request with Content-Type: application/json and the JSON data as the request body:

POST  https://api.grc.strikegraph.com/v1/evidence/{evidence-external-id}/attachment 
Authorization: Bearer {access-token} 
Content-Type: application/json 

BODY
{ 
  "your": "evidence-data", 
  "timestamp": "2024-01-15T10:30:00Z", 
  "status": "active" 
}

The JSON body can be any valid JSON object containing your evidence data, up to 10 MB.

Attach a file via API

The Evidence API also accepts file uploads. Send the file's raw bytes as the request body with the appropriate Content-Type header for the file format:

POST  https://api.grc.strikegraph.com/v1/evidence/{evidence-external-id}/attachment 
Authorization: Bearer {access-token} 
Content-Type: application/pdf 

BODY
{raw file bytes}

The file is sent as the raw request body, not as a multipart form upload. Set the Content-Type header to match the file's actual format. The server validates that the file's contents are consistent with the declared type and will reject mismatches.

Supported file types

The following file types are accepted:

• Documents: PDF (application/pdf), Word (application/msword, application/vnd.openxmlformats-officedocument.wordprocessingml.document), RTF (text/rtf)

• Spreadsheets: Excel (application/vnd.ms-excel, application/vnd.openxmlformats-officedocument.spreadsheetml.sheet)

• Presentations: PowerPoint (application/vnd.ms-powerpoint, application/vnd.openxmlformats-officedocument.presentationml.presentation)

• Apple iWork: Pages, Numbers, Keynote

• Images: PNG (image/png), JPEG (image/jpeg), GIF (image/gif), TIFF (image/tiff)

• Text and data: Plain text (text/plain), Markdown (text/markdown), CSV (text/csv), XML (text/xml), JSON (application/json), YAML (application/yaml, application/x-yaml, text/yaml)

Archive files (ZIP) and SVG images are not accepted.

Required headers

• Authorization: Bearer {access-token} — Your M2M access token

• Content-Type — Must match the format of the file being uploaded. The server uses this header to determine the stored file extension, so it must be accurate.

Optional headers

• Request-Id: {uuid} — Optional request identifier that will be returned as X-Request-Id for tracking

Custom filename

Attachments are saved with a default filename following the pattern api-attachment-{date}.{ext}, where the extension is determined by the Content-Type header.

You can provide a custom filename by appending ?filename=custom-filename to the URL. Custom filenames only support alphanumeric characters, dashes, and underscores. The file extension is always set automatically based on the Content-Type; you do not need to include it in the filename.

Request body

• For JSON: a JSON object containing your evidence data

• For files: the raw file bytes (not multipart/form-data)

• Maximum size: 10 MB

• File uploads (non-JSON) must not be empty

Success response

When your evidence is successfully uploaded, you'll receive a 201 Created response:

{     
    "requestId": "{uuid}",
    "attachmentUrl": "{url}"
}

The evidence will immediately appear in your Strike Graph instance and be available for compliance monitoring.

Rate Limits and Best Practices

Rate limiting

• 50 requests per minute per client

• Rate limits are applied per client ID, so multiple applications can each make 50 requests per minute

• When rate limited, you'll receive a 429 response with Retry-After headers indicating when to retry

Best practices

• Store your credentials securely — Never hardcode client secrets in your application code

• Handle token expiration — Access tokens expire after 2 hours, so implement automatic token refresh

• Implement retry logic — Handle rate limits and temporary errors gracefully with exponential backoff

• Set the correct Content-Type — The server validates file contents against the declared type and will reject mismatches

Error Handling

The Evidence API returns standardized error responses to help you troubleshoot issues quickly:

{ 
  "errorCode": "ERROR_CODE_IN_CAPS",
  "message": "Human-readable error description",
  "details": {},
  "meta": {} 
}

Common errors

Request tracking

Include a Request-Id header with a unique UUID to track requests across logs and support interactions. This ID will be returned as X-Request-Id in the response headers.

Need More Help?

If you encounter issues with the Evidence API, check the error response first: the message and details fields provide specific guidance on what went wrong. Verify that your credentials, scopes, and evidence IDs are correct, and confirm you're within the 50 requests per minute rate limit. If you need further assistance, reach out through the in-app messenger.