Check that the stored audit was not changed

GET

/v1/audit-log/integrity

HttpRequest request = HttpRequest.newBuilder()
    .uri(URI.create("http://localhost:8080/v1/audit-log/integrity"))
    .header("Authorization", "Bearer <token>")
    .method("GET", HttpRequest.BodyPublishers.noBody())
    .build();
HttpResponse<String> response = HttpClient.newHttpClient().send(request, HttpResponse.BodyHandlers.ofString());
System.out.println(response.body());

const url = 'http://localhost:8080/v1/audit-log/integrity';
const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request GET \
  --url http://localhost:8080/v1/audit-log/integrity \
  --header 'Authorization: Bearer <token>'

Available inEmbeddedBundledCluster

AuthAuthenticated Bearer token

Checks the caller’s tenant’s stored ACCESS and IDENTITY entries against their hash chains and names, per chain, the first place the chain no longer holds (CHANGED, UNLINKED, MISSING or HEAD). Removing the oldest entries is what retention does and is not a break. Embedded keeps its audit in memory only and answers durable false with no chains. Requires audit:read. Reads every stored entry of the tenant.

Authorizations

bearerAuth

Parameters

Header Parameters

x-tenant-id

string

>= 1 characters

Tenant selection. A principal of one tenant may omit it, and if sent it must name that tenant. A principal that may act in several tenants sends it on every request.

Query Parameters

sequence

integer format: int64

>= 1

Also answer each chain’s stored hash at this position

Responses

200

One report per chain

application/json

object

durable

required

boolean

intact

required

boolean

chains

required

Array<object>

object

category

required

string

Allowed values: ACCESS IDENTITY

entries

required

integer format: int64

firstSequence

integer | null format: int64

lastSequence

integer | null format: int64

headSequence

required

integer format: int64

headHash

string | null

hashAtSequence

string

intact

required

boolean

broken

object

sequence

integer format: int64

problem

string

Allowed values: CHANGED UNLINKED MISSING HEAD

detail

string

Example

{
  "chains": [
    {
      "category": "ACCESS",
      "broken": {
        "problem": "CHANGED"
      }
    }
  ]
}

400

Invalid request

application/problem+json

object

type

required

string

/^urn:bpm:error:/

title

required

string

status

required

integer

>= 400 <= 599

detail

required

string

instance

required

The request path.

string

mode

Present only on mode-not-supported. It names the engine’s mode.

string

Example

{
  "type": "urn:bpm:error:invalid-argument",
  "title": "Bad Request",
  "status": 400,
  "detail": "The request is malformed",
  "instance": "/v1/audit-log/integrity"
}

401

Authentication required

application/problem+json

object

type

required

string

/^urn:bpm:error:/

title

required

string

status

required

integer

>= 400 <= 599

detail

required

string

instance

required

The request path.

string

mode

Present only on mode-not-supported. It names the engine’s mode.

string

Example

{
  "type": "urn:bpm:error:unauthorized",
  "title": "Unauthorized",
  "status": 401,
  "detail": "A valid bearer credential is required",
  "instance": "/v1/audit-log/integrity"
}

Headers

WWW-Authenticate

string

403

The caller lacks the required permission.

application/problem+json

object

type

required

string

/^urn:bpm:error:/

title

required

string

status

required

integer

>= 400 <= 599

detail

required

string

instance

required

The request path.

string

mode

Present only on mode-not-supported. It names the engine’s mode.

string

Example

{
  "type": "urn:bpm:error:forbidden",
  "title": "Forbidden",
  "status": 403,
  "detail": "The principal lacks the action this route requires",
  "instance": "/v1/audit-log/integrity"
}

404

Tenant-scoped resource not found

application/problem+json

object

type

required

string

/^urn:bpm:error:/

title

required

string

status

required

integer

>= 400 <= 599

detail

required

string

instance

required

The request path.

string

mode

Present only on mode-not-supported. It names the engine’s mode.

string

Example

{
  "type": "urn:bpm:error:not-found",
  "title": "Not Found",
  "status": 404,
  "detail": "The requested resource does not exist",
  "instance": "/v1/audit-log/integrity"
}

409

Idempotency conflict

application/problem+json

object

type

required

string

/^urn:bpm:error:/

title

required

string

status

required

integer

>= 400 <= 599

detail

required

string

instance

required

The request path.

string

mode

Present only on mode-not-supported. It names the engine’s mode.

string

Example

{
  "type": "urn:bpm:error:conflict",
  "title": "Conflict",
  "status": 409,
  "detail": "The idempotency key is already associated with another request",
  "instance": "/v1/audit-log/integrity"
}

413

Authenticated request exceeds its configured bound

application/problem+json

object

type

required

string

/^urn:bpm:error:/

title

required

string

status

required

integer

>= 400 <= 599

detail

required

string

instance

required

The request path.

string

mode

Present only on mode-not-supported. It names the engine’s mode.

string

Example

{
  "type": "urn:bpm:error:payload-too-large",
  "title": "Payload Too Large",
  "status": 413,
  "detail": "The request exceeds the configured size limit",
  "instance": "/v1/audit-log/integrity"
}

429

Tenant quota exhausted

application/problem+json

object

type

required

string

/^urn:bpm:error:/

title

required

string

status

required

integer

>= 400 <= 599

detail

required

string

instance

required

The request path.

string

mode

Present only on mode-not-supported. It names the engine’s mode.

string

Example

{
  "type": "urn:bpm:error:quota-exhausted",
  "title": "Quota Exhausted",
  "status": 429,
  "detail": "The tenant active-instance quota is exhausted",
  "instance": "/v1/audit-log/integrity"
}

500

Non-leaking internal failure

application/problem+json

object

type

required

string

/^urn:bpm:error:/

title

required

string

status

required

integer

>= 400 <= 599

detail

required

string

instance

required

The request path.

string

mode

Present only on mode-not-supported. It names the engine’s mode.

string

Example

{
  "type": "urn:bpm:error:internal",
  "title": "Internal Server Error",
  "status": 500,
  "detail": "The request could not be completed",
  "instance": "/v1/audit-log/integrity"
}

501

The operation is on the reviewed allow-list of what this deployment mode cannot serve.

application/problem+json

object

type

required

string

/^urn:bpm:error:/

title

required

string

status

required

integer

>= 400 <= 599

detail

required

string

instance

required

The request path.

string

mode

Present only on mode-not-supported. It names the engine’s mode.

string

Example

{
  "type": "urn:bpm:error:mode-not-supported",
  "title": "Mode Not Supported",
  "status": 501,
  "detail": "GET /v1/audit-log/integrity is not supported in embedded mode",
  "instance": "/v1/audit-log/integrity",
  "mode": "embedded"
}

503

Backpressure or dependency unavailable

application/problem+json

object

type

required

string

/^urn:bpm:error:/

title

required

string

status

required

integer

>= 400 <= 599

detail

required

string

instance

required

The request path.

string

mode

Present only on mode-not-supported. It names the engine’s mode.

string

Example

{
  "type": "urn:bpm:error:unavailable",
  "title": "Service Unavailable",
  "status": 503,
  "detail": "The required engine service is not ready",
  "instance": "/v1/audit-log/integrity"
}