Runtime Alignment Monitor Data Contracts

Runtime Analyze Request (POST /v1/runtime/analyze)

Required fields

Field	Type
tenant_id	string
entity_id	string
event_id	string
score_version	string
anomaly_score	number (0-1)

Runtime Analyze Response

{
  "accepted": true,
  "tenant_id": "tenant-a",
  "actor_id": "actor-a",
  "request_id": "fixture-runtime-positive-a",
  "entity_id": "agent-a-9",
  "event_id": "evt-runtime-a-1001",
  "score_version": "runtime_v0",
  "anomaly_score": 0.63,
  "recommended_action": "degrade",
  "lineage": {
    "evidence_event_id": "9c8aa2b6-269e-4129-ae31-9f17f370522a",
    "score_snapshot_id": "ea1eeb12-78cb-4e4e-bec4-64845e51e795"
  },
  "status": "skeleton"
}

Score Lookup Response (GET /v1/score/{framework}/{entity_id})

Field	Description
tenant_id	Tenant context for lookup result.
framework	Framework key used for lookup.
entity_id	Entity id used for lookup.
score_snapshot_id	Persisted score snapshot id.
evidence_event_id	Linked evidence event id.
event_id	Event id linked to the score.
score_version	Score version string.
score_payload	Stored score payload object.
created_at	Score creation timestamp.

Runtime Risk Event Shape (runtime.risk.elevated)

{
  "event": "runtime.risk.elevated",
  "event_id": "evt_3001",
  "tenant_id": "tenant-a",
  "entity_id": "agent-a-9",
  "recommended_action": "degrade",
  "anomaly_score": 0.63,
  "score_version": "runtime_v0"
}