> ## Documentation Index > Fetch the complete documentation index at: https://plainrouter.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Check the workspace audit hash chain > Check the stored audit snapshot with bounded memory; compare its head hash with your saved export. Limited to 6/min per key and workspace. Unbound keys only. ## OpenAPI ````yaml https://plainrouter.com/openapi.json get /workspaces/{workspace}/admin/audit-events/verify openapi: 3.1.0 info: title: Plainrouter Conversion API version: 0.5.0 description: Plainrouter public Signals Conversion API. servers: - url: https://plainrouter.com/api/v1 description: Production security: - workspaceSecret: [] paths: /workspaces/{workspace}/admin/audit-events/verify: get: tags: - ActionAuditExportApi summary: Check the workspace audit hash chain description: >- Check the stored audit snapshot with bounded memory; compare its head hash with your saved export. Limited to 6/min per key and workspace. Unbound keys only. operationId: verify_audit_events parameters: - name: workspace in: path required: true description: The workspace ID schema: type: integer responses: '200': description: >- Same audit verifier result, plus current snapshot head and sequence bounds. content: application/json: schema: type: object properties: valid: type: boolean description: >- No verifier issue was found. Legacy hashes remain non-recomputable; this is not an external tail anchor. issues: type: array items: type: string row_count: type: integer first_sequence: type: - integer - 'null' last_sequence: type: - integer - 'null' head_hash: type: - string - 'null' verification: type: object properties: legacy: type: object properties: classification: type: string enum: - v1_non_recomputable row_count: type: integer first_sequence: type: - integer - 'null' last_sequence: type: - integer - 'null' predecessor_continuity: type: boolean required: - classification - row_count - first_sequence - last_sequence - predecessor_continuity v2: type: object properties: classification: type: string enum: - v2_recomputable row_count: type: integer cryptographically_recomputable: type: boolean verification_scope: type: string enum: - current_database_snapshot tail_deletion_detection: type: string enum: - not_externally_anchored required: - classification - row_count - cryptographically_recomputable - verification_scope - tail_deletion_detection checkpoint: type: object properties: present: type: boolean valid: type: - boolean - 'null' required: - present - valid issues: type: array items: type: string required: - legacy - v2 - checkpoint - issues note: type: string description: >- hash_version 2 uses SHA-256 of the canonical durable event fields. Null hash_version marks a legacy segment whose original hashes cannot be recomputed. Its single audit.legacy_checkpoint freezes a canonical snapshot digest of that segment. Verification covers the current database snapshot; detecting tail deletion requires comparing a previously saved head hash and sequence. Recognised assignments: name=value (also name[]= and parent[name]=) in URLs, fragments and form bodies; "name": value in JSON, including JSON nested in strings; name: value and name => value for compound names or quoted, bracketed or braced names; payload key names. Names are trimmed and matched case-insensitively: access_token, appsecret_proof, client_secret, refresh_token, signature, token, secret and password. Bare token, signature, secret and password colon/arrow forms require quotes, brackets or braces. The JSON object key code is preserved; code is redacted only as a parameter. Up to six rounds of JSON-escape, percent and HTML-entity decoding are applied. Recognised remaining assignments are exported whole as [redacted]; changed payload keys are renamed without overwriting other entries. Independently, substrings matching /EAA[A-Za-z0-9]{30,}/ are redacted from Meta provider response bodies before storage and hashing, and from exported payloads, actor names and summaries, without requiring a credential name. HTTP(S) URL user-info is redacted from exported payload strings, including JSON strings; an @ in a URL query or fragment does not trigger this user-info rule. This URL user-info rule does not change stored provider response bodies. thumbnail_url query strings are removed. Other encodings of non-Meta secrets are not guaranteed to be caught: the assignment rules do not recognise look-alike names, base64/base64url, name/value pairs, Authorization headers, JS hex escapes or unnamed free text. The EAA backstop covers these only where the matching token text is intact. A changed event includes redacted: true. Clients cannot recompute its event_hash and should use the verify endpoint, which checks the original stored bytes. Member export consent proof: signal.consent_decision_recorded and signal.consent_withdrawal_received payloads include visitor-linked event_id, consent_state and timestamps. event_id is pseudonymous to outsiders but may be a merchant order or Stripe identifier. required: - valid - issues - row_count - first_sequence - last_sequence - head_hash - verification - note '401': description: >- Workspace key missing, expired, revoked or no longer valid for its issuer or bound account. content: application/json: schema: $ref: '#/components/schemas/ErrorMessage' '403': description: >- The key lacks read ability, an explicit operation grant or current workspace membership, or is bound to one ad account. content: application/json: schema: $ref: '#/components/schemas/ErrorMessage' '404': description: >- Workspace outside the credential binding or unavailable; no audit data is returned. content: application/json: schema: anyOf: - $ref: '#/components/schemas/ErrorMessage' - $ref: '#/components/schemas/ApiRouteNotFound' '422': description: Invalid page size, time window or continuation cursor. content: application/json: schema: $ref: '#/components/schemas/ValidationError' '429': description: >- Six verification checks per minute per key and per workspace; the shared API limit also applies. content: application/json: schema: $ref: '#/components/schemas/ErrorMessage' headers: Retry-After: description: Seconds until retry is allowed. required: true schema: type: integer security: - workspaceExportKey: [] components: schemas: ErrorMessage: type: object properties: message: type: string required: - message title: ErrorMessage ApiRouteNotFound: type: object properties: error: type: object properties: code: type: string enum: - api_route_not_found message: type: string resolution: type: string required: - code - message - resolution request: type: object properties: method: type: string path: type: string required: - method - path resources: type: object properties: documentation: type: string openapi: type: string required: - documentation - openapi required: - error - request - resources title: ApiRouteNotFound ValidationError: type: object properties: message: type: string errors: type: object additionalProperties: type: array items: type: string required: - message - errors title: ValidationError securitySchemes: workspaceSecret: type: http description: >- Per-workspace Server secret. It authenticates only the Signals workspace represented by the credential. scheme: bearer workspaceExportKey: type: http description: >- Workspace read key whose stored grant explicitly names the operation. Existing grants are not expanded. scheme: bearer ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.