control plane api

Evaluations and frozen cohorts

Select redacted capture metadata from one workload, freeze exact capture references into an immutable cohort, and issue a short-lived export for that cohort only. All routes accept the same tenant-scoped authentication as the CLI.

Endpoints

method & path	does
`GET .../workloads/:workload_id/eval-capture-catalog`	Returns bounded, redacted metadata and content hashes. Filter by time, model, status, tool presence, structured output, limit, and deterministic sample seed.
`POST .../workloads/:workload_id/eval-cohorts`	Verifies 1–500 exact capture references against R2, freezes their order and selection metadata, and returns a server-computed cohort hash.
`GET .../workloads/:workload_id/eval-cohorts`	Lists immutable cohorts for the workload without returning capture bodies.
`POST .../eval-cohorts/:cohort_id/export`	Returns short-lived download URLs for that cohort's captures only and records the export.
`POST/GET .../eval-specs and .../eval-runs`	Stores immutable eval definitions and compact run summaries tied to a workload and cohort.

Capture catalog

catalog request

GET /admin/v1/orgs/org_.../projects/proj_.../workloads/usp_.../eval-capture-catalog
  ?from=2026-07-01T00:00:00Z
  &to=2026-07-15T00:00:00Z
  &limit=50
  &sample_seed=july-parity
  &status_code=200
  &requires_tools=true

The response includes capture_key, request_id, content_sha256, time, model and status metadata, latency, and shape flags. It excludes request and response bodies. The maximum window is 31 days and the maximum returned set is 100 captures.

Freeze and export

Create a cohort by posting the catalog's exact capture references and hashes. Understudy re-reads each R2 object, checks workload ownership, and rejects stale or modified content. Export links expire in 60–3,600 seconds and cover only the stored cohort.

cohort export response (shape)

{
  "export_id": "eve_...",
  "cohort_id": "evc_...",
  "cohort_sha256": "...",
  "expires_at": "2026-07-17T08:00:00Z",
  "captures": [
    {
      "request_id": "0190...",
      "content_sha256": "...",
      "url": "https://...short-lived-signed-url"
    }
  ]
}