Evidence access

Axiom keeps three kinds of evidence for every action:

• the action timeline (action_events): submitted, evaluated, approval requested and delivered, decisions, resume requests, dispatch, outcome, reconciliation;
• the signed receipt (axiom.receipt.v1), issued when an action reaches an outcome (including outcome_unknown) and reissued if reconciliation later establishes the final state;
• the audit stream (audit_events), the org-wide log delivered to SIEM.

Prompts, model reasoning, payment credentials and application payloads are not stored. Only the declared material fields (in canonical form, with salted commitments in the receipt), the summary and the intent text are kept. See Security model and privacy.

Who can read and export

Role (scope)	Read status, timeline, receipts	Export receipts and bundles
project_owner (project)	yes	yes
developer, viewer (project)	yes	no
tenant_admin (tenant)	yes, for the tenant's actions	yes
auditor (tenant or org)	yes	yes
org_admin, security_admin (org)	yes, for enrolled projects and org tenants	yes
The requesting agent	its own actions only	its own receipts

A scoped auditor can verify and export permitted evidence but cannot edit policies or approve anything. Filters are applied in the repository layer, never only in the UI: a request outside your scope answers 404.

One action

• Action detail (/app/actions/:aid, GET /v1/actions/{id}/timeline): status, agent, the stored policy decision and rule trace, every event, every approval with its decisions (approver, decision, how it was verified, native reference), related delegated actions, and a diagnosis.
• Receipt (/receipts/:aid, GET /v1/actions/{id}/receipt): the signed bundle, verified in the browser.

Redacted receipts

GET /v1/actions/{action_id}/receipt?reveal=operation,params.amount,params.currency

reveal limits the disclosures to the named fields. The signed commitments still cover every field, so the redacted bundle proves exactly what it shows and nothing more; a verifier reports the rest as redacted. Field names: tenant, agent, audience, operation, resource, not_after, root_action and params.<name>. Every export is recorded (receipt.exported, with whether it was redacted).

Across projects (Control)

Console: Evidence at /control/orgs/:oid/evidence.

GET /v1/orgs/{oid}/actions?q=417&state=succeeded&tenant=ten_…&project=prj_…&limit=50

Returns { items, next_cursor } scoped to what you may read, with a visibility per row.

POST /v1/orgs/{oid}/exports
content-type: application/json

{ "project_ids": ["prj_…"], "tenant_ids": ["ten_…"], "from": "2026-11-01T00:00:00Z", "to": "2026-12-01T00:00:00Z", "reveal": ["operation", "params.amount"] }

Answers { id, status, receipt_count, download_url }. One export holds at most 1,000 receipts; narrow the filters for more. Download with GET /v1/exports/{id}: the creator (while still allowed to export) or an org-wide exporter can download it. A tenant or project filter outside your scope is 404.

Evidence of enrolled projects

When an org enrolls an existing project (see Enrolling existing projects), the accepted terms decide what the org can see through the org:

Term	Effect on org-derived access
evidence_transfer: "all"	The project's full action history.
evidence_transfer: "since_enrollment"	Actions from acceptance onwards.
evidence_transfer: "none"	No action evidence through the org.
visibility: "metadata"	Summaries, resource IDs and field disclosures are withheld.

The project's own members keep their direct access regardless.

Retention and legal hold

Each receipt records a retention date when it is issued, from the project's plan:

Plan	History retained
free	14 days
team	90 days
business	365 days
control	2,555 days (7 years)

Place or release a legal hold (requires evidence.export; the reason is recorded):

POST /v1/receipts/{receipt_id}/legal-hold
content-type: application/json

{ "hold": true, "reason": "Dispute 2026-114 with Acme Corp" }

The periodic maintenance sweep (every 5 minutes) deletes receipts whose retention date has passed, with two exceptions: a receipt under legal hold is never deleted, and a receipt whose action has not reached a final state (succeeded or failed; for example one still outcome_unknown) is kept as evidence of work in flight. Export anything you need beyond the plan's history before it expires.

Enrollment retention term not enforced

The enrollment term retention_days is recorded with the accepted invitation but does not change how long receipts are kept; the plan's history days apply.

Verifying evidence outside Axiom

A receipt bundle verifies without an Axiom login: axiom verify receipt.json, the verifyReceipt function in the SDK, or the browser receipt verifier. Bundles carry the provider's outcome keys separately (provider_keys), and the verifier never accepts an Axiom key as the provider's outcome signer. For a dispute, still pin Axiom's published keys (--issuer-jwks https://api.sectigoaxiom.com/.well-known/jwks.json) and the provider's outcome keys rather than trusting the key snapshot embedded in the bundle; see Receipts and verification.