working-with-attestations

Fetch the attestation with GET /notes/:uuid?format=raw and compare $.detail.* (the measured value) against $.policy.data.* (the threshold). The comparison is narrated in $.policy.evaluation.logs[], and item-based controls list offenders in $.display.violations.rows.

There are exactly six results: pass, fail, warn, in progress, not required, and not found, spelled with spaces. There is no unknown result; camelCase forms like notRequired may appear in rule output and should be normalized before comparing.

GET /notes/attestations/:uuid/meta returns only policy provenance: the asset, policy hierarchy, and computedPolicy.sections. It has no result, detail, or display fields, so use GET /notes/:uuid?format=raw for measurements and failure detail.

POST multipart/form-data to /internal/upload/:control_entity_key/attestations/manual with a payload part containing the attestation result, series point, asset uuid, and user identity, plus one part per evidence file.

Threshold controls compare a single number, so the failure detail lives in $.detail.* versus $.policy.data.* and the evaluation logs. No shipped threshold rule records violation rows, so an empty violations.rows is expected, not missing data.

Treat a missing attestation as not found (no evidence), not as a failure, and do not retry tightly. A 404 means the note was deleted or never existed; surface the missing reference and skip it.