Skip to main content
Every state-changing API call is recorded in a hash-chained audit log. Each entry references the hash of the previous entry, so any tampering is detectable.

List audit entries

Filters Response 200

Verify the chain

Recomputes hashes for the requested range and reports any tampering.
Response 200 (intact)
Response 200 (tampering detected)
Run GET /v1/audit/verify from an out-of-band system on a schedule (e.g. daily). Persist last_entry_hash to detect retroactive deletions.

Required permissions

The compliance_officer and admin roles have this permission by default; viewer does not.