evidentia-api
FastAPI REST server and bundled React web UI for Evidentia, the open-source GRC tool.
This package is not typically installed directly. The preferred way is via the [gui] extra on the meta-package:
uv tool install "evidentia[gui]"
# or
pip install "evidentia[gui]"
Then run:
evidentia serve
# -> FastAPI + React UI at http://127.0.0.1:8000
What's inside
- FastAPI app (
evidentia_api.app:app) — REST endpoints mirroring every CLI capability. - SPA — React/Vite/shadcn/ui frontend, bundled as static assets inside the wheel under
evidentia_api/static/. - SSE streaming — long-running LLM calls (
risk generate,explain) stream progress to the browser without blocking.
REST surface
Every endpoint is typed with Pydantic models reused from evidentia-core. All endpoints bind to 127.0.0.1 by default; --host 0.0.0.0 emits a security warning.
| Method | Path | Purpose |
|---|---|---|
| GET | /api/health |
Health probe |
| GET | /api/version |
Evidentia version info |
| GET | /api/doctor |
Diagnostic summary |
| POST | /api/doctor/check-air-gap |
Air-gap validator |
| GET | /api/config |
Read evidentia.yaml |
| PUT | /api/config |
Write evidentia.yaml |
| GET | /api/frameworks |
List all 95 bundled catalogs |
| GET | /api/frameworks/{id} |
Framework detail |
| GET | /api/frameworks/{id}/controls/{control_id} |
Single control |
| POST | /api/gap/analyze |
Run GapAnalyzer, save to gap store |
| GET | /api/gap/reports |
List saved reports |
| GET | /api/gap/reports/{key} |
Load a saved report |
| POST | /api/gap/diff |
Compute diff between two reports |
| POST | /api/risk/generate |
SSE: per-gap risk statement generation |
| POST | /api/explain/{framework}/{control_id} |
Plain-English control explanation |
| POST | /api/init/wizard |
Generate starter YAML files |
| GET | /api/llm-status |
LLM provider configuration state |
Air-gapped mode
Running evidentia serve --offline wires the air-gap guard into every /api/* call. LLM features gracefully degrade with a pointer to Ollama. See docs/air-gapped.md.
Development
# From the repo root:
uv sync --all-packages
cd packages/evidentia-ui && npm install && npm run dev # Vite dev server at :5173
# In another terminal:
evidentia serve --dev # FastAPI at :8000 proxies /api/* to itself, / to Vite :5173
License
Apache-2.0 — see LICENSE.
1 maintainer
Metadata
1 maintainer
Release files for evidentia-api 0.13.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | Actions |
|---|---|---|---|---|
| evidentia_api-0.13.0.tar.gz | 3.2 MB | With provenance | Details for evidentia_api-0.13.0.tar.gz |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Actions Reset |
|---|---|---|---|---|
| evidentia_api-0.13.0-py3-none-any.whl | Python 3 | none | any | Details for evidentia_api-0.13.0-py3-none-any.whl |
Total release size: 6.5 MB
Release files / evidentia_api-0.13.0.tar.gz
| Download URL | evidentia_api-0.13.0.tar.gz |
|---|---|
| Size | 3.2 MB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
ccbaa3e0615e36659e5142116c22b6f5d5e29b9f495fb7bd2136d6419875b221
|
|
BLAKE2b-256 checksum How to use checksums |
ef5cda096fb0dfd5c90e5fe0dc311c728611899a5cd37a1b7646ac4fca6094e9
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 19, 2026.
Transparency logRelease files / evidentia_api-0.13.0-py3-none-any.whl
| Download URL | evidentia_api-0.13.0-py3-none-any.whl |
|---|---|
| Size | 3.3 MB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
fbf71a0d1ccce393800bd36e8595943ff50c496ec410f742a98b104565990fa6
|
|
BLAKE2b-256 checksum How to use checksums |
df52fa2b2da4d7ddd8bc130a3b2db0aec5f56fd7983383046dc3913d1431297f
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 19, 2026.
Transparency logSecurity for evidentia-api 0.13.0
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
Full provenance
All 2 files in this release have been uploaded with provenance metadata.
Attestation for evidentia_api-0.13.0.tar.gz
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 19, 2026.
Transparency logA note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.
