# Apeiris — the public evidence fabric for autonomous AI > Apeiris defines an open, machine-readable knowledge layer for AI assurance: 12 verification > domains / 605 controls, 300 normative sources, framework crosswalks (EU AI Act, ISO/IEC 42001, > NIST AI RMF, DORA, OWASP AISVS), the pinned MITRE ATLAS model, and a knowledge graph. Free to > use, cite, and build on. It maps to and extends the primary frameworks rather than replacing > them, and is designed to sit upstream of the tools you already run (GRC, CI/CD, gateways, > observability). It is a public knowledge layer and a planning aid — not a compliance > determination, audit result, or runtime enforcement. Base URL: https://apeiris.ai/integration/ · No key, no gate. Every artifact is static JSON served read-only over HTTPS with `Access-Control-Allow-Origin: *`, content-addressed by SHA-256 and pinned in a single Ed25519-signed manifest. ## Start here - Manifest (index of everything, signed): https://apeiris.ai/integration/manifest.json - Conformance contract (identifier grammar + closed vocabularies + invariants): https://apeiris.ai/integration/conformance.json - Human API & endpoints reference: https://apeiris.ai/integration/api/ ## Core data - Control matrices (one per domain): https://apeiris.ai/integration/domains/-controls-full.json (slugs: security, model, identity, agentic, authority, privacy, compliance, resilience, finance, ethics, knowledge, data). Each control carries validation_objective, evidence_required[], machine_tests[], blocking_effect, frameworks[] (crosswalks with fit + basis), threat.tags + threat.atlas. - Source registry (300 normative sources): https://apeiris.ai/integration/source_registry.json - Evidence Proof Map (per framework obligation -> addressing controls -> evidence -> verdict + gap): https://apeiris.ai/integration/proofmap.json · human view: https://apeiris.ai/integration/proof/ - Opportunity map (where control strength is thin, computed): https://apeiris.ai/integration/opportunities.json - Incident-to-control index (which documented incidents exercised each control; bidirectional with the Evidence Briefs): https://apeiris.ai/integration/control_incidents.json - Control neighborhoods (per control: related controls, threats addressed, incidents, framework + evidence summary — the knowledge-object model): https://apeiris.ai/integration/interconnect.json # Apeiris — the public evidence fabric for autonomous AI > Apeiris defines an open, machine-readable knowledge layer for AI assurance: 12 verification > domains / 605 controls, 300 normative sources, framework crosswalks (EU AI Act, ISO/IEC 42001, > NIST AI RMF, DORA, OWASP AISVS), the pinned MITRE ATLAS model, and a knowledge graph. Free to > use, cite, and build on. It maps to and extends the primary frameworks rather than replacing > them, and is designed to sit upstream of the tools you already run (GRC, CI/CD, gateways, > observability). It is a public knowledge layer and a planning aid — not a compliance > determination, audit result, or runtime enforcement. Base URL: https://apeiris.ai/integration/ · No key, no gate. Every artifact is static JSON served read-only over HTTPS with `Access-Control-Allow-Origin: *`, content-addressed by SHA-256 and pinned in a single Ed25519-signed manifest. ## Start here - Manifest (index of everything, signed): https://apeiris.ai/integration/manifest.json - Conformance contract (identifier grammar + closed vocabularies + invariants): https://apeiris.ai/integration/conformance.json - Human API & endpoints reference: https://apeiris.ai/integration/api/ ## Core data - Control matrices (one per domain): https://apeiris.ai/integration/domains/-controls-full.json (slugs: security, model, identity, agentic, authority, privacy, compliance, resilience, finance, ethics, knowledge, data). Each control carries validation_objective, evidence_required[], machine_tests[], blocking_effect, frameworks[] (crosswalks with fit + basis), threat.tags + threat.atlas. - Source registry (300 normative sources): https://apeiris.ai/integration/source_registry.json - Evidence Proof Map (per framework obligation -> addressing controls -> evidence -> verdict + gap): https://apeiris.ai/integration/proofmap.json · human view: https://apeiris.ai/integration/proof/ - Opportunity map (where control strength is thin, computed): https://apeiris.ai/integration/opportunities.json - Incident-to-control index (which documented incidents exercised each control; bidirectional with the Evidence Briefs): https://apeiris.ai/integration/control_incidents.json - Control neighborhoods (per control: related controls, threats addressed, incidents, framework + evidence summary — the knowledge-object model): https://apeiris.ai/integration/interconnect.json - Vendor capability map (which vendor products address which controls; curated + fact-checked, with a re-verification schedule): https://apeiris.ai/integration/vendor_registry.json · schedule: https://apeiris.ai/integration/vendor_currency.json - Knowledge graph: https://apeiris.ai/integration/graph/graph.json · human explorer: https://apeiris.ai/graph/ - MITRE ATLAS (pinned model): https://apeiris.ai/integration/atlas/atlas-model.json ## Identifiers - Cross-domain control URI: apeiris:///controls/- (e.g. apeiris://model/controls/CR-08) - 72 two-letter control families, globally unique. Always use the apeiris:// URI across domains. ## Verify before you trust - Recompute each artifact's SHA-256 and compare to the manifest; treat a mismatch as fail-closed. - Verify the manifest's Ed25519 signature against the published public key: https://apeiris.ai/integration/keys/manifest-signing-ed25519.pub.json - In-browser verifier: https://apeiris.ai/integration/verify/ ## Query it from an agent (read-only MCP servers, stdio JSON-RPC) - ATLAS knowledge base + map_to_apeiris — apeiris-control-core/adapters/atlas-mcp - Knowledge graph traversal (get_node / neighbors / shortest_path / query_graph) — apeiris-control-core/adapters/graph-mcp ## Two invariants worth repeating - Mapped is not satisfied: a frameworks[] crosswalk states a relationship (its fit), not that the obligation is met. The evidence is what you produce (evidence_required[]). - basis=anchored means the cited id is validated against the framework's captured primary text in CI; basis=asserted means it is cited but not yet machine-validated. ## Attribution & license Attribution: Apeiris — apeiris.ai. See https://apeiris.ai/integration/manifest.json (usage.license) for the current license of the public knowledge layer. · schedule: https://apeiris.ai/integration/vendor_currency.json - Knowledge graph: https://apeiris.ai/integration/graph/graph.json · human explorer: https://apeiris.ai/graph/ - MITRE ATLAS (pinned model): https://apeiris.ai/integration/atlas/atlas-model.json ## Identifiers - Cross-domain control URI: apeiris:///controls/- (e.g. apeiris://model/controls/CR-08) - 72 two-letter control families, globally unique. Always use the apeiris:// URI across domains. ## Verify before you trust - Recompute each artifact's SHA-256 and compare to the manifest; treat a mismatch as fail-closed. - Verify the manifest's Ed25519 signature against the published public key: https://apeiris.ai/integration/keys/manifest-signing-ed25519.pub.json - In-browser verifier: https://apeiris.ai/integration/verify/ ## Query it from an agent (read-only MCP servers, stdio JSON-RPC) - ATLAS knowledge base + map_to_apeiris — apeiris-control-core/adapters/atlas-mcp - Knowledge graph traversal (get_node / neighbors / shortest_path / query_graph) — apeiris-control-core/adapters/graph-mcp ## Two invariants worth repeating - Mapped is not satisfied: a frameworks[] crosswalk states a relationship (its fit), not that the obligation is met. The evidence is what you produce (evidence_required[]). - basis=anchored means the cited id is validated against the framework's captured primary text in CI; basis=asserted means it is cited but not yet machine-validated. ## Attribution & license Attribution: Apeiris — apeiris.ai. See https://apeiris.ai/integration/manifest.json (usage.license) for the current license of the public knowledge layer.