Sign in
Audits

Verify tenant audit chain integrity

Requires an owner/admin browser session with recent MFA. Returns tenant-scoped, no-store audit data; agent tokens and tenant API keys are not sufficient. Walks the tenant audit chain and verifies HMAC continuity over at most 10,000 rows. Partial verification starts at fromSeq and is anchored to the stored predecessor hash; use requireHead=true to require the current chain head.

post/audit/verify

Query parameters

fromSeqinteger
toSeqinteger
requireHeadboolean

Headers

X-Steward-Request-Timestampstring

Unix seconds, Unix milliseconds, or HTTP/ISO timestamp. Sensitive mutating routes require this or X-Steward-Request-Expires-At when request-expiry or request signatures are enforced.

X-Steward-Request-Expires-Atstring

Unix seconds, Unix milliseconds, or HTTP/ISO expiry time. Sensitive mutating routes require this or X-Steward-Request-Timestamp when request-expiry or request signatures are enforced.

X-Steward-Signaturestring

Authorization signature for sensitive mutating routes when STEWARD_REQUIRE_AUTH_SIGNATURE=true or production enforcement is enabled. Use v1=<hmac-sha256> or p256=<signature>.

X-Steward-Signing-Key-Idstring

Tenant request-signing key id used to select a managed HMAC signing key. Required when signing with a managed tenant key; omit only for static or app-client signing secrets.

Idempotency-Keystring

Required for signed sensitive requests and recommended for all sensitive mutating requests. Replays are scoped to authenticated or explicitly signed contexts.

Response

JSON response

oktrue required

Changes

Changed in 1 of the 9 revisions of this API.1