> ## Documentation Index
> Fetch the complete documentation index at: https://developer.kyberis.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Answer attribution

> Inspect the recorded source lineage behind one API response.

Requires `read:intel`. Results are scoped to your authenticated account.

Use `GET /v2/answers/{answer_id}/attribution` to inspect the recorded `facts` and
contributing `feeds` behind an API response. `agent_key` and `agent_key_type`
identify the recorded agent. When available, `transport` identifies `rest`, `mcp`,
or `unknown`; `skill_id`, `skill_version`, and `skill_source` describe the
self-reported executing skill. Nullable metadata can be absent or null.

See [intelligence flow](https://developer.kyberis.ai/api-reference/endpoint/attribution-flow.md) for transport,
self-reported skill metadata, and API-key fallback identities.


## OpenAPI

````yaml GET /v2/answers/{answer_id}/attribution
openapi: 3.1.0
info:
  description: Deterministic, evidence-backed threat assessment API for machine consumers.
  title: Threat Investigator API v2
  version: 0.1.0
servers: []
security: []
paths:
  /v2/answers/{answer_id}/attribution:
    get:
      tags:
        - Attribution
      summary: >-
        Replay a resolved answer: name the feeds that carried the facts behind
        it
      operationId: answer_attribution_detail_v2_answers__answer_id__attribution_get
      parameters:
        - in: path
          name: answer_id
          required: true
          schema:
            title: Answer Id
            type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AnswerAttributionResponse'
          description: Successful Response
        '422':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
          description: Validation Error
      security:
        - ApiKeyAuth: []
components:
  schemas:
    AnswerAttributionResponse:
      additionalProperties: false
      properties:
        agent_key:
          title: Agent Key
          type: string
        agent_key_type:
          enum:
            - agent_id
            - connection_key
            - agent_name
            - principal_id
            - unknown
          title: Agent Key Type
          type: string
        answer_id:
          title: Answer Id
          type: string
        answered_at:
          anyOf:
            - type: string
            - type: 'null'
          title: Answered At
        assessment_types:
          items:
            type: string
          title: Assessment Types
          type: array
        endpoint:
          title: Endpoint
          type: string
        fact_count:
          minimum: 0
          title: Fact Count
          type: integer
        facts:
          items:
            $ref: '#/components/schemas/AnswerAttributionFact'
          title: Facts
          type: array
        feed_count:
          minimum: 0
          title: Feed Count
          type: integer
        feeds:
          items:
            $ref: '#/components/schemas/AnswerAttributionFeed'
          title: Feeds
          type: array
        skill_id:
          anyOf:
            - type: string
            - type: 'null'
          title: Skill Id
        skill_source:
          anyOf:
            - const: self_reported
              type: string
            - type: 'null'
          title: Skill Source
        skill_version:
          anyOf:
            - type: string
            - type: 'null'
          title: Skill Version
        status:
          const: ok
          title: Status
          type: string
        transport:
          anyOf:
            - enum:
                - rest
                - mcp
                - unknown
              type: string
            - type: 'null'
          title: Transport
      required:
        - status
        - answer_id
        - agent_key
        - agent_key_type
        - endpoint
        - assessment_types
        - fact_count
        - feed_count
        - feeds
        - facts
      title: AnswerAttributionResponse
      type: object
    HTTPValidationError:
      properties:
        detail:
          items:
            $ref: '#/components/schemas/ValidationError'
          title: Detail
          type: array
      title: HTTPValidationError
      type: object
    AnswerAttributionFact:
      additionalProperties: false
      properties:
        feeds:
          items:
            type: string
          title: Feeds
          type: array
        key:
          title: Key
          type: string
        kind:
          enum:
            - indicator
            - entity
            - vulnerability
            - vulnerability_alias
            - report
            - relationship
          title: Kind
          type: string
        label:
          anyOf:
            - type: string
            - type: 'null'
          title: Label
        sole_feed_id:
          anyOf:
            - type: string
            - type: 'null'
          title: Sole Feed Id
        sources:
          items:
            $ref: '#/components/schemas/AnswerAttributionFactSource'
          title: Sources
          type: array
        sub_sources:
          items:
            type: string
          title: Sub Sources
          type: array
      required:
        - kind
        - key
      title: AnswerAttributionFact
      type: object
    AnswerAttributionFeed:
      additionalProperties: false
      properties:
        fact_count:
          minimum: 0
          title: Fact Count
          type: integer
        fact_kinds:
          items:
            enum:
              - indicator
              - entity
              - vulnerability
              - vulnerability_alias
              - report
              - relationship
            type: string
          title: Fact Kinds
          type: array
        feed_id:
          title: Feed Id
          type: string
        is_sole_carrier:
          title: Is Sole Carrier
          type: boolean
        registered:
          title: Registered
          type: boolean
        sole_fact_count:
          minimum: 0
          title: Sole Fact Count
          type: integer
        source_instance:
          anyOf:
            - type: string
            - type: 'null'
          title: Source Instance
        source_type:
          title: Source Type
          type: string
        sub_sources:
          items:
            type: string
          title: Sub Sources
          type: array
      required:
        - feed_id
        - source_type
        - registered
        - fact_count
        - sole_fact_count
        - is_sole_carrier
      title: AnswerAttributionFeed
      type: object
    ValidationError:
      properties:
        ctx:
          title: Context
          type: object
        input:
          title: Input
        loc:
          items:
            anyOf:
              - type: string
              - type: integer
          title: Location
          type: array
        msg:
          title: Message
          type: string
        type:
          title: Error Type
          type: string
      required:
        - loc
        - msg
        - type
      title: ValidationError
      type: object
    AnswerAttributionFactSource:
      additionalProperties: false
      description: |-
        One feed's contribution to a single fact.

        Kept per fact rather than only per answer so a reader can tell a fact
        supported by one feed from a fact corroborated by several, which is what
        feed weighting and eligibility filtering both key on.
      properties:
        feed_id:
          title: Feed Id
          type: string
        registered:
          default: false
          title: Registered
          type: boolean
        source_instance:
          anyOf:
            - type: string
            - type: 'null'
          title: Source Instance
        source_type:
          title: Source Type
          type: string
        sub_sources:
          items:
            type: string
          title: Sub Sources
          type: array
      required:
        - feed_id
        - source_type
      title: AnswerAttributionFactSource
      type: object
  securitySchemes:
    ApiKeyAuth:
      description: ApiKey <key_id>:<secret>
      in: header
      name: Authorization
      type: apiKey

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.