---
title: "Public checkpoint series for a monitored log"
method: GET
path: "/api/v1/audit/log/{logId}/checkpoints"
---

# Public checkpoint series for a monitored log

`GET /api/v1/audit/log/{logId}/checkpoints`

## Request

- Base URL: `https://app.axiorank.com`
- URL: `https://app.axiorank.com/api/v1/audit/log/{logId}/checkpoints`
- Auth: none required

PUBLIC, unauthenticated: the signed-tree-head series for a workspace that opted into public monitoring, keyed by its opaque log id. Anyone can pull the series and independently watch for equivocation or rollback (the `@axiorank/log-watchdog` daemon does this). Only hashes, counts, timestamps, signatures, and witness records are exposed, never audit content.

## Path parameters

- `logId` string, uuid, required

## Query parameters

- `after` integer
- `limit` integer

## Response `200`

A page of checkpoints, ascending by sequence.

- PublicCheckpointList
  - `logId` string, uuid, required
  - `checkpoints` PublicCheckpoint[], required
    - `seq` integer, required
    - `signedTreeHead` SignedTreeHead: An Ed25519-signed Merkle tree head over a sealed checkpoint window.
      - `seq` integer, required
      - `merkleRoot` string, required: Hex RFC 6962 root over the window's row hashes.
      - `treeSize` integer, required
      - `prevCheckpointHash` string, required: Binds the STH into the append-only chain.
      - `checkpointHash` string: This checkpoint's own hash, signed on self-anchored (v2) heads. Absent on v1.
      - `fromTs` string, date-time, required
      - `toTs` string, date-time, required
      - `workspaceId` string, uuid, required
      - `algorithm` 'EdDSA', required
      - `merkleVersion` integer, required
      - `treeAlgo` string, required
      - `keyId` string, required: RFC 7638 thumbprint of the signing key (JWKS lookup id).
      - `signedAt` string, date-time, required
      - `signature` string, required: base64url Ed25519 over the canonical STH.
    - `checkpointHash` string, required
    - `batchHash` string, required
    - `prevHash` string, required
    - `rowCount` integer, required
    - `fromTs` string, date-time, required
    - `toTs` string, date-time, required
    - `purged` boolean, required: Rows purged under retention; the signed head still proves the window.
    - `witnesses` WitnessRecord[], required
      - `witness` string, required: Witness scheme: 'rekor' or 'note:<name>'.
      - `keyId` string, required: Pinned witness key / log id used to verify the countersignature.
      - `signedAt` string, date-time, required
      - `subjectHash` string, required: Hex SHA-256 over the canonical STH: binds the record to this head.
      - `signature` string, required: The witness countersignature (for rekor, the SET).
      - `meta` object

## Other responses

- `404`: Unknown log id, or monitoring is not enabled.
- `429`: Rate limited.

---

[API](https://skmtc.dev/axiorank/apis/axiorank-gateway-api.md) · [All operations](https://skmtc.dev/axiorank/apis/axiorank-gateway-api/llms.txt) · [OpenAPI document](https://skmtc.dev/axiorank/apis/axiorank-gateway-api/revisions/d8a7a33656e4?raw)