---
title: "Query the eIDAS Audit Log"
description: "Retrieve eIDAS compliance audit entries for a service target in the walt.id Enterprise Stack."
stack: "Enterprise Stack (commercial) — version 1.1.1"
stack_version: "1.1.1"
stack_comparison: https://docs.walt.id/community-vs-enterprise.md
canonical_url: https://docs.walt.id/enterprise-stack/administration/events-and-metrics/eidas-audit-log/query
generated: 2026-10-01
---
# Query the eIDAS Audit Log

This guide shows you how to retrieve eIDAS audit entries for a specific Issuer2 or Verifier2 service. Use the results to review issuance and verification evidence for a time range, session, or entry type.

## Prerequisites

Before you begin, ensure you have:

- **An Enterprise Stack organization** with Issuer2 and/or Verifier2 activity that has produced audit entries.
- **A Bearer token** for an account or API key that holds the `view-audit-log` permission.
- **The service target** you want to audit, for example `waltid.tenant1.issuer1` or `waltid.tenant1.verifier1`.

**Note:**

Every query must include a `target`. Organization-wide dumps are not supported — choose the issuer or verifier service you want to review.

---

## Query Audit Entries

Call `POST /v1/audit/query` with a filter body. The organization is taken from the host you call (`{orgID}.enterprise-sandbox.waltid.dev`).

**Option: CURL**

**Endpoint:** `POST /v1/audit/query` | [API Reference](https://enterprise.sandbox.walt.id/swagger/index.html#/eIDAS%20Audit%20Log/post_v1_audit_query)

##### Example Request

```bash
curl -X 'POST' \
  'https://{orgID}.enterprise-sandbox.waltid.dev/v1/audit/query' \
  -H 'accept: application/json' \
  -H 'Authorization: Bearer {yourToken}' \
  -H 'Content-Type: application/json' \
  -d '{
  "organizationId": "{orgID}",
  "target": "waltid.tenant1.issuer1",
  "entryTypes": ["CREDENTIAL_ISSUED", "CREDENTIAL_LIFECYCLE"],
  "fromTimestamp": 1741192586004,
  "toTimestamp": 1741278986004,
  "limit": 100
}'
```

**Path Parameters**

- **orgID**: _String_ (required) - Your organization ID used as the host alias, e.g. `test.enterprise-sandbox.waltid.dev`.

**Header Parameters**

- **Authorization**: _String_ (required) - Bearer token for Enterprise Stack authentication. Format: `Bearer {token}`.

**Body Parameters**

- **organizationId**: _String_ (required) - Your organization ID. Must match the organization resolved from the request host.
- **target**: _String_ (required) - The service that produced the entries, e.g. `waltid.tenant1.issuer1`. Must be inside the scope authorized by your token.
- **entryTypes**: _Array of Strings_ (optional) - Restrict results to one or more entry types:
  - `"CREDENTIAL_ISSUED"` — Signed credential delivered to a wallet.
  - `"CREDENTIAL_LIFECYCLE"` — Provisioning, issuance, suspension, unsuspension, or revocation transitions.
  - `"PRESENTATION_VERIFICATION_COMPLETED"` — Completed OpenID4VP verification session.
- **fromTimestamp**: _Number_ (optional) - Inclusive start of the time range as Unix epoch milliseconds.
- **toTimestamp**: _Number_ (optional) - Inclusive end of the time range as Unix epoch milliseconds.
- **sessionId**: _String_ (optional) - Restrict to a single OID4VCI or OID4VP session ID.
- **nonce**: _String_ (optional) - Raw OpenID4VP nonce from a verification transaction. The API hashes it and matches against stored `nonceHash` values.
- **fromSequence**: _Number_ (optional) - Inclusive lower bound on the organization sequence number.
- **toSequence**: _Number_ (optional) - Inclusive upper bound on the organization sequence number.
- **limit**: _Number_ (optional) - Maximum entries to return. Defaults to `100`. Allowed range: `1`–`1000`.

---

##### Example Response

```json
[
  {
    "entryType": "CREDENTIAL_LIFECYCLE",
    "id": "a1b2c3d4-1111-2222-3333-444455556666",
    "organizationId": "waltid",
    "target": "waltid.tenant1.issuer1",
    "timestamp": 1741192586004,
    "sequenceNumber": 42,
    "prevEntryHash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
    "entryHash": "9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08",
    "sessionId": "fb517c9d-5178-48a9-8d39-9fd89d857d53",
    "credentialConfigurationId": "identity_credential_vc+sd-jwt",
    "event": "PROVISIONED",
    "reasonCode": null,
    "operatorId": null
  },
  {
    "entryType": "CREDENTIAL_ISSUED",
    "id": "b2c3d4e5-1111-2222-3333-444455556666",
    "organizationId": "waltid",
    "target": "waltid.tenant1.issuer1",
    "timestamp": 1741192721792,
    "sequenceNumber": 43,
    "prevEntryHash": "9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08",
    "entryHash": "2c26b46b68ffc68ff99b453c1d30413413422d706483bfa0f98a5e886266e7ae",
    "sessionId": "fb517c9d-5178-48a9-8d39-9fd89d857d53",
    "credentialConfigurationId": "identity_credential_vc+sd-jwt",
    "credentialIndex": 0,
    "format": "dc+sd-jwt",
    "credentialPayloadHash": "6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b",
    "holderBindingPublicKeyJwk": {
      "kty": "EC",
      "crv": "P-256",
      "x": "…",
      "y": "…"
    },
    "proofType": "jwt",
    "callId": "af341708-5722-4e04-b3c2-6b99008c7316"
  }
]
```

**Response Fields**

- **entryType**: _String_ - Discriminator for the entry shape. See [Entry Types](https://docs.walt.id/enterprise-stack/administration/events-and-metrics/eidas-audit-log/entry-types.md).
- **id**: _String_ - Unique ID of the audit entry.
- **organizationId**: _String_ - Organization that owns the chain.
- **target**: _String_ - Service that produced the entry.
- **timestamp**: _Number_ - When the action was recorded (Unix epoch milliseconds).
- **sequenceNumber**: _Number_ - Position in the organization hash chain.
- **prevEntryHash** / **entryHash**: _String_ - Hash-chain links used by [Verify Integrity](https://docs.walt.id/enterprise-stack/administration/events-and-metrics/eidas-audit-log/verify-integrity.md).

**Response Codes**

- `200` — Entries returned (may be an empty list).
- `400` — Invalid filter (for example missing `target`, or `limit` outside `1`–`1000`).
- `401` — Invalid or missing authentication token.
- `403` — Missing `view-audit-log` permission, or `target` outside the authorized scope.

🎉 You've retrieved compliance audit entries for the selected service.

---

## Common Review Queries

### Follow One Issuance Session

Use the OID4VCI session ID from your operational records or [IssuanceEvent](https://docs.walt.id/enterprise-stack/administration/events-and-metrics/event-types/issuance-event.md) data:

```json
{
  "organizationId": "{orgID}",
  "target": "waltid.tenant1.issuer1",
  "sessionId": "fb517c9d-5178-48a9-8d39-9fd89d857d53"
}
```

### Follow One Verification Session

```json
{
  "organizationId": "{orgID}",
  "target": "waltid.tenant1.verifier1",
  "entryTypes": ["PRESENTATION_VERIFICATION_COMPLETED"],
  "sessionId": "bec96d15-6fe9-4553-a873-82b2ef270b15"
}
```

### Look Up a Verification by Nonce

If you retained the OpenID4VP nonce from the transaction (for example from a wallet dashboard or support ticket), pass it as `nonce`. The API hashes it before matching — the raw nonce is never stored in the audit log.

```json
{
  "organizationId": "{orgID}",
  "target": "waltid.tenant1.verifier1",
  "nonce": "{rawNonceFromTransaction}"
}
```

---

## Next Steps

- **Interpret the payload** — [Entry Types](https://docs.walt.id/enterprise-stack/administration/events-and-metrics/eidas-audit-log/entry-types.md).
- **Confirm the chain is intact** — [Verify Integrity](https://docs.walt.id/enterprise-stack/administration/events-and-metrics/eidas-audit-log/verify-integrity.md).
- **Compare with operational monitoring** — [Query Events](https://docs.walt.id/enterprise-stack/administration/events-and-metrics/query-events.md).