# Agent-Readable / Reviewer-Readable API Evidence Checklist

**Author synthesis — proposed reviewer template. Not an industry standard, certification, implementation, audit template, security assurance or Treasury Desk product feature.**

## Empty template

| Group | Machine-facing element | Reviewer question | Exact source / record | Version / scope | Observed / unknown / N/A | Residual gap |
|---|---|---|---|---|---|---|
| 1. Version & operation | API/schema/SDK/tool-adapter version | Which contract was actually used? |  |  |  |  |
| 1. Version & operation | environment / tenant / account | What operational scope did the attempt belong to? |  |  |  |  |
| 1. Version & operation | operation ID / endpoint semantic name | Which operation and documented side effects applied? |  |  |  |  |
| 1. Version & operation | normalized non-sensitive arguments | Are amount, units, payee/resource and intended parameters reconstructable? |  |  |  |  |
| 1. Version & operation | actual allowed parameter set | Was the submitted object valid for the documented operation/version? |  |  |  |  |
| 2. Layered state | HTTP/transport result | Did a response arrive and what did HTTP establish? |  |  |  |  |
| 2. Layered state | tool/protocol envelope | Did the adapter/tool finish locally? |  |  |  |  |
| 2. Layered state | payment/business state | What provider-native state is recorded? |  |  |  |  |
| 2. Layered state | settlement/reconciliation evidence | What evidence supports economic/finance closure? |  |  |  |  |
| 2. Layered state | reviewer certainty | Is the conclusion KNOWN, UNKNOWN or CONFLICTING? |  |  |  |  |
| 3. Errors | provider-native machine code | What exact code was emitted? |  |  |  |  |
| 3. Errors | HTTP status | Which transport response was observed? |  |  |  |  |
| 3. Errors | adapter/downstream code | Was a downstream system code separately exposed? |  |  |  |  |
| 3. Errors | human message | What explanatory text was shown, without using it as machine policy? |  |  |  |  |
| 3. Errors | error-class mapping | Is any normalization unambiguous and source-bounded? |  |  |  |  |
| 4. Indeterminate outcome | provider object/status lookup | What authoritative object/state can be retrieved in the correct scope? |  |  |  |  |
| 4. Indeterminate outcome | webhook/event record | Is there authentic, correlated async evidence? |  |  |  |  |
| 4. Indeterminate outcome | ledger/report evidence | Is there downstream provider or finance evidence? |  |  |  |  |
| 4. Indeterminate outcome | lookup scope/completeness | What does a miss actually cover? |  |  |  |  |
| 5. Idempotency | idempotency/client token | What reference identifies repeat semantics? |  |  |  |  |
| 5. Idempotency | scope | Provider/account/operation/version scope? |  |  |  |  |
| 5. Idempotency | payload equivalence | Must repeated parameters be identical/equivalent? |  |  |  |  |
| 5. Idempotency | lifetime/pruning | How long is replay identity retained? |  |  |  |  |
| 5. Idempotency | concurrency/error retention | Are concurrent attempts or failures retained/cached? |  |  |  |  |
| 5. Idempotency | failover portability | Does another provider understand the same reference? |  |  |  |  |
| 6. Retries/failover | client/SDK retry policy | Which layer retries and under what documented preconditions? |  |  |  |  |
| 6. Retries/failover | backoff / retry hint | Is there a source-native retry signal or schedule? |  |  |  |  |
| 6. Retries/failover | retry budget/deadline | How many attempts / until what deadline? |  |  |  |  |
| 6. Retries/failover | same vs changed intent | Are amount/payee/scope unchanged? |  |  |  |  |
| 6. Retries/failover | provider failover | Is first-provider outcome resolved before a second economic attempt? |  |  |  |  |
| 6. Retries/failover | decision authority | Who is allowed to continue, stop or escalate? |  |  |  |  |
| 7. Async | callback receipt | Was the callback transport acknowledged? |  |  |  |  |
| 7. Async | authenticity | Was origin/integrity verified under the documented method? |  |  |  |  |
| 7. Async | event ID / dedupe | Can duplicate delivery be recognized? |  |  |  |  |
| 7. Async | event time / observed time | What happened when, and when was it observed? |  |  |  |  |
| 7. Async | ordering/conflict handling | Can late/out-of-order evidence coexist without silent overwrite? |  |  |  |  |
| 8. Compensation & closure | cancel/void/refund/reversal request | What recovery action was requested? |  |  |  |  |
| 8. Compensation & closure | recovery preconditions/authority | Was the action allowed in the current state and mandate? |  |  |  |  |
| 8. Compensation & closure | compensation child ID | Is recovery tracked separately from the original attempt? |  |  |  |  |
| 8. Compensation & closure | compensation outcome | Requested, accepted, pending, failed or confirmed? |  |  |  |  |
| 8. Compensation & closure | reconciliation / closure criterion | What evidence actually closes the case? |  |  |  |  |
| 8. Compensation & closure | unresolved contradictions | What still conflicts or remains unavailable? |  |  |  |  |

## Filled synthetic example — CASE-SYN-05

Synthetic opaque references only; no real credentials, payment details or executable commands.

| Group | Machine-facing element | Reviewer question | Exact source / record | Version / scope | Observed / unknown / N/A | Residual gap |
|---|---|---|---|---|---|---|
| Version & operation | API/schema version | Contract used? | `SRC-CONTRACT-A@2026.09` | provider A / test fixture | observed | none in fixture |
| Version & operation | environment | Scope? | `env=synthetic-lab`, `tenant=T-OPAQUE` | local fixture | observed | not production evidence |
| Version & operation | operation | Operation? | `payments.create` | v2026.09 | observed | author fixture, not provider schema |
| Version & operation | normalized args | Intent reconstructable? | `ARGREF-05`, amount `1250 minor units`, `CUR-X`, `PAYEE-REF-7` | logical payment `LP-05` | observed | no sensitive payload retained |
| Layered state | HTTP | What did transport establish? | `ATT-05-01` response `202` | attempt 1 | observed | acceptance not completion |
| Layered state | tool envelope | Local result? | `TOOL-05-01=returned` | adapter `TA-3` | observed | no business closure |
| Layered state | payment state | Provider-native state? | `PAY-OPAQUE-55=SETTLED_SIM` | synthetic provider | observed | synthetic only |
| Layered state | reconciliation | Closure evidence? | `REC-05=matched` | synthetic ledger | observed | synthetic only |
| Layered state | reviewer certainty | Final certainty? | `CASE-SYN-05 disposition` | reviewer model | KNOWN | residual limits remain |
| Errors | native code | Error? | none | N/A | N/A | none |
| Indeterminate outcome | status lookup | Authoritative lookup? | `LOOKUP-05` → same payment ID/state | correct tenant | observed | synthetic |
| Idempotency | reference | Repeat identity? | `IDEMP-05` | provider A / create operation | observed | no cross-provider inference |
| Idempotency | equivalence | Same payload? | `ARGREF-05` digest match | attempt 1 / retry | observed | synthetic |
| Retries | retry history | Controlled? | one transport retry, same provider/ref | `RH-05` | observed | no general recommendation |
| Async | callback | Evidence? | event `EV-05-1`, signature flag `verified_fixture=true` | synthetic | observed | no crypto verification performed |
| Async | duplicate/order | Correct handling? | duplicate event ID ignored; event-time preserved | fixture | observed | synthetic |
| Compensation | recovery action | Required? | none | N/A | N/A | none |
| Closure | criterion | Why closed? | provider state + correlated event + reconciliation record | fixture criterion v1 | observed | does not prove production reliability |

### Filled-example disposition

`CASE-SYN-05 = CLOSED_FOR_FIXTURE_REVIEW` because the selected synthetic closure criterion is met. This says nothing about real provider reliability, legal finality, security assurance or production readiness.