Evidence

Rule zero: a claim is verified only when there is evidence with a timestamp. Every source result therefore lists evidence ids (evd_…), stable for the life of the record, and every id resolves to the captured bytes plus a hash you can re-check.

Evidence ids

Ids appear in three places: on each results[].evidence[] entry of a verification, in the per-verification index GET /v1/verifications/{id}/evidence, and on a hosted consent (evidenceId, the signed disclosure). The report PDF prints the same ids in its evidence index so a reviewer can go from a line in the report to the raw capture.

Signed URLs

GET /v1/evidence/{id} returns the metadata and a signed url. The link needs no API key, so it can be handed to a reviewer or embedded in your own UI; it expires at expiresAt, about fifteen minutes after the call. Call again for a fresh one. The same bytes are reachable with your key at GET /v1/evidence/{id}/content.

GET /v1/evidence/evd_a1…
{
  "id": "evd_a1…", "object": "evidence", "verificationId": "ver_7c1e…",
  "sourceCode": "PA-PALS", "kind": "rendered_record",
  "sourceUrl": "https://www.pals.pa.gov/#!/page/search",
  "contentType": "application/pdf", "sha256": "9f2c…", "bytes": 48213,
  "capturedAt": "2026-11-03T14:05:09Z",
  "url": "https://api.primarycheck.com/v1/evidence/evd_a1…/content?exp=1793…&sig=…",
  "expiresAt": "2026-11-03T14:20:09Z"
}

Hashes

sha256 is computed over the stored bytes at capture time and never changes. Store it with your own record of the decision; re-downloading later and hashing again proves the file is what was reviewed. The PDF report prints every hash. In the SDKs, pc.evidence.download(id) fetches the metadata and the bytes in one call.

Retention

Evidence is retained for seven years from capture under the FCRA schedule, through disputes and re-investigations, and is served from immutable storage. Deleting a verification does not delete its evidence inside that window; after it, evidence is purged with the report.

Kinds

Kind	What it is
`api_response`	The source's raw JSON payload, inline when small, otherwise a stored object. sha256 on the result.
`page_capture`	PDF and PNG of the source page when the lookup ran in a browser.
`dataset_row`	The matching row (or the empty search) from a dataset, with dataAsOf.
`document`	A board order or disciplinary PDF linked from the record.
`rendered_record`	Our template: source, URL, timestamp, every field, every check, verdict. The file auditors want.
`outreach_log`	Channels, contact sources, times and outcomes of employer or registrar outreach.
`call_transcript`	Transcript of a voice verification call.
`partner_response`	The partner's raw response (NSC, payroll connect, Nursys).

When result reuse answers a claim, the reused result points at the original captures; the ids and hashes are the same ones the first verification recorded.