Record an auditor's signed defensibility verdict on one `(block, source)` citation of the finding at `{id}`. CONFORM to `handlers::edges::assert` (the sibling authored-write handler): thin — build the command, dispatch it, map the error. No persistence he

POST

/api/resources/{id}/citation-audits

id is a routing address only. The real authorization subject is the block's owning finding,
resolved server-side from req.block_id
(temper-services/src/authz/audit_gate.rs:65-77). citation_audit_service::record_citation_audit
derives that finding and refuses with 404 if it disagrees with id, so a caller cannot address
one finding in the path while writing an audit onto a block of another.

CitationAuditRequest carries no act/authorship fields (unlike AssertRelationshipRequest's
flattened ActInput) — that shape was fixed in Task 7/3 and is not this task's to change — so
the command's act is always the empty default here.

Request

Authorization

JWT Bearer

Add the parameter

Authorization

to Headers

Example:

Authorization: ********************

Path Params

Header Params

Body Params application/jsonRequired

Examples

Responses

🟢200OK

text/plain

Citation audit recorded; returns the new kb_citation_audits.id

🟠400Bad Request

🟠401Unauthorized

🟠404Record Not Found

Request Example

Shell

JavaScript

Java

Swift

curl --location '/api/resources//citation-audits' \
--header 'X-Temper-Surface;' \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '{
    "block_id": "bd8cc6cb-1750-49ca-a3b6-034ebc9ab225",
    "reason": "string",
    "source": {
        "kind": "event",
        "value": "a860a344-d7b2-406e-828e-8d442f23f344"
    },
    "value": 0
}'

Response Example

400 - Example 1

{
    "error": {
        "code": "string",
        "details": null,
        "message": "string"
    }
}

Modified at 2026-08-19 12:26:18

List the finding at `{id}`'s citation-audit trail — one row per audit, each naming its auditor.

get_content