> ## Documentation Index
> Fetch the complete documentation index at: https://docs.truenroll.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Forensics results

> Retrieve fraud and tamper-detection results for a case.

```
GET /partner/v1/cases/{id}/forensics
```

Returns a forensics entry per analyzed file. Once a run is `completed`, each entry includes the
structured verdict, document context, a plain-language `summary`, `topEvidence`, and the per-check
outcomes in `checks[]` — so you can ingest results programmatically without parsing the PDF. A
`reportUrl` still links to the full PDF report. Returns `409` if no upload was created with the
`forensics` feature. See
[Forensics & verification](/concepts/forensics-and-verification) for what's checked.

Multi-file and multi-credential cases return one entry per credential (keyed by `credentialId` +
`fileId`). Rich fields appear only for `completed` entries; while a run is still `queued`,
`processing`, or `failed` the entry keeps the lean shape (`uploadId`, `credentialId`, `fileId`,
`status`, `reportUrl`).

### Path parameters

<ParamField path="id" type="string" required>
  TruEnroll case ID.
</ParamField>

## Response fields

<ResponseField name="data" type="object">
  <Expandable title="data">
    <ResponseField name="id" type="string">TruEnroll case ID.</ResponseField>
    <ResponseField name="externalId" type="string">Your reference for this case.</ResponseField>

    <ResponseField name="forensics" type="object[]">
      One entry per analyzed file across all uploads that had forensics enabled.

      <Expandable title="forensics[]">
        <ResponseField name="uploadId" type="string | null">
          ID of the upload this forensics result belongs to.
        </ResponseField>

        <ResponseField name="credentialId" type="string | null">
          ID of the credential this result relates to. `null` for raw-file forensics
          (uploads submitted with `classify: false`), where `fileId` identifies the file instead.
        </ResponseField>

        <ResponseField name="fileId" type="string">
          ID of the source file the forensics result was produced from.
        </ResponseField>

        <ResponseField name="status" type="string">
          Forensics status: `queued`, `processing`, `completed`, `failed`.
        </ResponseField>

        <ResponseField name="verdict" type="string | null">
          Overall risk verdict for the document, e.g. `LOW RISK`, `MEDIUM RISK`, `HIGH RISK`.
          Present once status is `completed`.
        </ResponseField>

        <ResponseField name="documentName" type="string | null">
          Name/title of the document as identified during analysis.
        </ResponseField>

        <ResponseField name="candidateName" type="string | null">
          Candidate name extracted from the document.
        </ResponseField>

        <ResponseField name="registrationNumber" type="string | null">
          Registration or serial number extracted from the document.
        </ResponseField>

        <ResponseField name="issuerName" type="string | null">
          Issuing institution identified for the document.
        </ResponseField>

        <ResponseField name="issuerSubName" type="string | null">
          Secondary issuer (e.g. affiliated college or partner program), when applicable.
        </ResponseField>

        <ResponseField name="issuanceYear" type="integer | null">
          Year the document was issued.
        </ResponseField>

        <ResponseField name="summary" type="string | null">
          Plain-language summary of the overall forensics assessment.
        </ResponseField>

        <ResponseField name="topEvidence" type="string[]">
          Key evidence statements supporting the verdict. Empty array when none apply.
        </ResponseField>

        <ResponseField name="checks" type="object[]">
          Per-check outcomes from the standard forensics check set. Empty array until `completed`.

          <Expandable title="checks[]">
            <ResponseField name="checkNumber" type="integer">
              1-based position of the check in the standard check set.
            </ResponseField>

            <ResponseField name="title" type="string">Short name of the check.</ResponseField>

            <ResponseField name="status" type="string">
              Outcome of the check, e.g. `PASS`, `FAIL`, or `UNVERIFIED` when it could not be
              conclusively evaluated.
            </ResponseField>

            <ResponseField name="description" type="string">
              Human-readable explanation of the check outcome.
            </ResponseField>
          </Expandable>
        </ResponseField>

        <ResponseField name="reportUrl" type="string | null">
          URL to the full forensics PDF report. Available once status is `completed`.
        </ResponseField>
      </Expandable>
    </ResponseField>
  </Expandable>
</ResponseField>

## Example

```json theme={null}
{
  "success": true,
  "message": "Forensics retrieved",
  "meta": {},
  "data": {
    "id": "6850abc123def456ghi789",
    "externalId": "applicant-9876",
    "forensics": [
      {
        "uploadId": "6850def456ghi789abc123",
        "credentialId": "6850ghi789abc123def456",
        "fileId": "file_abc",
        "status": "completed",
        "verdict": "LOW RISK",
        "documentName": "Bachelor of Science",
        "candidateName": "Syed Muhammad Ali",
        "registrationNumber": "150264",
        "issuerName": "Oxford Brookes University",
        "issuerSubName": null,
        "issuanceYear": 2019,
        "summary": "This Bachelor of Science has been identified as low risk. Oxford Brookes University is a recognized UK institution and the document terminology aligns with official templates.",
        "topEvidence": [
          "Terminology and spelling match official Oxford Brookes University templates.",
          "Oxford Brookes University is a recognized UK degree-awarding body.",
          "No structural anomalies or integrity issues detected."
        ],
        "checks": [
          { "checkNumber": 1, "title": "Name & Identity", "status": "PASS", "description": "The candidate's name is clearly stated and consistent throughout the document." },
          { "checkNumber": 5, "title": "Institution Identity", "status": "PASS", "description": "Oxford Brookes University is a legitimate, recognized UK higher education institution." },
          { "checkNumber": 11, "title": "Digital Footprint & URLs", "status": "UNVERIFIED", "description": "No verification QR code or URL was detected on the document." }
        ],
        "reportUrl": "https://..."
      }
    ]
  }
}
```