Assurance analytics

GET /v1/analytics gives tenant operators a single evidence-free view of journey performance and assurance operations. It requires a human administrator, compliance, analyst or viewer session. API keys are deliberately excluded because analytics can reveal commercially sensitive patterns even without identity fields.

GET /v1/analytics?from=2026-06-01T00%3A00%3A00.000Z&to=2026-07-01T00%3A00%3A00.000Z&cohort=country
Authorization: Bearer TENANT_OPERATOR_SESSION

const analytics = await proofline.analytics.get({
  from: "2026-06-01T00:00:00.000Z",
  to: "2026-07-01T00:00:00.000Z",
  cohort: "workflow",
});

if (!analytics.privacy.smallCohortsSuppressed) {
  throw new Error("Analytics privacy contract is not active");
}

Response domains

• summary: started, opened, decisioned, approved, review and expiry totals plus list-price cost estimates;
• funnel: workflow-aware eligible/reached/abandoned counts and conversion percentage;
• timeSeries: daily journey outcome counts;
• quality: outcomes, average score and pass rate by assurance signal category;
• review: open/overdue/critical cases and resolved-finding false-positive rate;
• cohorts: country, channel, workflow or application-type comparison;
• usage: the same hashed usage statement used by the billing ledger; and
• privacy: machine-readable proof of response minimisation and suppression policy.

Privacy behaviour

The endpoint never returns display names, external references, declared identity fields, contact information, evidence JSON, media, screening names or device identifiers. Cohort cells below the fixed minimum of five are returned only as key: "suppressed", their count and the threshold. This avoids silently dropping activity while preventing a small slice from becoming an identity lookup.

Overall tenant totals are not cohort attributes and remain visible to authorised tenant operators. Control Tower does not receive this endpoint and cannot use it to cross the applicant-evidence boundary.

Interpretation

Workflow steps are counted only for applications whose pinned workflow version contains that step. reached comes from durable completed-step state; rejected or expired records at a step contribute to its abandonment count. A signal score is shown as a model/provider output—not a probability or percentage certainty.

Usage cost is an estimate under the active list or contracted pricing mode. Finalized billing reconciliation remains the financial authority.

Errors

Code	Meaning
invalid_analytics_range	Start does not precede end.
analytics_range_too_large	The requested window exceeds 366 days.
forbidden	The caller is not a supported human tenant role.