> ## Documentation Index
> Fetch the complete documentation index at: https://developer.kyberis.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Evidence Responses

> Interpret claim-based evidence retrieval responses.

Evidence responses support or weaken specific claims. Use focused evidence calls so each result maps to a clear question.

## Response Envelope

`/v2/evidence` returns:

| Field         | Meaning                                                            |
| ------------- | ------------------------------------------------------------------ |
| `status`      | Retrieval status for the request.                                  |
| `input_mode`  | Whether the request used `subject` or `query` mode.                |
| `resolution`  | Entity resolution context when applicable.                         |
| `subject`     | Resolved or submitted subject context when available.              |
| `claim_type`  | Evidence claim being tested.                                       |
| `context`     | Request context used to constrain retrieval.                       |
| `max_results` | Requested result limit.                                            |
| `items`       | Evidence items returned for the claim.                             |
| `next_cursor` | Pagination cursor when additional results are available.           |
| `metadata`    | Retrieval metadata, degradation details, and implementation notes. |

Batch evidence responses use the standard batch envelope described in [Batch responses](/responses/batches).

## Claim Types

Use only these claim types:

* `active_exploitation`
* `sector_targeting`
* `actor_association`
* `campaign_association`
* `malware_association`
* `relevance_to_environment`
* `observed_in_the_wild`

## Key Fields

Look for evidence IDs, evidence type, source, published time, matched subject, confidence, and any pagination cursor fields. For IOC `sector_targeting` evidence, attributes may include targeted industries, targeted countries, record count, max confidence, and feed sources.

## IOC Sector Targeting

`sector_targeting` can be used with IOC subjects (`ip`, `domain`, `url`, `hash`, or `email`) when target-industry context is available. Supplying `context.sector` filters evidence to that sector. Omitting `context.sector` lets agents discover the targeted sectors returned by Kyberis.

## Hydration

Use `GET /v2/evidence/{evidence_id}` when a high-impact conclusion depends on details from a specific evidence item.

Identifier-style IDs such as `ip--...` or `actor--...` can return synthetic hydration with no report payload. Prefer hydrating report-backed evidence IDs such as `report--...` when available.

## Agent Guidance

Evidence can be sparse. If evidence is weak, say so and recommend validation instead of presenting a decisive conclusion.