Audit API
Search, export and verify the tamper-evident audit trail.
Events are hash-chained. verify-integrity recomputes the chain and reports the first position where it breaks. Exports are watermarked and themselves audited, because taking an export is an event worth recording.
#Endpoints
| Endpoint | Permission | Notes | |
|---|---|---|---|
GET |
/v1/audit-events |
audit:read |
— |
GET |
/v1/audit-events/{eventId} |
audit:read |
— |
POST |
/v1/audit-events/export |
audit:export |
— |
POST |
/v1/audit-events/verify-integrity |
audit:verify_integrity |
— |
#What each endpoint does
#GET /v1/audit-events
Search the audit trail.
Requires audit:read.
#GET /v1/audit-events/{eventId}
Audit event detail with hash chain position.
Requires audit:read.
#POST /v1/audit-events/export
Export audit data. Watermarked, hashed and audited.
Requires audit:export.
Request body:
json{
"format": "csv|json",
"reason": "string"
}
#POST /v1/audit-events/verify-integrity
Verify the audit hash chain.
Requires audit:verify_integrity.