---
title: "Get Audit Inclusion Proof"
method: GET
path: "/api/v1/edges/audit_attestation/proofs/{event_id}"
tags: ["Edge"]
---

# Get Audit Inclusion Proof

`GET /api/v1/edges/audit_attestation/proofs/{event_id}`

## Request

- Base URL: `https://example.conductor.one`
- URL: `https://example.conductor.one/api/v1/edges/audit_attestation/proofs/{event_id}`
- Auth: HTTP bearer and OAuth 2
  - Client credentials
  - Token URL: `/auth/v1/token`

Returns the checked inclusion proof of one audit event of the caller's
 own tenant. An event outside the tenant is NOT_FOUND, like a missing one.

## Path parameters

- `event_id` string, required: The eventId field.

## Response `200`

Successful response

- C1ApiEdgeV1EdgeServiceGetAuditInclusionProofResponse: The EdgeServiceGetAuditInclusionProofResponse message.
  - `proof` C1ApiEdgeV1TBAuditInclusionProof: TBAuditInclusionProof proves one audit row belongs to a signed batch. The service checks the path against the manifest root before returning it. It carries no row content: auditors verify the row against leaf_hash offline with `tb audit verify-proof`.
    - `leafHash` string: The row's stored RFC 6962 leaf hash, hex.
    - `leafIndex` string, uint64: Index of the row's leaf in its batch.
    - `manifest` C1ApiEdgeV1TBAuditAttestationManifest: TBAuditAttestationManifest is one signed batch manifest of the tenant's tamper-evident audit log (Time Bandit warehouse attestation). It carries only the manifest's signed fields, so an auditor can rebuild the signed bytes and verify the Ed25519 signature offline with the key listed under key_id.
      - `batchId` string: The batchId field.
      - `canon` string: Canonicalization of the row bytes the leaves hash, for example tb-audit-canon-ch-v1.
      - `chainSeq` string, uint64: Zero-based, contiguous position of this batch in its chain.
      - `firstEventTime` string, date-time, nullable
      - `instanceId` string: The instanceId field.
      - `keyId` string: The keyId field.
      - `lastEventTime` string, date-time, nullable
      - `originId` string: The chain is (tenant_id, origin_id, instance_id).
      - `prevRoot` string: The previous batch's root in this chain, or 64 zeros for the first.
      - `root` string: RFC 6962 Merkle root of the batch, hex.
      - `rowCount` string, uint64: The rowCount field.
      - `signature` string: Ed25519 signature over the domain-separated manifest encoding, hex.
      - `tenantId` string: The tenantId field.
      - `version` integer: The version field.
    - `path` string[], nullable: RFC 6962 audit path, leaf to root, hex.

## Changes

- **2026-10-06** `918a4e749f56`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/conductorone/apis/c1-api/changes/api/v1/edges/audit_attestation/proofs/:event_id/get.md)

---

[API](https://skmtc.dev/conductorone/apis/c1-api.md) - [All operations](https://skmtc.dev/conductorone/apis/c1-api/llms.txt) - [OpenAPI document](https://skmtc.dev/conductorone/apis/c1-api/revisions/fe943bedf41b?raw)