Skip to content

Verify the audit trail has not been tampered with

Re-check your tenant's stored audit records against their signatures and their hash chain, to prove that no record was altered or removed after it was written. Verification detects and reports; it never modifies an audit record.

Who can do it

A tenant administrator starts a verification of the tenant's own chains through the API. In the console, verification is started by a platform super administrator; your Audit Log shows its result, read-only. A tenant auditor can read the result but not start a verification.

Before you start

  • Your audit records are kept as chains, one per record type: cryptographic operations, administrative changes, authentication, PQC handshake and audit access. A verification walks one chain at a time.
  • The platform also verifies every chain on a schedule, so your Audit Log may already show a recent result.

Steps

  1. Open Audit Log from your tenant's navigation and read the integrity status beside the title: Verified intact, Not yet verified, Integrity break detected or Integrity status unavailable. It states when the records were last verified, which record types that covers, and whether older events were removed by the retention policy.
  2. To start a verification, a tenant administrator calls the API described under "Without the console". In the console, a platform super administrator does it:
    1. Open Audit Integrity from the platform navigation and select By tenant.
    2. On your tenant's row for the record type, select Verify this chain.
    3. In Verify one chain, tick Re-check from the start of the chain to ignore the recorded checkpoint and prove the whole chain again; leave it clear to resume from the last verified position.
    4. Select Verify.

What you see when it worked

The verification reports the records checked, the record signatures that did not match, the range covered and, when it found one, each break with its kind and position. A verdict of intact speaks only for the range covered: a walk that stopped at its budget says so, and calling again continues from where it stopped. Your Audit Log's integrity status then reflects the latest run.

A broken verdict is a successful verification, not an error. It stays broken until a later run over the same range finds the chain intact.

If it fails

What you see Cause What to do
"The verification could not run" A verification of this chain is already in flight (409), or the request was refused Wait for the running one to finish, then verify again
403 from the API You do not hold the permission to verify, or you addressed a tenant that is not your own Use a tenant administrator account of this tenant
Integrity status unavailable The status could not be read The records themselves are unaffected; reload the page

Without the console

A tenant administrator has no console control for this task; the API is the way to start a verification of the tenant's own chains.

Surface How
API, verify one chain POST /api/v3/audit/tenants/{tenantId}/integrity/verify?plane=<plane> (operation verifyTenantAuditIntegrity), where plane names the chain, for example CRYPTO, ADMIN, AUTH, PQC or META. Add fromGenesis=true to re-prove the chain from its origin. The call is synchronous and answers 200 with verdict (INTACT or BROKEN), rowsVerified, verifiedFrom, verifiedTo, complete, signatureFailures, chainBreaks and coverage
API, read the latest result GET /api/v3/audit/tenants/{tenantId}/integrity/last (getTenantAuditIntegrityVerdict); omit plane for the aggregate across all record types. everVerified: false means nobody has looked, and is not a pass

There is no CLI command and no admin SDK method for audit integrity.