eIDAS Audit Log Overview
The eIDAS Audit Log records compliance evidence for credential issuance and presentation verification in the Enterprise Stack. Use it when you need to demonstrate what happened during a transaction — for example during an eIDAS / EUDI Wallet supervisory review, an internal compliance check, or a data-protection investigation.
It is separate from operational events. Events help you monitor product activity and build metrics. The audit log is append-only, hash-chained, and designed so personal credential data is not stored in clear text.
What Gets Recorded
| Area | Entry type | What it proves |
|---|---|---|
| Issuance | CREDENTIAL_LIFECYCLE | State changes such as provisioned, issued, suspended, unsuspended, or revoked |
| Issuance | CREDENTIAL_ISSUED | That a signed credential was delivered, which public key it was bound to, and a hash of the payload |
| Verification | PRESENTATION_VERIFICATION_COMPLETED | What was requested from the wallet, verifier authentication evidence, and the outcome of verification policies |
Entries are written automatically when Issuer2 and Verifier2 complete the corresponding business operations. You do not enable logging per request.
Design Principles
- Append-only — Entries cannot be updated or deleted through the Enterprise API.
- Hash-chained — Each entry links to the previous one. Changing or removing an entry breaks the chain for everything after it.
- Privacy-aware — Credential claims are not stored. The log keeps a hash of the signed credential payload, public keys, presentation request definitions, and verification evidence instead.
- Organization-scoped — Sequence numbers and the integrity chain belong to one organization. Queries always run against a specific service target inside that organization.
The hash chain detects tampering of stored entries. Detecting deletion of a complete trailing segment of the chain still requires you to keep independent checkpoints (for example periodic exports) outside the application database.
Access
Reading the audit log requires the view-audit-log permission on the organization (or a parent scope that grants it). Assign it to a compliance or auditor role through Access & Permissions.
Get Started
- Query the Audit Log — Retrieve entries for a service, session, or time range.
- Entry Types — Understand the fields returned for each recorded action.
- Verify Integrity — Confirm that the organization chain is intact.