#Verify eIDAS Audit Log Integrity

This guide shows you how to check that the eIDAS audit log for your organization has not been tampered with. Run this periodically as part of compliance monitoring, or after an incident review.

#How Integrity Works

Every audit entry in an organization forms a single append-only chain:

Each entry receives a monotonic sequenceNumber.
Each entry stores prevEntryHash (the previous entry's entryHash, or GENESIS for the first entry).
Each entry stores its own entryHash, derived from the previous hash and the entry contents.

If an entry is modified, removed from the middle of the chain, or its sequence numbers are disrupted, verification fails and reports where the break starts.

Verifying the live database chain alone cannot prove that a complete trailing segment was never deleted. For production compliance programs, export signed checkpoints (sequence number + tip hash) to storage outside the Enterprise API database on a regular schedule.

#Prerequisites

Before you begin, ensure you have:

A Bearer token with the view-audit-log permission at organization scope.
Access via the organization host, e.g. https://{orgID}.enterprise-sandbox.waltid.dev.

Chain verification must be called at organization-root scope. The API rejects the request if the resolved route target is not the organization itself.

#Verify the Chain

Call GET /v1/audit/verify-chain. Optionally limit the check to a sequence range.

CURL

Endpoint: GET /v1/audit/verify-chain | API Reference

#Example Request

curl -X 'GET' \
  'https://{orgID}.enterprise-sandbox.waltid.dev/v1/audit/verify-chain?fromSequence=0&toSequence=1000' \
  -H 'accept: application/json' \
  -H 'Authorization: Bearer {yourToken}'

Path Parameters

orgID: String (required) - Your organization ID used as the host alias, e.g. test.enterprise-sandbox.waltid.dev.

Query Parameters

fromSequence: Number (optional) - Inclusive start of the sequence range. Defaults to 0.
toSequence: Number (optional) - Inclusive end of the sequence range. Defaults to the end of the chain.

Header Parameters

Authorization: String (required) - Bearer token for Enterprise Stack authentication. Format: Bearer {token}.

#Example Response (Intact)

{
  "intact": true,
  "checkedEntries": 128,
  "firstBrokenAt": null,
  "message": "Chain intact: 128 entries verified (seq 0–127)"
}

#Example Response (Broken)

{
  "intact": false,
  "checkedEntries": 42,
  "firstBrokenAt": 42,
  "message": "Hash mismatch at seq=42: stored=9f86d081884c7d65… recomputed=2c26b46b68ffc68f…"
}

Response Fields

intact: Boolean - true if every checked entry recomputes correctly and sequence numbers are continuous.
checkedEntries: Number - How many entries were verified in this run.
firstBrokenAt: Number or null - Sequence number of the first failing entry, or null when intact.
message: String - Human-readable summary of the result.

Response Codes

200 — Verification completed (inspect intact for the outcome).
400 — Invalid sequence parameters.
401 — Invalid or missing authentication token.
403 — Missing view-audit-log permission, or call was not made at organization-root scope.

🎉 You've verified the integrity of the organization audit chain for the selected range.

#Interpreting Results

Result	What to do
`intact: true`	The checked range is consistent. Continue with your scheduled monitoring.
`intact: false`	Treat as a security / compliance incident. Note `firstBrokenAt` and `message`, freeze related exports, and investigate database access outside the Enterprise API.
`checkedEntries: 0`	No entries exist in the requested range — expected for a new organization or an empty sequence window.

#Recommended Operating Practice

Grant least privilege — Give view-audit-log only to compliance and security roles.
Query by session during investigations — Start from a known sessionId or nonce, then expand the time window if needed.
Verify on a schedule — Run /audit/verify-chain regularly and alert on intact: false.
Keep external checkpoints — Periodically store the latest sequenceNumber and entryHash outside MongoDB so trailing deletions can be detected later.
Separate concerns — Use Events & Metrics for product analytics; use this audit log for compliance evidence.

#Next Steps

Review recorded evidence — Entry Types.
Retrieve entries for an investigation — Query the Audit Log.
Manage auditor access — Permissions.

Last updated on August 18, 2026

eIDAS Audit Entry Types eIDAS Audit Log