API reference
Audit
5 operations in this area of the contract. Every one declares the permission it requires.
Contract version 0.2.0All areas
Operations
/v1/audit/chain-integrityVerify this tenant's audit chain
Recomputes the chain from genesis and checks every anchor, on demand. It does not read a stored verdict: a cached "valid" flag is precisely what an attacker would set. `broken_at_seq` locates the first divergence so an investigator has somewhere to start.
Show parameters and responsesHide parameters and responses
Responses
200Chain statusChainStatus
/v1/audit/eventsThe audit trail
Show parameters and responsesHide parameters and responses
Parameters
| Name | In | Type | Description |
|---|---|---|---|
action | query | string | — |
resource_type | query | string | — |
resource_id | query | string | — |
after_seq | query | integer | Keyset position on the per-tenant sequence, in the clear. Predates `cursor` and still works; `cursor` wins if both are sent. |
limit | query | integer | Page size, capped at 200. |
cursor | query | string | Opaque keyset cursor from a previous response. Offset pagination is deliberately not offered: `OFFSET 500000` is a table scan, and if it were offered it would be used (ADR-0012). Only the collections that document this parameter can be resumed. The rest report `truncated: true` and refuse a cursor rather than silently returning the first page again — see the `truncated` field on the page schemas. |
Responses
200A page of audit events, newest firstAuditPage
/v1/audit/retention-policiesList retention coverage and effective hold state
Returns every member of the closed evidence-family vocabulary, including families for which this tenant has no configured policy. Missing coverage is explicit and is never treated as an implicit five-year policy.
A hold is a conservative tenant-wide summary for subject-scoped evidence. An active or release-pending hold blocks reductions but permits increases; it does not claim every row belongs to the held subject. NEEDS-COMPLIANCE-VALIDATION (Q5). This surface does not purge data, choose an erasure boundary, or override a legal hold.
Show parameters and responsesHide parameters and responses
Responses
200Complete retention-policy coverageRetentionPolicyPage
/v1/audit/retention-policies/{resourceType}/historyList immutable applied versions for an evidence family
Show parameters and responsesHide parameters and responses
Parameters
| Name | In | Type | Description |
|---|---|---|---|
resourceTyperequired | path | alert_records | audit_events | case_records | configuration_history | customer_records | onboarding_evidence | privacy_records | regulatory_reports | screening_records | transaction_records | — |
Responses
200Applied policy versions, newest firstRetentionHistoryPage422—
/v1/audit/retention-policies/{resourceType}/proposalsPropose a retention-period change for independent approval
Creates a digest-bound approval request; it does not change the effective policy. The maker cannot approve their own request. The five-year floor is validated before storage and enforced again by the database. An active hold refuses a reduction both here and when the checker later applies it, closing the approval-delay race. No deletion is performed.
Show parameters and responsesHide parameters and responses
Parameters
| Name | In | Type | Description |
|---|---|---|---|
resourceTyperequired | path | alert_records | audit_events | case_records | configuration_history | customer_records | onboarding_evidence | privacy_records | regulatory_reports | screening_records | transaction_records | — |
Responses
202Proposal recorded; policy unchanged pending a different checkerRetentionProposal409An active or release-pending hold blocks this reduction422—