InsuredAuditDeveloper Portal

Court Ready Evidentiary Bundles (CREB)

A CREB bundle is a sealed, signed ZIP that proves the state of a member, matter, or incident as of a particular date. It is the platform’s primary export format for legal discovery, regulator inquiry, and internal audit.

Lifecycle

  1. Request. POST /v1/bundles returns immediately with status: REQUESTED and a new bundle_id.
  2. Build. The bundle-worker polls for requested rows, fetches all matching events + documents, generates a manifest, computes hashes, signs with an Ed25519 key from the signing-keys registry, and writes a sealed ZIP to WORM.
  3. Seal. The row flips to status: SEALED with a worm_blob_sha256 pointing at the ZIP.
  4. Download. GET /v1/bundles/{id}/download streams the ZIP. The ETag equals the SHA-256 so downstream tooling can verify.

Scope syntax

{
  "scope": {
    "tenant_id": "acme",
    // pick ONE of these scope keys:
    "member_id": "01HZZMEMBERID...",
    "matter_id": "matter-abc-123",
    "incident_id": "INC-2026-05-23-001",
    // optional time window:
    "from": "2024-01-01T00:00:00Z",
    "to": "2026-05-23T00:00:00Z"
  },
  "bundle_type": "MEMBER",       // MEMBER | MATTER | INCIDENT
  "requested_by": "[email protected]"
}

Bundle contents

  • manifest.json — the bundle metadata, the request scope, a list of every included event and document with sha256s, the signing key id, the signature, and the WORM head hash at seal time.
  • events.jsonl — every event envelope, one per line.
  • documents/{sha256} — every referenced document.
  • chain.tsv — the chain-of-custody trace.
  • signature.sig — detached Ed25519 signature over the manifest.

Verification

Use POST /v1/bundles/{id}/verify-signature to have the platform re-check a freshly-downloaded bundle (the route doesn’t require the bytes — it verifies the WORM-resident copy). For offline verification, the manifest’s signing_public_key_jwk is published verbatim so independent verifiers can run the check without contacting the platform.

Diffs

GET /v1/bundles/{id}/diff?against={other_id} returns a JSON diff between two bundles built over the same scope at different times — useful for showing what changed between an original production and a supplemental.