Query the eIDAS Audit Log

This guide shows you how to retrieve eIDAS audit entries for a specific Issuer2 or Verifier2 service. Use the results to review issuance and verification evidence for a time range, session, or entry type.

Prerequisites

Before you begin, ensure you have:

  • An Enterprise Stack organization with Issuer2 and/or Verifier2 activity that has produced audit entries.
  • A Bearer token for an account or API key that holds the view-audit-log permission.
  • The service target you want to audit, for example waltid.tenant1.issuer1 or waltid.tenant1.verifier1.

Every query must include a target. Organization-wide dumps are not supported — choose the issuer or verifier service you want to review.

Query Audit Entries

Call POST /v1/audit/query with a filter body. The organization is taken from the host you call ({orgID}.enterprise-sandbox.waltid.dev).

CURL

Endpoint: POST /v1/audit/query | API Reference

Example Request
curl -X 'POST' \
  'https://{orgID}.enterprise-sandbox.waltid.dev/v1/audit/query' \
  -H 'accept: application/json' \
  -H 'Authorization: Bearer {yourToken}' \
  -H 'Content-Type: application/json' \
  -d '{
  "organizationId": "{orgID}",
  "target": "waltid.tenant1.issuer1",
  "entryTypes": ["CREDENTIAL_ISSUED", "CREDENTIAL_LIFECYCLE"],
  "fromTimestamp": 1741192586004,
  "toTimestamp": 1741278986004,
  "limit": 100
}'

Path Parameters

  • orgID: String (required) - Your organization ID used as the host alias, e.g. test.enterprise-sandbox.waltid.dev.

Header Parameters

  • Authorization: String (required) - Bearer token for Enterprise Stack authentication. Format: Bearer {token}.

Body Parameters

  • organizationId: String (required) - Your organization ID. Must match the organization resolved from the request host.
  • target: String (required) - The service that produced the entries, e.g. waltid.tenant1.issuer1. Must be inside the scope authorized by your token.
  • entryTypes: Array of Strings (optional) - Restrict results to one or more entry types:
    • "CREDENTIAL_ISSUED" — Signed credential delivered to a wallet.
    • "CREDENTIAL_LIFECYCLE" — Provisioning, issuance, suspension, unsuspension, or revocation transitions.
    • "PRESENTATION_VERIFICATION_COMPLETED" — Completed OpenID4VP verification session.
  • fromTimestamp: Number (optional) - Inclusive start of the time range as Unix epoch milliseconds.
  • toTimestamp: Number (optional) - Inclusive end of the time range as Unix epoch milliseconds.
  • sessionId: String (optional) - Restrict to a single OID4VCI or OID4VP session ID.
  • nonce: String (optional) - Raw OpenID4VP nonce from a verification transaction. The API hashes it and matches against stored nonceHash values.
  • fromSequence: Number (optional) - Inclusive lower bound on the organization sequence number.
  • toSequence: Number (optional) - Inclusive upper bound on the organization sequence number.
  • limit: Number (optional) - Maximum entries to return. Defaults to 100. Allowed range: 1–1000.
Example Response
[
  {
    "entryType": "CREDENTIAL_LIFECYCLE",
    "id": "a1b2c3d4-1111-2222-3333-444455556666",
    "organizationId": "waltid",
    "target": "waltid.tenant1.issuer1",
    "timestamp": 1741192586004,
    "sequenceNumber": 42,
    "prevEntryHash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
    "entryHash": "9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08",
    "sessionId": "fb517c9d-5178-48a9-8d39-9fd89d857d53",
    "credentialConfigurationId": "identity_credential_vc+sd-jwt",
    "event": "PROVISIONED",
    "reasonCode": null,
    "operatorId": null
  },
  {
    "entryType": "CREDENTIAL_ISSUED",
    "id": "b2c3d4e5-1111-2222-3333-444455556666",
    "organizationId": "waltid",
    "target": "waltid.tenant1.issuer1",
    "timestamp": 1741192721792,
    "sequenceNumber": 43,
    "prevEntryHash": "9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08",
    "entryHash": "2c26b46b68ffc68ff99b453c1d30413413422d706483bfa0f98a5e886266e7ae",
    "sessionId": "fb517c9d-5178-48a9-8d39-9fd89d857d53",
    "credentialConfigurationId": "identity_credential_vc+sd-jwt",
    "credentialIndex": 0,
    "format": "dc+sd-jwt",
    "credentialPayloadHash": "6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b",
    "holderBindingPublicKeyJwk": {
      "kty": "EC",
      "crv": "P-256",
      "x": "…",
      "y": "…"
    },
    "proofType": "jwt",
    "callId": "af341708-5722-4e04-b3c2-6b99008c7316"
  }
]

Response Fields

  • entryType: String - Discriminator for the entry shape. See Entry Types.
  • id: String - Unique ID of the audit entry.
  • organizationId: String - Organization that owns the chain.
  • target: String - Service that produced the entry.
  • timestamp: Number - When the action was recorded (Unix epoch milliseconds).
  • sequenceNumber: Number - Position in the organization hash chain.
  • prevEntryHash / entryHash: String - Hash-chain links used by Verify Integrity.

Response Codes

  • 200 — Entries returned (may be an empty list).
  • 400 — Invalid filter (for example missing target, or limit outside 1–1000).
  • 401 — Invalid or missing authentication token.
  • 403 — Missing view-audit-log permission, or target outside the authorized scope.

🎉 You've retrieved compliance audit entries for the selected service.

Common Review Queries

Follow One Issuance Session

Use the OID4VCI session ID from your operational records or IssuanceEvent data:

{
  "organizationId": "{orgID}",
  "target": "waltid.tenant1.issuer1",
  "sessionId": "fb517c9d-5178-48a9-8d39-9fd89d857d53"
}

Follow One Verification Session

{
  "organizationId": "{orgID}",
  "target": "waltid.tenant1.verifier1",
  "entryTypes": ["PRESENTATION_VERIFICATION_COMPLETED"],
  "sessionId": "bec96d15-6fe9-4553-a873-82b2ef270b15"
}

Look Up a Verification by Nonce

If you retained the OpenID4VP nonce from the transaction (for example from a wallet dashboard or support ticket), pass it as nonce. The API hashes it before matching — the raw nonce is never stored in the audit log.

{
  "organizationId": "{orgID}",
  "target": "waltid.tenant1.verifier1",
  "nonce": "{rawNonceFromTransaction}"
}

Next Steps

Last updated on August 18, 2026
eIDAS Audit Log OvervieweIDAS Audit Entry Types