Update evidence
/workspaces/{workspace}/evidence/items/{evidenceItem}Changes only the fields you send. Sending requirement_ids replaces the whole mapping. Changing the cadence moves the next review date.
Authentication
Send an API token as a bearer token. This endpoint needs a read and write token, made by an editor, admin or owner. Create one in My account → API tokens; see scopes and roles.
Authorization: Bearer 42|bynh_pat_•••••••HeaderPath parameters
workspacestringRequiredYour workspace slug, e.g. dokan.
evidenceItemintegerRequiredEvidence item id.
Request body
application/jsontitlestringmax 160Error: “Give the evidence a name, like “MFA is required for every admin”.”
categoryenumExact English values. One of
Access management,Asset management,Business continuity,Change management,Cryptography,Data protection,Governance,Incident response,Logging and monitoring,Network security,People,Physical security,Secure development,Vendor management,Vulnerability management.review_every_daysenumHow often it’s reviewed. One of
30,90,180,365.descriptionstring, nullablemax 2000Longer description.
methodstring, nullablemax 240How it’s collected.
owner_idinteger, nullableA member of this workspace.
is_publicbooleanList it on the trust center.
public_labelstring, nullablemax 160Label shown publicly.
collectedbooleantrue marks it collected now if it never was; next_review_at is then set from the cadence.
requirement_idsstringmax 200Replaces the mapping. Each must be a requirement of a framework you follow.
Response
200 OKThe full item (without met and people).
idintegerEvidence item id.titlestringName.categorystringOne of the categories listed on create.statusenumpending: never collected. due: next review within 14 days. overdue: past next_review_at. One ofcurrent,due,overdue,pending.status_labelstringLocalized (Current, Review due, Overdue, Not collected yet).owner{id, name}|nullOwner.review_every_daysenumCadence. One of30,90,180,365.last_collected_atstring|nullISO 8601.next_review_atstring|nullYYYY-MM-DD.is_publicbooleanListed on the trust center.requirements_countintegerMapped requirements.files_countintegerAttached files.descriptionstring|nullLonger description.methodstring|nullHow it’s collected.public_labelstring|nullLabel shown publicly.reminded_atstring|nullLast reminder.created_atstringISO 8601.requirements[]objectid, code, title, framework {slug, short_name}; on GET show alsomet.files[]objectid, filename, mime, size, uploaded_by, uploaded_at, download_path.timelineobjectdays (90 strings, oldest first: current | overdue | none), current_share (percent of tracked days current, 1 decimal, or null), collections (count in the last 90 days), lapse (most recent overdue run: from, to, days, ongoing, resolved_by, note; or null).history[]objectLast 40 audit events on the item: id, kind (action without the evidence. prefix), who, text (localized), at.
Rate limits
This endpoint counts toward your general limit of 120 requests a minute and its own limit of 60 a minute. Its own limit answers 429 without Retry-After; wait and try again.
Errors
Every error is JSON with a message. See Errors.