---
title: "eIDAS Audit Log Overview"
description: "Review compliance-grade issuance and verification audit records in the walt.id Enterprise Stack."
stack: "Enterprise Stack (commercial) — version 1.1.1"
stack_version: "1.1.1"
stack_comparison: https://docs.walt.id/community-vs-enterprise.md
canonical_url: https://docs.walt.id/enterprise-stack/administration/events-and-metrics/eidas-audit-log/overview
generated: 2026-10-01
---
# eIDAS Audit Log Overview

The **eIDAS Audit Log** records compliance evidence for credential issuance and presentation verification in the Enterprise Stack. Use it when you need to demonstrate what happened during a transaction — for example during an eIDAS / EUDI Wallet supervisory review, an internal compliance check, or a data-protection investigation.

It is separate from [operational events](https://docs.walt.id/enterprise-stack/administration/events-and-metrics/overview.md). Events help you monitor product activity and build metrics. The audit log is append-only, hash-chained, and designed so personal credential data is not stored in clear text.

## What Gets Recorded

| Area | Entry type | What it proves |
|:-----|:-----------|:---------------|
| Issuance | `CREDENTIAL_LIFECYCLE` | State changes such as provisioned, issued, suspended, unsuspended, or revoked |
| Issuance | `CREDENTIAL_ISSUED` | That a signed credential was delivered, which public key it was bound to, and a hash of the payload |
| Verification | `PRESENTATION_VERIFICATION_COMPLETED` | What was requested from the wallet, verifier authentication evidence, and the outcome of verification policies |

Entries are written automatically when Issuer2 and Verifier2 complete the corresponding business operations. You do not enable logging per request.

## Design Principles

- **Append-only** — Entries cannot be updated or deleted through the Enterprise API.
- **Hash-chained** — Each entry links to the previous one. Changing or removing an entry breaks the chain for everything after it.
- **Privacy-aware** — Credential claims are not stored. The log keeps a hash of the signed credential payload, public keys, presentation request definitions, and verification evidence instead.
- **Organization-scoped** — Sequence numbers and the integrity chain belong to one organization. Queries always run against a specific service target inside that organization.

**Note:**

The hash chain detects tampering of stored entries. Detecting deletion of a complete trailing segment of the chain still requires you to keep independent checkpoints (for example periodic exports) outside the application database.

## Access

Reading the audit log requires the `view-audit-log` permission on the organization (or a parent scope that grants it). Assign it to a compliance or auditor role through [Access & Permissions](https://docs.walt.id/enterprise-stack/administration/access-and-permissions/overview.md).

## Get Started

- [**Query the Audit Log**](https://docs.walt.id/enterprise-stack/administration/events-and-metrics/eidas-audit-log/query.md) — Retrieve entries for a service, session, or time range.
- [**Entry Types**](https://docs.walt.id/enterprise-stack/administration/events-and-metrics/eidas-audit-log/entry-types.md) — Understand the fields returned for each recorded action.
- [**Verify Integrity**](https://docs.walt.id/enterprise-stack/administration/events-and-metrics/eidas-audit-log/verify-integrity.md) — Confirm that the organization chain is intact.