---
title: "The evidence trail"
method: GET
path: "/api/v1/firme/{id}/events"
tags: ["Signatures (app routes)"]
---

# The evidence trail

`GET /api/v1/firme/{id}/events`

## Request

- Base URL: `https://api.custodo.ai`
- URL: `https://api.custodo.ai/api/v1/firme/{id}/events`
- Auth: HTTP bearer

Every act on the envelope, in chain order, each hash-chained to the one before. Verify it with `GET /{id}/verify`, or recompute a `v2` link yourself (see FirmeChainVerdict).

## Path parameters

- `id` string, uuid, required

## Headers

- `X-Tenant-Id` string, uuid

## Response `200`

The links, oldest first.

- object
  - `ok` true, required
  - `data` object[], required
    - `id` string, required: A UUID.
    - `event` 'created' | 'sent' | 'viewed' | 'otp_sent' | 'otp_verified' | 'signed' | 'declined' | 'completed' | 'expired' | 'voided' | 'copy_sent', required
    - `signerId` string, nullable, required: A UUID.
    - `detail` object, nullable, required
    - `prevHash` string, nullable, required
    - `hash` string, required
    - `at` string, required: ISO 8601, UTC.

## Other responses

- `400`: The request did not validate: `error.details` names the fields.
- `401`: No API key, or one that is malformed, unknown, revoked or expired.
- `403`: The module is off for this organisation, the credential lacks the permission, or the tier does not cover it.
- `404`: Nothing with that id in this organisation.
- `429`: The API key has spent its minute, or its day. See `Retry-After`.

---

[API](https://skmtc.dev/custodo/apis/custodo-integrazioni.md) · [All operations](https://skmtc.dev/custodo/apis/custodo-integrazioni/llms.txt) · [OpenAPI document](https://skmtc.dev/custodo/apis/custodo-integrazioni/revisions/16d336d3ec2a?raw)