> ## Documentation Index > Fetch the complete documentation index at: https://docs.checkfu.com/llms.txt > Use this file to discover all available pages before exploring further. # Read a reviewed plan's exact diff > Returns one page of the immutable secret-free review artifact behind a reviewed Application plan: bounded change frames with exact canonical semantic values in base64 chunks, ordered by change sequence, with an authenticated opaque cursor. Available only to a signed-in person; API keys, services, models, and MCP transports are denied (§7.4). Responses never carry raw source text. Checkfu support posture: alpha; hosted. Required evidence journey: blueprint-authority. Deployment-specific readiness and the latest proven release are available from GET /v1/support/capabilities. ## OpenAPI ````yaml /openapi.json get /v1/agent-blueprint-application-plans/{id}/diff openapi: 3.1.0 info: title: Checkfu API version: '2026-08-31' description: >- Authentication is declared per operation: API-key, runtime, or connector bearer; Automation signature; or credential-free pairing redemption. Every general Checkfu REST request requires the dated `Checkfu-Version` header (one of: 2026-08-31); the three MCP JSON-RPC transports use `MCP-Protocol-Version`, A2A uses `A2A-Version`, and the provider OAuth callback carries neither Checkfu header. API keys resolve one Workspace without a request selector; authenticated responses identify it with `Checkfu-Workspace-Id`. servers: - url: https://api.checkfu.com security: - bearerAuth: [] tags: - name: organizations - name: sourceRepositories - name: tenants - name: workspaces - name: principals - name: principalGroups - name: principalAccessCredentials - name: apiKeys - name: agents - name: harnesses - name: harnessRuntime - name: computerProfiles - name: permissionAssignments - name: actionPolicies - name: files - name: memoryStores - name: dreams - name: modelCredentials - name: modelRoutingProfiles - name: blueprintInstallations - name: toolSources - name: skills - name: skillSources - name: agentSources - name: agentBlueprints - name: skillProposals - name: instructionProposals - name: catalog - name: concepts - name: agentBlueprintApplications - name: agentBlueprintApplicationPlans - name: support - name: bootstrapRequests - name: connections - name: connectionVaults - name: connectionAssignments - name: connectedRuntimes - name: fileTrees - name: collaboration - name: automationGraphs - name: automations - name: actionApprovals - name: standingApprovals - name: usage - name: models - name: outcomes - name: budgets - name: billing - name: sessions - name: audit - name: sessionExports - name: runs - name: runnerPools - name: transcripts - name: sessionWatches - name: sessionHandoffs - name: sessionCapsules - name: sessionTrajectories - name: webhookEndpoints - name: integrationGateway - name: workEnvironments - name: computers - name: computerScreens - name: computerBrowserObservations - name: computerBrowserActions - name: environments - name: vaults - name: apiMcp - name: a2a paths: /v1/agent-blueprint-application-plans/{id}/diff: get: tags: - agentBlueprintApplicationPlans summary: Read a reviewed plan's exact diff description: >- Returns one page of the immutable secret-free review artifact behind a reviewed Application plan: bounded change frames with exact canonical semantic values in base64 chunks, ordered by change sequence, with an authenticated opaque cursor. Available only to a signed-in person; API keys, services, models, and MCP transports are denied (§7.4). Responses never carry raw source text. Checkfu support posture: alpha; hosted. Required evidence journey: blueprint-authority. Deployment-specific readiness and the latest proven release are available from GET /v1/support/capabilities. operationId: agentBlueprintApplicationPlans.getDiff parameters: - name: id in: path schema: $ref: '#/components/schemas/BlueprintApplyPlanId' required: true - name: checkfu-version in: header schema: type: string enum: - '2026-08-31' required: true - name: cursor in: query schema: $ref: '#/components/schemas/ExactReviewCursor' required: false - name: frame_limit in: query schema: type: string required: false responses: '200': description: >- Authorized, no-store, bounded page over one immutable exact review artifact. content: application/json: schema: $ref: '#/components/schemas/BlueprintApplyReviewArtifactPage' headers: checkfu-workspace-id: description: The Workspace resolved from the authenticated bearer credential. required: true schema: $ref: '#/components/schemas/WorkspaceId' '400': description: Typed Checkfu wire error content: application/json: schema: $ref: '#/components/schemas/ValidationMalformedError' '401': description: Typed Checkfu wire error content: application/json: schema: type: object required: - error properties: error: type: object required: - type - message - more properties: type: type: string enum: - auth.invalid_key message: type: string more: type: string enum: - >- https://docs.checkfu.com/reference/errors#auth-invalid-key description: >- Stable public documentation and remedy for this error type. additionalProperties: false additionalProperties: false '403': description: >- The organization, tenant, or workspace backing this key is administratively disabled. | Deployment governance or retention policy denied the request. content: application/json: schema: anyOf: - type: object required: - error properties: error: type: object properties: type: type: string enum: - auth.disabled_tenancy message: type: string more: type: string enum: - >- https://docs.checkfu.com/reference/errors#auth-disabled-tenancy description: >- Stable public documentation and remedy for this error type. required: - type - message - more additionalProperties: false additionalProperties: false - $ref: '#/components/schemas/PolicyDeniedError' '404': description: >- The requested resource does not exist in the resolved deployment boundary. content: application/json: schema: $ref: '#/components/schemas/ValidationNotFoundError' '409': description: The request conflicts with the resource's current state. content: application/json: schema: $ref: '#/components/schemas/ValidationConflictError' '429': description: Typed Checkfu wire error headers: retry-after: description: >- Delay in seconds for rate limits or deployment quotas with a known release or UTC reset boundary required: false schema: type: integer minimum: 1 content: application/json: schema: type: object required: - error properties: error: type: object required: - type - message - more properties: type: type: string enum: - budget.exceeded message: type: string more: type: string enum: - >- https://docs.checkfu.com/reference/errors#budget-exceeded description: >- Stable public documentation and remedy for this error type. additionalProperties: false additionalProperties: false '500': description: >- An unexpected internal failure occurred; the message contains an opaque incident reference. content: application/json: schema: $ref: '#/components/schemas/RuntimeInternalError' security: - bearerAuth: [] components: schemas: BlueprintApplyPlanId: type: string allOf: - pattern: ^bplan_[0-9a-f]{32}$ ExactReviewCursor: type: string allOf: - minLength: 43 - maxLength: 512 - pattern: ^[A-Za-z0-9_-]+$ BlueprintApplyReviewArtifactPage: type: object properties: artifact: type: object properties: id: $ref: '#/components/schemas/ReviewArtifactId' revision: type: integer allOf: - exclusiveMinimum: 0 blueprint_apply_plan_id: $ref: '#/components/schemas/BlueprintApplyPlanId' plan_fingerprint: type: string allOf: - pattern: ^sha256:[0-9a-f]{64}$ reviewed_body_digest: type: string allOf: - pattern: ^sha256:[0-9a-f]{64}$ change_count: type: integer allOf: - minimum: 0 canonical_body_utf8_bytes: type: integer allOf: - minimum: 0 expires_at: $ref: '#/components/schemas/CurrentTimestamp' required: - id - revision - blueprint_apply_plan_id - plan_fingerprint - reviewed_body_digest - change_count - canonical_body_utf8_bytes - expires_at additionalProperties: false frames: type: array items: $ref: '#/components/schemas/BlueprintApplyReviewArtifactFrame' allOf: - maxItems: 8 next_cursor: anyOf: - $ref: '#/components/schemas/ExactReviewCursor' - type: 'null' required: - artifact - frames - next_cursor additionalProperties: false WorkspaceId: type: string allOf: - pattern: ^wrkspc_[0-9a-f]{32}$ ValidationMalformedError: type: object properties: error: type: object properties: type: type: string enum: - validation.malformed message: type: string more: type: string enum: - https://docs.checkfu.com/reference/errors#validation-malformed description: Stable public documentation and remedy for this error type. required: - type - message - more additionalProperties: false required: - error additionalProperties: false description: >- The request could not be decoded or violated a declared input constraint. PolicyDeniedError: type: object properties: error: type: object properties: type: type: string enum: - policy.denied message: type: string more: type: string enum: - https://docs.checkfu.com/reference/errors#policy-denied description: Stable public documentation and remedy for this error type. required: - type - message - more additionalProperties: false required: - error additionalProperties: false description: Deployment governance or retention policy denied the request. ValidationNotFoundError: type: object properties: error: type: object properties: type: type: string enum: - validation.not_found message: type: string more: type: string enum: - https://docs.checkfu.com/reference/errors#validation-not-found description: Stable public documentation and remedy for this error type. required: - type - message - more additionalProperties: false required: - error additionalProperties: false description: >- The requested resource does not exist in the resolved deployment boundary. ValidationConflictError: type: object properties: error: type: object properties: type: type: string enum: - validation.conflict message: type: string more: type: string enum: - https://docs.checkfu.com/reference/errors#validation-conflict description: Stable public documentation and remedy for this error type. required: - type - message - more additionalProperties: false required: - error additionalProperties: false description: The request conflicts with the resource's current state. RuntimeInternalError: type: object properties: error: type: object properties: type: type: string enum: - runtime.internal message: type: string more: type: string enum: - https://docs.checkfu.com/reference/errors#runtime-internal description: Stable public documentation and remedy for this error type. required: - type - message - more additionalProperties: false required: - error additionalProperties: false description: >- An unexpected internal failure occurred; the message contains an opaque incident reference. ReviewArtifactId: type: string allOf: - pattern: ^rview_[0-9a-f]{32}$ CurrentTimestamp: type: string allOf: - maxLength: 24 - pattern: ^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$ description: A canonical UTC ISO-8601 timestamp with millisecond precision. BlueprintApplyReviewArtifactFrame: anyOf: - type: object properties: type: type: string enum: - change frame_sequence: type: integer allOf: - exclusiveMinimum: 0 change_sequence: type: integer allOf: - exclusiveMinimum: 0 plan_entry_sequence: type: integer allOf: - exclusiveMinimum: 0 resource: $ref: '#/components/schemas/Union_172' logical_name: $ref: '#/components/schemas/ExactReviewLogicalName' source_location: anyOf: - type: object properties: file: $ref: '#/components/schemas/ExactReviewSourcePath' canonical_path: anyOf: - $ref: '#/components/schemas/ExactReviewSourcePath' - type: 'null' start: $ref: '#/components/schemas/Objects_95' end: $ref: '#/components/schemas/Objects_95' derived: type: boolean required: - file - canonical_path - start - end - derived additionalProperties: false - type: 'null' semantic_path: $ref: '#/components/schemas/ExactReviewSemanticPath' before: anyOf: - $ref: '#/components/schemas/BlueprintApplyReviewValueRef' - type: 'null' after: anyOf: - $ref: '#/components/schemas/BlueprintApplyReviewValueRef' - type: 'null' required: - type - frame_sequence - change_sequence - plan_entry_sequence - resource - logical_name - source_location - semantic_path - before - after additionalProperties: false - type: object properties: type: type: string enum: - value_chunk frame_sequence: type: integer allOf: - exclusiveMinimum: 0 change_sequence: type: integer allOf: - exclusiveMinimum: 0 side: type: string enum: - before - after chunk_index: type: integer allOf: - minimum: 0 chunk_count: type: integer allOf: - exclusiveMinimum: 0 - maximum: 64 byte_offset: type: integer allOf: - minimum: 0 raw_utf8_bytes: type: integer allOf: - exclusiveMinimum: 0 - maximum: 65536 canonical_json_utf8_base64: $ref: '#/components/schemas/ExactReviewChunkBase64' required: - type - frame_sequence - change_sequence - side - chunk_index - chunk_count - byte_offset - raw_utf8_bytes - canonical_json_utf8_base64 additionalProperties: false description: One ordered review change descriptor or bounded canonical value chunk. Union_172: anyOf: - $ref: '#/components/schemas/ManagedResourceRef' - type: object properties: resource_kind: type: string enum: - action_policy - agent - agent_installation - automation - budget - memory_store - permission_assignment - principal - environment_recipe - surface_scope resource_id: type: 'null' required: - resource_kind - resource_id additionalProperties: false ExactReviewLogicalName: type: string allOf: - maxLength: 512 ExactReviewSourcePath: type: string allOf: - maxLength: 1024 Objects_95: type: object properties: line: type: integer allOf: - exclusiveMinimum: 0 column: type: integer allOf: - exclusiveMinimum: 0 byte: type: integer allOf: - minimum: 0 required: - line - column - byte additionalProperties: false ExactReviewSemanticPath: type: string allOf: - maxLength: 2048 BlueprintApplyReviewValueRef: type: object properties: sha256: type: string allOf: - pattern: ^sha256:[0-9a-f]{64}$ utf8_bytes: type: integer allOf: - exclusiveMinimum: 0 - maximum: 4194304 chunk_count: type: integer allOf: - exclusiveMinimum: 0 - maximum: 64 required: - sha256 - utf8_bytes - chunk_count additionalProperties: false ExactReviewChunkBase64: type: string allOf: - minLength: 4 - maxLength: 87384 - pattern: ^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$ ManagedResourceRef: anyOf: - type: object properties: resource_kind: type: string enum: - action_policy resource_id: $ref: '#/components/schemas/ActionPolicyId' required: - resource_kind - resource_id additionalProperties: false - type: object properties: resource_kind: type: string enum: - agent resource_id: $ref: '#/components/schemas/AgentId' required: - resource_kind - resource_id additionalProperties: false - type: object properties: resource_kind: type: string enum: - agent_installation resource_id: $ref: '#/components/schemas/AgentPlacementId' required: - resource_kind - resource_id additionalProperties: false - type: object properties: resource_kind: type: string enum: - automation resource_id: $ref: '#/components/schemas/AutomationId' required: - resource_kind - resource_id additionalProperties: false - type: object properties: resource_kind: type: string enum: - budget resource_id: $ref: '#/components/schemas/BudgetId' required: - resource_kind - resource_id additionalProperties: false - type: object properties: resource_kind: type: string enum: - memory_store resource_id: $ref: '#/components/schemas/MemoryStoreId' required: - resource_kind - resource_id additionalProperties: false - type: object properties: resource_kind: type: string enum: - permission_assignment resource_id: $ref: '#/components/schemas/PermissionAssignmentId' required: - resource_kind - resource_id additionalProperties: false - type: object properties: resource_kind: type: string enum: - principal resource_id: $ref: '#/components/schemas/PrincipalId' required: - resource_kind - resource_id additionalProperties: false - type: object properties: resource_kind: type: string enum: - environment_recipe resource_id: $ref: '#/components/schemas/EnvironmentId' required: - resource_kind - resource_id additionalProperties: false - type: object properties: resource_kind: type: string enum: - surface_scope resource_id: $ref: '#/components/schemas/CollaborationSpaceId' required: - resource_kind - resource_id additionalProperties: false description: Family-discriminated identity of one materialized managed resource. ActionPolicyId: type: string allOf: - pattern: ^apol_[0-9a-f]{32}$ AgentId: type: string allOf: - pattern: ^agent_[0-9a-f]{32}$ AgentPlacementId: type: string allOf: - pattern: ^aini_[0-9a-f]{32}$ AutomationId: type: string allOf: - pattern: ^auto_[0-9a-f]{32}$ BudgetId: type: string allOf: - pattern: ^bgt_[0-9a-f]{32}$ MemoryStoreId: type: string allOf: - pattern: ^memstore_[0-9a-f]{32}$ PermissionAssignmentId: type: string allOf: - pattern: ^perm_[0-9a-f]{32}$ PrincipalId: type: string allOf: - pattern: ^prin_[0-9a-f]{32}$ EnvironmentId: type: string allOf: - pattern: ^env_[0-9a-f]{32}$ CollaborationSpaceId: type: string allOf: - pattern: ^surf_[0-9a-f]{32}$ securitySchemes: bearerAuth: type: http scheme: bearer ````