{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://raw.githubusercontent.com/api-evangelist/blumira/main/json-schema/blumira-response-finding-evidence-schema.json",
  "title": "response_finding_evidence",
  "x-generated": "2026-09-29",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/blumira-openapi.yml#/components/schemas/response_finding_evidence",
  "properties": {
    "data": {
      "description": "Paginated evidence rows; each object has keys from evidence_keys.",
      "items": {
        "$ref": "#/$defs/evidence_row_dynamic"
      },
      "type": "array"
    },
    "evidence_keys": {
      "description": "Field names that appear in each evidence row (data items). Use these to interpret the keys of each object in data. Sorted alphabetically; __time_matched is the reserved field for the evidence created timestamp.\n",
      "items": {
        "type": "string"
      },
      "type": "array"
    },
    "links": {
      "$ref": "#/$defs/api_links"
    },
    "meta": {
      "$ref": "#/$defs/api_meta"
    },
    "status": {
      "description": "Status of request",
      "type": "string"
    }
  },
  "required": [
    "data",
    "status",
    "links",
    "meta"
  ],
  "type": "object",
  "$defs": {
    "api_links": {
      "properties": {
        "next": {
          "description": "Link to next set of records (null when no next page). Path matches the request path with page query params.",
          "type": [
            "string",
            "null"
          ]
        },
        "prev": {
          "description": "Link to previous set of records (null when no previous page). Path matches the request path with page query params.",
          "type": [
            "string",
            "null"
          ]
        },
        "self": {
          "description": "Link to current set of records. Path matches the request path with page query params.",
          "type": "string"
        }
      },
      "type": "object"
    },
    "api_meta": {
      "description": "Meta information",
      "properties": {
        "page": {
          "description": "Current page of records",
          "type": "integer"
        },
        "page_size": {
          "description": "How many records come across on a page",
          "type": "integer"
        },
        "total_items": {
          "description": "How many total records there are",
          "type": "integer"
        },
        "total_pages": {
          "description": "How many total pages of records there are",
          "type": "integer"
        }
      },
      "type": "object"
    },
    "evidence_row_dynamic": {
      "additionalProperties": true,
      "description": "One row of evidence. Keys are dynamic and match the field names in the top-level evidence_keys array (e.g. __time_matched, id, and rule-specific fields like src_ip, user). Values may be string, number, boolean, array, or object depending on the field.\n",
      "type": "object"
    }
  }
}