---
title: "Signed tree head for a checkpoint"
method: GET
path: "/api/v1/audit/checkpoints/{seq}"
---

# Signed tree head for a checkpoint

`GET /api/v1/audit/checkpoints/{seq}`

## Request

- Base URL: `https://app.axiorank.com`
- URL: `https://app.axiorank.com/api/v1/audit/checkpoints/{seq}`
- Auth: HTTP bearer

Fetch the signed tree head (STH) for one of your workspace's sealed checkpoints by its sequence number. A monitor pins the STH series over time to detect a retroactive edit. Requires the `logs:read` scope; the workspace is taken from the key, so an STH series is never cross-tenant.

## Path parameters

- `seq` integer, required

## Response `200`

The signed tree head for that checkpoint.

- SignedTreeHead: An Ed25519-signed Merkle tree head over a sealed checkpoint window.
  - `seq` integer, required
  - `merkleRoot` string, required: Hex RFC 6962 root over the window's row hashes.
  - `treeSize` integer, required
  - `prevCheckpointHash` string, required: Binds the STH into the append-only chain.
  - `checkpointHash` string: This checkpoint's own hash, signed on self-anchored (v2) heads. Absent on v1.
  - `fromTs` string, date-time, required
  - `toTs` string, date-time, required
  - `workspaceId` string, uuid, required
  - `algorithm` 'EdDSA', required
  - `merkleVersion` integer, required
  - `treeAlgo` string, required
  - `keyId` string, required: RFC 7638 thumbprint of the signing key (JWKS lookup id).
  - `signedAt` string, date-time, required
  - `signature` string, required: base64url Ed25519 over the canonical STH.

## Other responses

- `400`: Invalid checkpoint sequence.
- `401`: Missing or invalid API key.
- `404`: Unknown checkpoint, or it predates the Merkle upgrade.

---

[API](https://skmtc.dev/axiorank/apis/axiorank-gateway-api.md) · [All operations](https://skmtc.dev/axiorank/apis/axiorank-gateway-api/llms.txt) · [OpenAPI document](https://skmtc.dev/axiorank/apis/axiorank-gateway-api/revisions/d8a7a33656e4?raw)