Get Execution Trust Record
Returns the complete Execution Trust Record for businessTransactionId (looked up by Business Transaction ID, despite the path segment name; there is no separate trustRecordId lookup).
Authorizations
Caller API key issued by scripts/generate-api-key.ts. Sent as Authorization: Bearer . Verified against a stored SHA-256 hash in constant time by packages/api/src/auth/StaticKeyAuthenticator.ts. Required on every route not listed as exempt in this document's top-level description. See /api-reference/authentication.
Path Parameters
Business Transaction identifier (not the Trust Record's own trustRecordId).
Response
Execution Trust Record found.
Canonical immutable record representing everything Parmana knows about a Business Transaction: the authoritative source for replay, verification, audit, and receipt generation. One Execution Trust Record exists per Business Transaction. overrides, executions, verifications, and receipts are append-only: existing entries are never modified or removed.
Unique Execution Trust Record identifier.
Business Transaction identifier.
Canonical immutable business context accepted by Parmana for execution: Authority -> Authorization -> Intent -> Business Transaction -> Policy. Every Business Transaction produces exactly one Decision, one Execution, and one Execution Trust Record.
Override history. Append-only; empty on every transaction in this repository today (no route creates an Override).
Execution history. Append-only.
Verification history. Append-only.
Receipt history. Append-only.
Canonical hash of the Execution Trust Record, computed over its canonical serialized form.
Cryptographic signature over the canonical Execution Trust Record, proving it was produced by Parmana and has not been modified since signing.
UTC timestamp when the Execution Trust Record was first created.
UTC timestamp when the Execution Trust Record was last extended with a new immutable artifact.
Explicit binding linking policy-governance provenance (transaction.policy.contentHash/governanceAnchor) to what a connector actually did (executions[].evidence.attributes.connector). Not a new cryptographic guarantee on its own -- both were already covered by trustRecordHash/signature -- but a single, explicitly-named pointer an auditor can check without reconstructing the binding themselves. Absent on a Trust Record built before this field existed.