Skip to content
VerifAIer
Home / Docs / Flight Recorder walkthrough
Operational walkthrough

Flight Recorder walkthrough

This is the operational guide. For what Flight Recorder is and why it exists, read the Flight Recorder product page.

Walkthrough

Flight Recorder

Record AI sessions into replay-safe, tamper-evident artifacts and receipts.

~4 min readDifficulty: EasyPrereq: Control Center login for retrieval

What it is

The Flight Recorder is VerifAIer's session recorder. It captures an AI session into a content-addressed, replay-safe artifact with a receipt, and preserves it in a tamper-evident archive. Internally these are recorded as sessions, the recorder session type is FLIGHT_RECORDER.

Why it exists

AI sessions are ephemeral. The Flight Recorder turns them into durable, replay-safe evidence you can retrieve, audit and preserve, long after the tab is closed.

When to use it

Use it whenever you need a forensic record of an AI session, for audit, incident review, or compliance evidence.

Where it fits / architecture position

The recorder sits between capture (Sentinel or the API) and the archive, and is surfaced through the Control Center.

Sessioncaptured
Recorderartifact + receipt
Archivetamper-evident
Control Centerreview

Typical workflow

  • A session is recorded (via Sentinel or the API).
  • It is stored as an artifact with a receipt.
  • You list and retrieve sessions, artifacts and receipts through the authenticated operational API.

Step-by-step usage

Recorded sessions and artifacts are retrieved through the Control Center operational API. These endpoints require an authenticated Control Center session:

# list recorded sessions
GET /api/control/sessions

# list artifacts and receipts
GET /api/vai/artifacts
GET /api/vai/artifacts/{artifact_id}
GET /api/vai/receipts
Screenshot
Control Center session list with recorded AI sessions and their receipts (real capture added in the product-proof pass)

Inputs and outputs

Inputs: a recorded session. Valid session types are GENERIC, FLIGHT_RECORDER, PIPELINE, AUDIT and MANUAL; statuses are ACTIVE, COMPLETE, ARCHIVED and ERROR. Outputs: artifacts and receipts, listed via the endpoints above.

Real example

The operational endpoints are authenticated. Called without a Control Center session they return a clear 401, verified against the running server:

curl -s http://localhost:8000/api/control/sessions
{
  "detail": "Authentication required"
}

Authenticate first (see the Control Center walkthrough) to receive the session and artifact lists.

Expected results

  • Without a session, 401 Authentication required (as above).
  • With a valid session, JSON lists of sessions, artifacts and receipts.
  • An empty archive is normal on a fresh install, record a session first.

Common mistakes

  • Calling /api/vai/* or /api/control/* without authenticating, these are operational endpoints, not the open trust APIs.
  • Confusing the recorder's artifacts with the per-operation audit receipt: both are receipts, at different granularities.

Troubleshooting

  • 401 Authentication required: authenticate via the Control Center.
  • Empty list: no sessions recorded yet, capture one with Sentinel or the audit API.

Related documentation