Freeze scope
Select archive IDs, evidence revisions and authorized components; identify externally referenced content.
MOBILE-ID · TRUSTED LTANS
Export & Transfer
Package data, evidence and context for recipient verification and acknowledgement of the custody handover point.
Outcome and scope
Prepare a recipient-reconcilable package and define custody handover separately from source deletion.
Documentation scope Workflow design and integration contract; operational configuration is confirmed per environment.
| Prepare | Receive |
|---|---|
| Case-based export, audits, repository migration or provider exit. | A manifested package with integrity digests, authorized content/evidence and recipient acknowledgement. |
Participants: Record owners, senders, recipients and destination approvers.
Workflow and decision points
Package
Inventory files, sizes, digests, format revisions and relationships. Use approved recipient encryption and transfer profiles.
Recipient checks
The recipient checks inventory, bytes and evidence using its own trust inputs; missing components need reasons.
Acknowledge custody
Bind acknowledgement to the exact package and checks. Transfer responsibility only at the agreed point; source disposition is a separate decision.
States, guards and authority
| Current | Guard | Actor | Next | Artifact / recovery |
|---|---|---|---|---|
| Export requested [model] | Authorization and revisions pinned | Archive Service | Package ready [model] | Manifest binds exact bytes, evidence and externally referenced omissions. |
| Delivered [model] | Recipient reconciles package and material | Recipient | Awaiting acknowledgement / rejected [model] | Missing files or wrong digests retain source responsibility under the agreement. |
| Awaiting acknowledgement [model] | Acknowledgement binds transfer and checks | Transfer coordinator | Acknowledged transfer [model] | Source disposition is separate and remains subject to retention and holds. |
Exceptions and controls
| Situation | Action | Boundary |
|---|---|---|
| External data missing | Identify omitted content and its supplying owner. | Do not call a digest-only package complete. |
| No recipient acknowledgement | Retain responsibility under the current agreement. | Export completion does not close transfer. |
| Case-scoped export | Apply authorization and minimization. | A hold does not automatically forbid every authorized retrieval. |
Authorization, approval and recovery
Separate exports:write from transfers:write; encrypt packages and check digest and format versions. Transfer is not disposition.
Without recipient acknowledgement, the sender retains preservation responsibility. Reconstruct from the manifest and reverify before acceptance.
Reconciliation artifacts and acceptance
Retain manifest, export permissions, destination, package digest, recipient report and receipt; do not complete transfer before agreed conditions.
- Missing or altered files must be detected; checking a sample JSON manifest is not ERS validation.
- An acknowledgement for another package cannot complete the transfer.
Integration and data contract
| API | Application scope | Documentation |
|---|---|---|
POST /v1/archives/{archiveId}/exports | exports:write | Export / Transfer API |
GET /v1/exports/{exportId} | exports:read | Export / Transfer API |
POST /v1/archives/{archiveId}/transfers | transfers:write | Transfer API |
GET /v1/transfers/{transferId} | transfers:read | Transfer API |
POST /v1/transfers/{transferId}/acknowledgements | transfers:acknowledge | Transfer API |
Technical input and references
| Element | Definition |
|---|---|
| Input | archiveId, evidence version, export scope, transfer destination and recipient authentication profile. |
| Output | Package containing manifest, payload or reference, evidence, policies, validation material and recipient acknowledgement. |
Execute and reconcile a scenario
| Element | Action |
|---|---|
| Synthetic ID | exp-test-001 → trf-test-001 |
| Task | Freeze package → recipient inventory → scoped verification → acknowledgement. |
| Acceptance case | Wrong recipient/digest/scope is rejected; EXPORTED is not ACKNOWLEDGED. |
These are business test criteria; synthetic packages alone do not establish backend execution or valid ERS.