# Audit API and comparison kit — version 1.0.0

## One-off run
Import the included Postman collection. Configure the public service origin and the target URL in a private environment. Create an audit, retain its edit token privately and poll the returned identifier until it is done or failed. Use the API documentation for current limits and error responses.

The collection contains request templates for creation, reading, rerunning and deletion. Ownership-changing actions require the edit token. Reading a report or attachment by identifier does not; possession of that link is sufficient. Avoid confidential notes and attachments.

## Polling
Use a bounded deadline, wait between requests and respect Retry-After when present. Stop on a final failed status rather than retrying forever. The example runner performs a new scoped audit and reports a queue or provider failure clearly.

## Comparable evidence
Match target, requested device, maximum pages, accessibility setting and rule version. Align results by page path and check identifier. Distinguish a newly failed check from a missing page or a changed observation on an already failed check. The comparison interface can inspect two existing reports without saving another server-side history.

## Optional recurrence
The example workflow is manually triggered by default. Its README shows how to enable a weekly schedule. A repository owner chooses the target, settings, retention period and whether a regression should fail the job. Workflow notifications follow that repository's settings; no mail address is collected by this site.

## Retention boundaries
Temporary audit records, attachments and PDFs retain the service's 30-day expiry. A saved comparison artifact is a separate copy under the repository owner's control. Set a short artifact retention period and delete local copies when no longer needed. Never include the edit token in that artifact.

## Interpretation
An automated comparison describes selected response rules at two times. It does not test authenticated workflows, prove accessibility conformance or certify security. Repeat important user journeys independently and assign owners to the changes that warrant investigation.