v2.0.3

Observed Asset Ingestion

Submit immutable prompt and model runtime evidence to Kavach while retaining ownership of your runtime.

Overview

Kavach does not need to become your prompt editor or model-serving runtime to govern asset identity. A producer can report the exact prompt or model configuration it used, and Kavach records a versioned,Observed asset with source metadata and ontology lineage.

The generic OSS ingestion boundary is intentionally provider-neutral:POST /api/v1/prompts/observations and POST /api/v1/models/observations. Integrations submit runtime facts, not deployment instructions.

Prerequisites

Start the local stack and obtain an API token through Studio or your configured identity provider. The default Docker stack runs the control plane at http://localhost:8000.

bash

export KAVACH_API_URL=http://localhost:8000
export KAVACH_TOKEN=replace-with-a-bearer-token

Stable identity matters

Use a stable source_system such as support-api and an immutable source_reference such as an evaluation-run or execution identifier. Repeating the same evidence is idempotent; conflicting evidence for the same logical version returns 409.

Observe a Prompt

When prompt content can be shared, submit it with the observed identity. Kavach calculates and retains a SHA-256 content hash.

bash

curl -X POST "$KAVACH_API_URL/api/v1/prompts/observations" \
  -H "Authorization: Bearer $KAVACH_TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "support-assistant",
    "version": "v7",
    "source_system": "support-api",
    "source_reference": "evaluation-run-123",
    "template": "Answer using only the supplied context.\nQuestion: {{question}}",
    "variables": ["question", "context"]
  }'

If content cannot leave the runtime, omit template and send a SHA-256 content_hash instead. Studio will show that content is unavailable while retaining the asset’s identity, provenance, references, and lineage.

json

{
  "name": "support-assistant",
  "version": "v7",
  "source_system": "support-api",
  "source_reference": "evaluation-run-123",
  "content_hash": "sha256:replace-with-the-runtime-hash",
  "variables": ["question", "context"]
}

Observe a Model

Report provider-native identity and the runtime values actually used. Provider-specific fields belong in parameters; Kavach records them without interpreting or changing runtime behavior.

bash

curl -X POST "$KAVACH_API_URL/api/v1/models/observations" \
  -H "Authorization: Bearer $KAVACH_TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{
    "provider": "OpenAI",
    "model_name": "gpt-5",
    "version": "2026-06",
    "source_system": "support-api",
    "source_reference": "evaluation-run-123",
    "context_window": 128000,
    "parameters": {"temperature": 0.2, "max_tokens": 800, "top_p": 1.0}
  }'

Python Producer

python

import hashlib
import os

import httpx

template = "Answer using only the supplied context.\nQuestion: {{question}}"
payload = {
    "name": "support-assistant",
    "version": "v7",
    "source_system": "support-api",
    "source_reference": "evaluation-run-123",
    "content_hash": f"sha256:{hashlib.sha256(template.encode()).hexdigest()}",
    "variables": ["question", "context"],
}

response = httpx.post(
    f"{os.environ['KAVACH_API_URL']}/api/v1/prompts/observations",
    headers={"Authorization": f"Bearer {os.environ['KAVACH_TOKEN']}"},
    json=payload,
    timeout=10,
)
response.raise_for_status()

Node.js Producer

import { createHash } from "node:crypto";

const template = "Answer using only the supplied context.\nQuestion: {{question}}";
const contentHash = `sha256:${createHash("sha256").update(template).digest("hex")}`;

const response = await fetch(
  `${process.env.KAVACH_API_URL}/api/v1/prompts/observations`,
  {
    method: "POST",
    headers: {
      Authorization: `Bearer ${process.env.KAVACH_TOKEN}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({
      name: "support-assistant",
      version: "v7",
      source_system: "support-api",
      source_reference: "evaluation-run-123",
      content_hash: contentHash,
      variables: ["question", "context"],
    }),
  },
);

if (!response.ok) throw new Error(await response.text());

Verification

Open Assets → Prompt Catalog or Assets → Model Catalog. The record is labeled Observed and exposes its source metadata. Use Open ontology to inspect the bounded lineage around that exact version.

See Asset Catalogs for the ownership model and dataset artifact behavior, or the REST API reference for the broader control-plane surface.