> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tallychannel.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Get Latest Snapshot

> Returns the most recent snapshot for the subject. Requires `tenant_reader`
or an active grant with `read_latest` scope.




## OpenAPI

````yaml GET /v1/tenants/{tenant_id}/subjects/{subject_type}/{subject_id}/snapshots/latest
openapi: 3.1.0
info:
  title: Tally Platform API
  version: '1.0'
  description: >
    The Tally Platform API is a versioned REST API for managing business
    identity

    state, counterparty access grants, and refresh workflows.


    All tenant-scoped endpoints require an `Authorization: Bearer <token>`
    header

    containing a valid Firebase Auth JWT. Tokens are issued by Google Identity

    Platform (GCIP) after sign-in at your environment's app domain.


    **Base URLs**

    | Environment | URL |

    |-------------|-----|

    | Staging | `https://tally-platform-api-xwka6vu2kq-ue.a.run.app` |

    | Production | `https://tally-platform-api-iikaevm4pq-ue.a.run.app` |
  contact:
    email: support@tallychannel.com
servers:
  - url: https://tally-platform-api-xwka6vu2kq-ue.a.run.app
    description: Staging
  - url: https://tally-platform-api-iikaevm4pq-ue.a.run.app
    description: Production
security:
  - BearerAuth: []
tags:
  - name: System
    description: Health checks and service metadata. No authentication required.
  - name: Tenants
    description: Tenant creation and member management.
  - name: Grants
    description: >-
      Access grant lifecycle — create, list, revoke. Controls which counterparty
      tenants can read which subjects.
  - name: Identity State
    description: >-
      Initial snapshot creation. Writes the first versioned state record for a
      subject.
  - name: Snapshots
    description: >-
      Read identity state — latest, history, by ID, export, chain proof, and
      diff.
  - name: Updates
    description: Propose and apply RFC 6902 patch updates to create new snapshot versions.
  - name: Transfer Offers
    description: Consensual `tenant_owner` role transfer handshake between principals.
  - name: Refresh Requests
    description: >-
      Counterparty-initiated requests for attribute updates or snapshot
      confirmation.
  - name: Webhooks
    description: Webhook subscription management and secret rotation.
paths:
  /v1/tenants/{tenant_id}/subjects/{subject_type}/{subject_id}/snapshots/latest:
    get:
      tags:
        - Snapshots
      summary: Get latest snapshot
      description: >
        Returns the most recent snapshot for the subject. Requires
        `tenant_reader`

        or an active grant with `read_latest` scope.
      operationId: getLatestSnapshot
      parameters:
        - $ref: '#/components/parameters/tenant_id'
        - $ref: '#/components/parameters/subject_type'
        - $ref: '#/components/parameters/subject_id'
        - name: view
          in: query
          schema:
            type: string
            enum:
              - full
              - header
            default: full
          description: >-
            `full` returns the complete envelope. `header` returns metadata
            only.
        - name: verify
          in: query
          schema:
            type: string
            enum:
              - none
              - hash
              - chain
            default: none
          description: >
            Optional integrity verification to perform.

            `hash` verifies the stored envelope_hash against a freshly computed
            RFC 8785 hash.

            `chain` additionally validates the full prev_hash chain back to the
            root.
      responses:
        '200':
          description: Latest snapshot.
          content:
            application/json:
              schema:
                type: object
                properties:
                  snapshot:
                    $ref: '#/components/schemas/SnapshotFull'
                  verification:
                    $ref: '#/components/schemas/HashVerification'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
components:
  parameters:
    tenant_id:
      name: tenant_id
      in: path
      required: true
      schema:
        type: string
      description: Tenant identifier.
      example: tally-staging
    subject_type:
      name: subject_type
      in: path
      required: true
      schema:
        type: string
        enum:
          - individual
          - organization
      description: Subject type discriminator.
    subject_id:
      name: subject_id
      in: path
      required: true
      schema:
        type: string
      description: Stable subject identifier within its type namespace.
      example: subj-f71e30bc
  schemas:
    SnapshotFull:
      allOf:
        - $ref: '#/components/schemas/SnapshotHeader'
        - type: object
          properties:
            envelope:
              $ref: '#/components/schemas/EntityStateEnvelopeV1'
    HashVerification:
      type: object
      properties:
        valid:
          type: boolean
        ok:
          type: boolean
        computed_hash:
          type: string
          nullable: true
        stored_hash:
          type: string
          nullable: true
        matches:
          type: object
          properties:
            rfc8785:
              type: boolean
            legacy:
              type: boolean
    SnapshotHeader:
      type: object
      description: Lightweight snapshot metadata without the full envelope.
      properties:
        snapshot_id:
          type: string
          format: uuid
        snapshot_version:
          type: integer
        generated_at:
          type: string
          format: date-time
        envelope_hash:
          type: string
          nullable: true
          description: >-
            SHA-256 (RFC 8785 JCS) of the full envelope. Null if not yet
            computed.
        prev_hash:
          type: string
          nullable: true
          description: Hash of the preceding snapshot envelope, for chain linkage.
        subject:
          type: object
          properties:
            subject_type:
              type: string
            subject_id:
              type: string
      required:
        - snapshot_id
        - snapshot_version
        - generated_at
    EntityStateEnvelopeV1:
      type: object
      description: >
        Immutable versioned identity state envelope. Stored as a snapshot.

        `attributes` is an open map — the canonical v1 field lists for
        organization

        and individual subjects are defined in the schema package and documented
        in

        the identity model.
      properties:
        envelope_version:
          type: string
          enum:
            - entity_state_envelope_v1
        snapshot_id:
          type: string
          format: uuid
          description: Deterministic UUIDv5 derived from subject and patch content.
        snapshot_version:
          type: integer
          minimum: 1
          description: Monotonically increasing version number per subject.
        generated_at:
          type: string
          format: date-time
        subject:
          type: object
          properties:
            subject_type:
              type: string
              enum:
                - individual
                - organization
            subject_id:
              type: string
              minLength: 1
          required:
            - subject_type
            - subject_id
          additionalProperties: true
        attributes:
          type: object
          description: >
            Identity attributes. Open map — any key/value is accepted.

            Canonical organization attributes are grouped under `legal`,
            `contact`,

            `jurisdiction`, and `identifiers`; `legal.legal_name` is required.

            Canonical individual attributes are grouped under `biographic`,
            `contact`,

            `jurisdiction`, and `identifiers`; `biographic.name` is required
            with at

            least one of `given_name`, `family_name`, or `formatted_name`.
          additionalProperties: true
        evidence:
          type: array
          items:
            $ref: '#/components/schemas/EvidenceMetadata'
        audit:
          type: object
          properties:
            created_by:
              type: string
            created_at:
              type: string
              format: date-time
            source:
              type: string
            request_id:
              type: string
            correlation_id:
              type: string
          required:
            - created_by
            - created_at
            - source
          additionalProperties: true
        attribute_paths:
          type: object
          description: >
            Maps JSON Pointer paths to arrays of evidence references. Encodes
            which evidence supports each attribute value.
          additionalProperties:
            type: array
            items:
              $ref: '#/components/schemas/EvidenceRef'
        diff:
          $ref: '#/components/schemas/EntityStateDiff'
      required:
        - envelope_version
        - snapshot_id
        - snapshot_version
        - generated_at
        - subject
        - attributes
        - evidence
        - audit
      additionalProperties: true
    ErrorEnvelope:
      type: object
      properties:
        error:
          type: object
          properties:
            code:
              type: string
              description: Machine-readable error code.
              example: validation_error
            message:
              type: string
              description: Human-readable error message.
              example: Request body failed schema validation.
            details:
              type: array
              items:
                $ref: '#/components/schemas/ErrorDetail'
            request_id:
              type: string
              description: Request ID for tracing. Injected server-side.
              example: req_01j2k3m4n5
          required:
            - code
            - message
      required:
        - error
    EvidenceMetadata:
      type: object
      properties:
        evidence_id:
          type: string
        evidence_type:
          type: string
        source:
          type: string
        captured_at:
          type: string
          format: date-time
        retrieved_at:
          type: string
          format: date-time
        hash:
          $ref: '#/components/schemas/EvidenceHash'
        locator:
          type: string
        notes:
          type: string
      required:
        - evidence_id
        - evidence_type
        - source
        - captured_at
      additionalProperties: true
    EvidenceRef:
      type: object
      properties:
        evidence_id:
          type: string
        evidence_type:
          type: string
        role:
          type: string
          enum:
            - primary
            - corroborating
            - conflicting
      required:
        - evidence_id
        - evidence_type
      additionalProperties: true
    EntityStateDiff:
      type: object
      properties:
        format:
          type: string
          enum:
            - rfc6902
        ops:
          type: array
          items: {}
      required:
        - format
        - ops
    ErrorDetail:
      type: object
      properties:
        path:
          type: string
          description: JSON Pointer to the field that caused the error.
          example: /subject_id
        message:
          type: string
          example: subject_id is required.
        code:
          type: string
          example: invalid_type
      required:
        - path
        - message
    EvidenceHash:
      type: object
      properties:
        alg:
          type: string
          example: sha256
        value:
          type: string
          example: adf11c84...
      required:
        - alg
        - value
      additionalProperties: true
  responses:
    Unauthorized:
      description: Missing or invalid Bearer token.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorEnvelope'
          example:
            error:
              code: unauthorized
              message: Authentication required.
    Forbidden:
      description: Authenticated but insufficient role or missing grant.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorEnvelope'
          example:
            error:
              code: forbidden
              message: Owner or grant required.
    NotFound:
      description: Resource not found.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorEnvelope'
  securitySchemes:
    BearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: |
        Firebase Auth JWT issued by Google Identity Platform.
        Obtain a token by signing in at your app domain and calling
        `firebase.auth().currentUser.getIdToken()`.

````