HowAISafe separates submitted evidence, reviewer acceptance and legal or certification conclusions. This reference documents the behavior that exists now.
Owner/Admin: manage members, settings, tokens and evidence deletion. Contributor: registers systems and submits evidence. Reviewer: accepts submitted evidence. Viewer: read-only access.
When strict review is enabled, the submitting user cannot accept the same control.
PDF, PNG, JPEG, TXT, CSV and JSON files up to 8 MB are accepted. The service validates basic file signatures, stores a SHA-256 digest, versions matching filenames and serves files as downloads.
Automated malware scanning and external object storage are not connected. Do not upload secrets or raw production datasets.
Missing has no accepted evidence. In progress is assigned work. Ready for review records the submitter. Accepted records the reviewer and time. Not applicable records an operator decision.
Optimistic revisions reject stale browser updates instead of silently overwriting newer work.
CSV export provides a flat systems-and-controls register. JSON export includes nested evidence metadata and audit events. Files themselves are downloaded individually after access checks.
Read tokens expose GET /api/safe/v1/systems with the systems:read scope. Secrets are shown once and stored only as SHA-256 hashes.
curl -sS https://safe.howaicite.com/api/safe/v1/systems \ -H "Authorization: Bearer $HOWAISAFE_API_TOKEN"
Keep tokens in a secret manager. Never place them in client-side code, source control or support messages.