DoAIRight API
Evals ingest, experiment-assignment, CI test-set gating, OpenTelemetry capture, and governed evidence ingest for the DoAIRight Evaluate & Assure platform. All endpoints authenticate with a per-system `dar_…` API key as an HTTP Bearer token. Filing evidence is not a compliance verdict — DoAIRight does not certify.
Authentication
Every endpoint requires an HTTP Bearer token: a per-system API key in the form dar_<token>, sent as Authorization: Bearer dar_…. Missing or invalid keys return 401 — auth is never optional.
Base URL
https://doairight.com
Machine-readable spec
GET /api/evals/openapi.json — this same document (OpenAPI 3.0.3), as JSON.
File governed evidence artifacts
Push one or more evidence artifacts mapped to ISO/IEC 42001 requirement keys (`clause:…` or `control:…`). Same `dar_` API-key auth as the Evals API: tenant and AI system come from the key; `aiSystemId` in the body must match the key's system (403 on mismatch). Does not consume eval usage quota. Dedupes by sha256 checksum per tenant+system+requirementKey. Filing an artifact is not a certification or conformity verdict.
curl -X POST https://doairight.com/api/ingest/evidence \
-H "Authorization: Bearer dar_xxxxxxxxxxxxxxxx" \
-H "Content-Type: application/json" \
-d '{
"aiSystemId": "8b6e6f2a-1e0a-4f52-9a7a-2b8b2b9b0a11",
"source": "access-review-export",
"items": [
{
"requirementKey": "control:A.2.2",
"content": "Q3 access-review attestation: all production AI operators reviewed.",
"encoding": "utf8",
"fileName": "q3-access-review.txt",
"summary": "Quarterly access review for AI operators"
}
]
}'Ingest one observed run
curl -X POST https://doairight.com/api/evals/observe \
-H "Authorization: Bearer dar_xxxxxxxxxxxxxxxx" \
-H "Content-Type: application/json" \
-d '{
"prompt": "Summarize this contract in three bullet points.",
"response": "- Term: 12 months\n- Auto-renews unless cancelled 30 days prior\n- Governing law: Delaware",
"kind": "generative"
}'Submit a BYOR (bring-your-own-response) experiment run
curl -X POST https://doairight.com/api/evals/submit \
-H "Authorization: Bearer dar_xxxxxxxxxxxxxxxx" \
-H "Content-Type: application/json" \
-d '{
"prompt": "Summarize this contract in three bullet points.",
"response": "- Term: 12 months\n- Auto-renews unless cancelled 30 days prior\n- Governing law: Delaware",
"experimentKey": "summary-prompt-v2",
"variantKey": "treatment"
}'Get a sticky experiment variant assignment
curl -X POST https://doairight.com/api/evals/variant \
-H "Authorization: Bearer dar_xxxxxxxxxxxxxxxx" \
-H "Content-Type: application/json" \
-d '{
"experimentKey": "summary-prompt-v2",
"userKey": "user_8f21"
}'Run a CI/test-set gate against a prompt version + dataset with client-submitted responses
curl -X POST https://doairight.com/api/evals/ci \
-H "Authorization: Bearer dar_xxxxxxxxxxxxxxxx" \
-H "Content-Type: application/json" \
-d '{
"promptVersionKey": "contract-summary@3",
"datasetId": "8b6e6f2a-1e0a-4f52-9a7a-2b8b2b9b0a11",
"items": [
{
"itemId": "5c1b6b0e-2222-4f0a-9d3d-2b9b0a118b6e",
"response": "- Term: 12 months\n- Auto-renews unless cancelled 30 days prior"
}
]
}'OpenTelemetry (GenAI semantic conventions) trace export ingest
Accepts an OTLP/JSON export; each span that normalizes to a GenAI turn is ingested through the same pipeline as /observe.
curl -X POST https://doairight.com/api/evals/otlp \ -H "Authorization: Bearer dar_xxxxxxxxxxxxxxxx"