Queries & evidence
Understand completion, partial answers, cancellation and what the API actually stores.
Job states
| State | Meaning |
|---|---|
| running | Waiting for one or more endpoint responses |
| complete | All targets answered successfully |
| partial | All targets responded, but at least one failed |
| timed_out | Deadline reached with outstanding targets |
| cancelled | Further delivery/results stopped for this job |
Terminal status describes the job, not the security posture of its endpoints. A complete job can contain evidence that does not fully answer the investigation. Check the individual answers and errors.
How evidence arrives
Enrolled agents use their existing outbound HTTPS question worker. They collect local evidence and answer using their configured model. This API does not require inbound endpoint ports. GET /queries/{id} materializes results and finalizes state; stored finding search covers results already retrieved this way.
Answers retain endpoint attribution. Raw evidence rows are omitted from API jobs, but answer text can still contain sensitive data. There is no raw-evidence download route in this release.
Cancel a query
curl --fail-with-body -X POST \
"https://api.recursift.app/v1/queries/$RECURSIFT_QUERY_ID/cancel" \
-H "Authorization: Bearer $RECURSIFT_API_KEY"Cancellation needs query:write. It blocks pending delivery and rejects late answers. It cannot interrupt inference already running in an older installed agent. Cancelling an already terminal job returns its unchanged receipt.
Audit records
An audit:read key can page through /audit/events. Each event includes seq, the exact event_json string, prev_hash and hash. Preserve event_json byte-for-byte when verifying the chain; reformatting it changes the hash.
The operator’s recursift-admin verify-audit command can verify exported JSONL. Chain verification needs an independently trusted chain head to detect complete rewriting. External signed anchoring is not implemented.