Skip to main content
GET
Check the workspace audit hash chain

Authorizations

Authorization
string
header
required

Workspace read key whose stored grant explicitly names the operation. Existing grants are not expanded.

Path Parameters

workspace
integer
required

The workspace ID

Response

Same audit verifier result, plus current snapshot head and sequence bounds.

valid
boolean
required

No verifier issue was found. Legacy hashes remain non-recomputable; this is not an external tail anchor.

issues
string[]
required
row_count
integer
required
first_sequence
integer | null
required
last_sequence
integer | null
required
head_hash
string | null
required
verification
object
required
note
string
required

hash_version 2 uses SHA-256 of the canonical durable event fields. Null hash_version marks a legacy segment whose original hashes cannot be recomputed. Its single audit.legacy_checkpoint freezes a canonical snapshot digest of that segment. Verification covers the current database snapshot; detecting tail deletion requires comparing a previously saved head hash and sequence. Recognised assignments: name=value (also name[]= and parent[name]=) in URLs, fragments and form bodies; "name": value in JSON, including JSON nested in strings; name: value and name => value for compound names or quoted, bracketed or braced names; payload key names. Names are trimmed and matched case-insensitively: access_token, appsecret_proof, client_secret, refresh_token, signature, token, secret and password. Bare token, signature, secret and password colon/arrow forms require quotes, brackets or braces. The JSON object key code is preserved; code is redacted only as a parameter. Up to six rounds of JSON-escape, percent and HTML-entity decoding are applied. Recognised remaining assignments are exported whole as [redacted]; changed payload keys are renamed without overwriting other entries. Independently, substrings matching /EAA[A-Za-z0-9]{30,}/ are redacted from Meta provider response bodies before storage and hashing, and from exported payloads, actor names and summaries, without requiring a credential name. HTTP(S) URL user-info is redacted from exported payload strings, including JSON strings; an @ in a URL query or fragment does not trigger this user-info rule. This URL user-info rule does not change stored provider response bodies. thumbnail_url query strings are removed. Other encodings of non-Meta secrets are not guaranteed to be caught: the assignment rules do not recognise look-alike names, base64/base64url, name/value pairs, Authorization headers, JS hex escapes or unnamed free text. The EAA backstop covers these only where the matching token text is intact. A changed event includes redacted: true. Clients cannot recompute its event_hash and should use the verify endpoint, which checks the original stored bytes. Member export consent proof: signal.consent_decision_recorded and signal.consent_withdrawal_received payloads include visitor-linked event_id, consent_state and timestamps. event_id is pseudonymous to outsiders but may be a merchant order or Stripe identifier.