> ## Documentation Index > Fetch the complete documentation index at: https://docs.checkfu.com/llms.txt > Use this file to discover all available pages before exploring further. > ## Agent Instructions > Base URL: https://api.checkfu.com. Current wire version: `2026-08-31` (`Checkfu-Version: 2026-08-31`). > Mutating HTTP requests require `Authorization: Bearer $CHECKFU_API_KEY`, `Checkfu-Version: 2026-08-31`, `Content-Type: application/json`, and `Idempotency-Key` on retriable writes. Ordinary API keys are Workspace-bound; do not send a Workspace selector header. > Core workflow: create an Agent (`POST /v1/agents`) and Environment (`POST /v1/environments`), grant `use_environment` (`POST /v1/permission-assignments`), create a Session (`POST /v1/sessions`), send events (`POST /v1/sessions/{id}/events`), stream progress (`GET /v1/sessions/{id}/events/stream`), and read the input result (`GET /v1/sessions/{id}/inputs/{input_id}/result`). > Domain model: an Agent is mutable configuration; a Session freezes its AgentVersion and Environment at creation and owns its private workspace and ordered event history. Vault stores secret credentials; Connection links an external account; ActionApproval records human approval before an action runs. > Capability status combines `audience`, `stability`, `availability`, evaluated prerequisites, and release evidence; check https://docs.checkfu.com/getting-started/status (`GET /v1/support/capabilities`) for live `available` status. # Read the Session evidence an ActionApproval withholds > Returns the real values of the fields a pending Automation review withholds from its context_summary.subject because they are drawn from Session… ## OpenAPI ````yaml /openapi.json get /v1/action-approvals/{id}/session-evidence openapi: 3.1.0 info: title: Checkfu API version: '2026-08-31' description: >- Authentication is declared per operation: API-key, runtime, or connector bearer; Automation signature; or credential-free pairing redemption. Every general Checkfu REST request requires the dated `Checkfu-Version` header (one of: 2026-08-31); the three MCP JSON-RPC transports use `MCP-Protocol-Version`, A2A uses `A2A-Version`, and the provider OAuth callback carries neither Checkfu header. API keys resolve one Workspace without a request selector; authenticated responses identify it with `Checkfu-Workspace-Id`. servers: - url: https://api.checkfu.com security: - bearerAuth: [] tags: - name: organizations - name: sourceRepositories - name: tenants - name: workspaces - name: principals - name: principalGroups - name: principalAccessCredentials - name: apiKeys - name: agents - name: harnessRuntime - name: permissionAssignments - name: actionPolicies - name: files - name: memoryStores - name: modelCredentials - name: modelRoutingProfiles - name: toolSources - name: skills - name: skillSources - name: skillProposals - name: instructionProposals - name: catalog - name: concepts - name: support - name: connections - name: connectionAssignments - name: connectedRuntimes - name: fileTrees - name: collaboration - name: automationGraphs - name: automations - name: actionApprovals - name: standingApprovals - name: workloadReviewPolicies - name: usage - name: models - name: budgets - name: billing - name: sessions - name: audit - name: sessionExports - name: runs - name: runnerPools - name: transcripts - name: sessionWatches - name: sessionCapsules - name: sessionTrajectories - name: webhookEndpoints - name: integrationGateway - name: environments - name: vaults - name: apiMcp - name: a2a paths: /v1/action-approvals/{id}/session-evidence: get: tags: - actionApprovals summary: Read the Session evidence an ActionApproval withholds description: >- Returns the real values of the fields a pending Automation review withholds from its `context_summary.subject` because they are drawn from Session evidence: the Connection call arguments or business review inputs named in the subject's `withheld`, with `evidence_sha256`, their canonical digest, which equals the subject's `session_evidence.evidence_sha256`, and `not_after`, after which they can no longer be read. Only a signed-in Console person whose current `observe` grant covers every Agent in `session_evidence.agents` may read them, and the same grant is required to answer the review and is checked again when the approved call sends. The read is audited by digest; no value is written to the ActionApproval, its audit or the run trace. A review that withholds nothing, one that is no longer pending, or evidence whose custody ended reads as not found. Checkfu support posture: alpha; hosted. Required evidence journey: capability-gateway. Deployment-specific readiness and the latest proven release are available from GET /v1/support/capabilities. operationId: actionApprovals.getActionApprovalSessionEvidence parameters: - name: id in: path schema: $ref: '#/components/schemas/NonBrowserActionApprovalId' required: true - name: checkfu-version in: header schema: type: string enum: - '2026-08-31' required: true responses: '200': description: Success content: application/json: schema: type: object properties: withheld: $ref: '#/components/schemas/AutomationReviewWithheldFieldsUnique' values: $ref: '#/components/schemas/JsonObject' evidence_sha256: type: string pattern: ^sha256:[0-9a-f]{64}$ not_after: $ref: '#/components/schemas/CurrentTimestamp' required: - withheld - values - evidence_sha256 additionalProperties: false headers: checkfu-workspace-id: description: The Workspace resolved from the authenticated bearer credential. required: true schema: $ref: '#/components/schemas/WorkspaceId' '400': description: Typed Checkfu wire error content: application/json: schema: type: object properties: type: type: string enum: - error error: type: object properties: type: type: string enum: - invalid_request_error code: type: string enum: - validation.malformed message: type: string more: type: string enum: - >- https://docs.checkfu.com/reference/errors#validation-malformed description: >- Stable public documentation and remedy for this error type. required: - type - code - message - more additionalProperties: false request_id: type: string allOf: - minLength: 1 required: - type - error - request_id additionalProperties: false '401': description: Typed Checkfu wire error content: application/json: schema: type: object properties: type: type: string enum: - error error: type: object properties: type: type: string enum: - authentication_error code: type: string enum: - auth.invalid_key message: type: string more: type: string enum: - >- https://docs.checkfu.com/reference/errors#auth-invalid-key description: >- Stable public documentation and remedy for this error type. required: - type - code - message - more additionalProperties: false request_id: type: string allOf: - minLength: 1 required: - type - error - request_id additionalProperties: false '403': description: >- The organization, tenant, or workspace backing this key is administratively disabled. | Deployment governance or retention policy denied the request. content: application/json: schema: anyOf: - type: object properties: type: type: string enum: - error error: type: object properties: type: type: string enum: - permission_error code: type: string enum: - auth.disabled_tenancy message: type: string more: type: string enum: - >- https://docs.checkfu.com/reference/errors#auth-disabled-tenancy description: >- Stable public documentation and remedy for this error type. required: - type - code - message - more additionalProperties: false request_id: type: string allOf: - minLength: 1 required: - type - error - request_id additionalProperties: false - $ref: '#/components/schemas/PolicyDeniedError' '404': description: >- The requested resource does not exist in the resolved deployment boundary. content: application/json: schema: $ref: '#/components/schemas/ValidationNotFoundError' '409': description: >- The Session evidence a review withholds is no longer retained: its source was erased or its custody ended. content: application/json: schema: $ref: '#/components/schemas/RetentionEvidenceContentUnavailableError' '429': description: Typed Checkfu wire error headers: retry-after: description: >- Delay in seconds for rate limits or deployment quotas with a known release or UTC reset boundary required: false schema: type: integer minimum: 1 content: application/json: schema: type: object properties: type: type: string enum: - error error: type: object properties: type: type: string enum: - rate_limit_error code: type: string enum: - budget.exceeded message: type: string more: type: string enum: - >- https://docs.checkfu.com/reference/errors#budget-exceeded description: >- Stable public documentation and remedy for this error type. required: - type - code - message - more additionalProperties: false request_id: type: string allOf: - minLength: 1 required: - type - error - request_id additionalProperties: false '500': description: >- An unexpected internal failure occurred; the message contains an opaque incident reference. content: application/json: schema: $ref: '#/components/schemas/RuntimeInternalError' '503': description: Authorization could not be evaluated. Retry the same request. content: application/json: schema: $ref: '#/components/schemas/AuthorizationUnavailableError' security: - bearerAuth: [] components: schemas: NonBrowserActionApprovalId: type: string pattern: ^approval_[0-9a-f]{32}$ AutomationReviewWithheldFieldsUnique: type: array items: type: string allOf: - minLength: 1 - maxLength: 128 allOf: - minItems: 1 - maxItems: 64 JsonObject: type: object additionalProperties: $ref: '#/components/schemas/JsonValue' description: A JSON object with string keys and JSON values. CurrentTimestamp: type: string allOf: - maxLength: 24 - pattern: ^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$ x-checkfu-current-timestamp: true description: A canonical UTC ISO-8601 timestamp with millisecond precision. WorkspaceId: type: string pattern: ^wrkspc_[0-9a-f]{32}$ PolicyDeniedError: type: object properties: error: additionalProperties: false type: object properties: type: type: string enum: - permission_error message: type: string more: type: string enum: - https://docs.checkfu.com/reference/errors#policy-denied description: Stable public documentation and remedy for this error type. code: type: string enum: - policy.denied required: - type - message - more - code type: type: string enum: - error request_id: type: string allOf: - minLength: 1 required: - error - type - request_id additionalProperties: false description: Deployment governance or retention policy denied the request. ValidationNotFoundError: type: object properties: error: additionalProperties: false type: object properties: type: type: string enum: - not_found_error message: type: string more: type: string enum: - https://docs.checkfu.com/reference/errors#validation-not-found description: Stable public documentation and remedy for this error type. code: type: string enum: - validation.not_found required: - type - message - more - code type: type: string enum: - error request_id: type: string allOf: - minLength: 1 required: - error - type - request_id additionalProperties: false description: >- The requested resource does not exist in the resolved deployment boundary. RetentionEvidenceContentUnavailableError: type: object properties: error: additionalProperties: false type: object properties: type: type: string enum: - conflict_error message: type: string more: type: string enum: - >- https://docs.checkfu.com/reference/errors#retention-evidence-content-unavailable description: Stable public documentation and remedy for this error type. code: type: string enum: - retention.evidence_content_unavailable required: - type - message - more - code type: type: string enum: - error request_id: type: string allOf: - minLength: 1 required: - error - type - request_id additionalProperties: false description: >- The Session evidence a review withholds is no longer retained: its source was erased or its custody ended. RuntimeInternalError: type: object properties: error: additionalProperties: false type: object properties: type: type: string enum: - api_error message: type: string more: type: string enum: - https://docs.checkfu.com/reference/errors#runtime-internal description: Stable public documentation and remedy for this error type. code: type: string enum: - runtime.internal required: - type - message - more - code type: type: string enum: - error request_id: type: string allOf: - minLength: 1 required: - error - type - request_id additionalProperties: false description: >- An unexpected internal failure occurred; the message contains an opaque incident reference. AuthorizationUnavailableError: type: object properties: error: additionalProperties: false type: object properties: type: type: string enum: - api_error message: type: string more: type: string enum: - >- https://docs.checkfu.com/reference/errors#auth-authorization-unavailable description: Stable public documentation and remedy for this error type. code: type: string enum: - auth.authorization_unavailable required: - type - message - more - code type: type: string enum: - error request_id: type: string allOf: - minLength: 1 required: - error - type - request_id additionalProperties: false description: Authorization could not be evaluated. Retry the same request. JsonValue: description: >- A value in the JSON data model: null, boolean, finite number, string, array, or object. securitySchemes: bearerAuth: type: http scheme: bearer ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.