AUDIT

List tenant audit entries

GET/v1/audit-log

See the request and response contract below.

Backend integrationYour backend and SDK use a tenant API key.

Try itAvailable for creating, reading, and deleting verification sessions in Test. Other operations are reference-only; API-key protected routes require a tenant API key on your backend. Open a session request

Parameters

Parameters for GET /v1/audit-log
Name	Location	Required	Schema	Description
`limit`	query	No	`integer`	—
`cursor`	query	No	`string`	—

Responses

Response 200

JSON response

application/json · Response schema

entriesarray<object>optional

Nested fields

session_idstringoptional

statusstringoptional

credential_typesarray<string>optional

issuer_idsarray<string>optional

error_codestringoptional

declaredarray<string>optional

requestedarray<string>optional

scaobjectoptional

Present on a verified EUDI TS 12 SCA presentation. Contains transaction hashes, authentication codes, signed authorization issue times and factor names; never claim values.

Nested fields

transaction_typesarray<string>optional

transaction_data_hashesarray<string>optional

base64url SHA-256 of each encoded transaction_data value, as signed in the Key Binding JWT.

authentication_codesarray<string>optional

Key Binding JWT jti values.

authorization_issued_atarray<integer>optional

Signed Key Binding JWT iat values, as Unix timestamps in seconds.

factorsarray<string>optional

Asserted factors as category:method.

authorization_policiesarray<object>optional

Effective TS12 policy applied to each wallet authorization and its bound transaction types.

Nested fields

authentication_codestringoptional

transaction_typesarray<string>optional

effective_policyobjectoptional

Optional session-wide rules for TS12 Key Binding JWT authentication factors and authorization freshness. Applies to every TS12 transaction in the session. Each transaction may also define a stricter sca_policy scoped to its credential. Conflicting policies are rejected before session creation. The built-in check (two distinct factor categories, TS12 methods only) always applies; policies only narrow it. A presentation that does not meet its effective policy fails with failure_category SCA_POLICY_NOT_MET.

Nested fields

max_authorization_age_secondsintegeroptional: Optional maximum age for the signed Key Binding JWT iat, in seconds. Values range from 1 to 86,400; omitted means no additional age limit.
required_factorsarray<string>optional: Factor categories that must each be present.
allowed_methodsobjectoptional: Per-category allow-list of TS12 methods. A category without a list accepts every TS12 method.
allow_other_methodsbooleanoptional: When false, the unspecified "other" method is rejected in every category.

View JSON schema

{
  "type": "object",
  "description": "Optional session-wide rules for TS12 Key Binding JWT authentication factors and authorization freshness. Applies to every TS12 transaction in the session. Each transaction may also define a stricter sca_policy scoped to its credential. Conflicting policies are rejected before session creation. The built-in check (two distinct factor categories, TS12 methods only) always applies; policies only narrow it. A presentation that does not meet its effective policy fails with failure_category SCA_POLICY_NOT_MET.",
  "properties": {
    "max_authorization_age_seconds": {
      "type": "integer",
      "minimum": 1,
      "maximum": 86400,
      "description": "Optional maximum age for the signed Key Binding JWT iat, in seconds. Values range from 1 to 86,400; omitted means no additional age limit."
    },
    "required_factors": {
      "type": "array",
      "minItems": 1,
      "maxItems": 3,
      "uniqueItems": true,
      "items": {
        "type": "string",
        "enum": [
          "knowledge",
          "possession",
          "inherence"
        ]
      },
      "description": "Factor categories that must each be present."
    },
    "allowed_methods": {
      "type": "object",
      "description": "Per-category allow-list of TS12 methods. A category without a list accepts every TS12 method.",
      "properties": {
        "knowledge": {
          "type": "array",
          "minItems": 1,
          "uniqueItems": true,
          "items": {
            "type": "string",
            "enum": [
              "pin_less_than_6_digits",
              "pin_6_or_more_digits",
              "passphrase_less_than_8_chars",
              "passphrase_8_to_11_chars",
              "passphrase_12_or_more_chars",
              "pattern",
              "other"
            ]
          }
        },
        "possession": {
          "type": "array",
          "minItems": 1,
          "uniqueItems": true,
          "items": {
            "type": "string",
            "enum": [
              "key_in_remote_wscd",
              "key_in_local_external_wscd",
              "key_in_local_internal_wscd",
              "key_in_local_native_wscd",
              "other"
            ]
          }
        },
        "inherence": {
          "type": "array",
          "minItems": 1,
          "uniqueItems": true,
          "items": {
            "type": "string",
            "enum": [
              "fingerprint_device",
              "fingerprint_external",
              "face_device",
              "face_external",
              "other"
            ]
          }
        }
      },
      "additionalProperties": false
    },
    "allow_other_methods": {
      "type": "boolean",
      "default": true,
      "description": "When false, the unspecified \"other\" method is rejected in every category."
    }
  },
  "additionalProperties": false
}

View JSON schema

{
  "type": "object",
  "properties": {
    "authentication_code": {
      "type": "string"
    },
    "transaction_types": {
      "type": "array",
      "items": {
        "type": "string"
      }
    },
    "effective_policy": {
      "$ref": "#/components/schemas/ScaPolicy"
    }
  }
}

effective_policyobjectoptional

Effective factor constraints on a verified SCA presentation, including the built-in two-category minimum. Absent on historical entries created before this evidence was recorded.

Nested fields

minimum_distinct_factorsintegeroptional
required_factorsarray<string>optional
allowed_methodsobjectoptional
allow_other_methodsbooleanoptional
max_authorization_age_secondsintegeroptional: Maximum accepted age of the signed Key Binding JWT iat, if configured.

View JSON schema

{
  "type": "object",
  "description": "Effective factor constraints on a verified SCA presentation, including the built-in two-category minimum. Absent on historical entries created before this evidence was recorded.",
  "properties": {
    "minimum_distinct_factors": {
      "type": "integer"
    },
    "required_factors": {
      "type": "array",
      "items": {
        "type": "string"
      }
    },
    "allowed_methods": {
      "type": "object",
      "additionalProperties": {
        "type": "array",
        "items": {
          "type": "string"
        }
      }
    },
    "allow_other_methods": {
      "type": "boolean"
    },
    "max_authorization_age_seconds": {
      "type": "integer",
      "description": "Maximum accepted age of the signed Key Binding JWT iat, if configured."
    }
  }
}

View JSON schema

{
  "type": "object",
  "description": "Present on a verified EUDI TS 12 SCA presentation. Contains transaction hashes, authentication codes, signed authorization issue times and factor names; never claim values.",
  "properties": {
    "transaction_types": {
      "type": "array",
      "items": {
        "type": "string"
      }
    },
    "transaction_data_hashes": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "base64url SHA-256 of each encoded transaction_data value, as signed in the Key Binding JWT."
    },
    "authentication_codes": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Key Binding JWT jti values."
    },
    "authorization_issued_at": {
      "type": "array",
      "items": {
        "type": "integer"
      },
      "description": "Signed Key Binding JWT iat values, as Unix timestamps in seconds."
    },
    "factors": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Asserted factors as category:method."
    },
    "authorization_policies": {
      "type": "array",
      "description": "Effective TS12 policy applied to each wallet authorization and its bound transaction types.",
      "items": {
        "type": "object",
        "properties": {
          "authentication_code": {
            "type": "string"
          },
          "transaction_types": {
            "type": "array",
            "items": {
              "type": "string"
            }
          },
          "effective_policy": {
            "$ref": "#/components/schemas/ScaPolicy"
          }
        }
      }
    },
    "effective_policy": {
      "type": "object",
      "description": "Effective factor constraints on a verified SCA presentation, including the built-in two-category minimum. Absent on historical entries created before this evidence was recorded.",
      "properties": {
        "minimum_distinct_factors": {
          "type": "integer"
        },
        "required_factors": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "allowed_methods": {
          "type": "object",
          "additionalProperties": {
            "type": "array",
            "items": {
              "type": "string"
            }
          }
        },
        "allow_other_methods": {
          "type": "boolean"
        },
        "max_authorization_age_seconds": {
          "type": "integer",
          "description": "Maximum accepted age of the signed Key Binding JWT iat, if configured."
        }
      }
    }
  }
}

qes_approvalsarray<object>optional

Present on a verified presentation that carried a CSC QES approval. The signed approval digest and counts only; never document contents or claim values.

Nested fields

bindingstringoptional: Allowed valueskey_binding_jwtdevice_signed
hash_algorithm_oidstringoptional
valuestringoptional: Base64 approval digest the wallet signed.
document_countintegeroptional
num_signaturesintegeroptional

View JSON schema

{
  "type": "object",
  "properties": {
    "binding": {
      "type": "string",
      "enum": [
        "key_binding_jwt",
        "device_signed"
      ]
    },
    "hash_algorithm_oid": {
      "type": "string"
    },
    "value": {
      "type": "string",
      "description": "Base64 approval digest the wallet signed."
    },
    "document_count": {
      "type": "integer"
    },
    "num_signatures": {
      "type": "integer"
    }
  }
}

latency_msintegeroptional

occurred_atstringoptional

prev_hashstringoptional

entry_hashstringoptional

chain_intactbooleanoptional

View JSON schema

{
  "type": "object",
  "description": "On a refusal outside the selected intended use, declared and requested describe the recorded attribute sets; they are not present on every audit event and have not yet been confirmed through a live-key response.",
  "properties": {
    "session_id": {
      "type": "string"
    },
    "status": {
      "type": "string"
    },
    "credential_types": {
      "type": "array",
      "items": {
        "type": "string"
      }
    },
    "issuer_ids": {
      "type": "array",
      "items": {
        "type": "string"
      }
    },
    "error_code": {
      "type": "string"
    },
    "declared": {
      "type": "array",
      "items": {
        "type": "string"
      }
    },
    "requested": {
      "type": "array",
      "items": {
        "type": "string"
      }
    },
    "sca": {
      "type": "object",
      "description": "Present on a verified EUDI TS 12 SCA presentation. Contains transaction hashes, authentication codes, signed authorization issue times and factor names; never claim values.",
      "properties": {
        "transaction_types": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "transaction_data_hashes": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "base64url SHA-256 of each encoded transaction_data value, as signed in the Key Binding JWT."
        },
        "authentication_codes": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Key Binding JWT jti values."
        },
        "authorization_issued_at": {
          "type": "array",
          "items": {
            "type": "integer"
          },
          "description": "Signed Key Binding JWT iat values, as Unix timestamps in seconds."
        },
        "factors": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Asserted factors as category:method."
        },
        "authorization_policies": {
          "type": "array",
          "description": "Effective TS12 policy applied to each wallet authorization and its bound transaction types.",
          "items": {
            "type": "object",
            "properties": {
              "authentication_code": {
                "type": "string"
              },
              "transaction_types": {
                "type": "array",
                "items": {
                  "type": "string"
                }
              },
              "effective_policy": {
                "$ref": "#/components/schemas/ScaPolicy"
              }
            }
          }
        },
        "effective_policy": {
          "type": "object",
          "description": "Effective factor constraints on a verified SCA presentation, including the built-in two-category minimum. Absent on historical entries created before this evidence was recorded.",
          "properties": {
            "minimum_distinct_factors": {
              "type": "integer"
            },
            "required_factors": {
              "type": "array",
              "items": {
                "type": "string"
              }
            },
            "allowed_methods": {
              "type": "object",
              "additionalProperties": {
                "type": "array",
                "items": {
                  "type": "string"
                }
              }
            },
            "allow_other_methods": {
              "type": "boolean"
            },
            "max_authorization_age_seconds": {
              "type": "integer",
              "description": "Maximum accepted age of the signed Key Binding JWT iat, if configured."
            }
          }
        }
      }
    },
    "qes_approvals": {
      "type": "array",
      "description": "Present on a verified presentation that carried a CSC QES approval. The signed approval digest and counts only; never document contents or claim values.",
      "items": {
        "type": "object",
        "properties": {
          "binding": {
            "type": "string",
            "enum": [
              "key_binding_jwt",
              "device_signed"
            ]
          },
          "hash_algorithm_oid": {
            "type": "string"
          },
          "value": {
            "type": "string",
            "description": "Base64 approval digest the wallet signed."
          },
          "document_count": {
            "type": "integer"
          },
          "num_signatures": {
            "type": "integer"
          }
        }
      }
    },
    "latency_ms": {
      "type": "integer"
    },
    "occurred_at": {
      "type": "string"
    },
    "prev_hash": {
      "type": "string"
    },
    "entry_hash": {
      "type": "string"
    },
    "chain_intact": {
      "type": "boolean"
    }
  }
}

has_morebooleanoptional

next_cursorstring,nulloptional

View JSON schema

{
  "type": "object",
  "properties": {
    "entries": {
      "type": "array",
      "items": {
        "$ref": "#/components/schemas/AuditEntry"
      }
    },
    "has_more": {
      "type": "boolean"
    },
    "next_cursor": {
      "type": [
        "string",
        "null"
      ]
    }
  }
}

Response 400

Invalid pagination cursor

application/json · Response schema

errorstringrequired
messagestringrequired

View JSON schema

{
  "type": "object",
  "required": [
    "error",
    "message"
  ],
  "properties": {
    "error": {
      "type": "string"
    },
    "message": {
      "type": "string"
    }
  }
}

Response 401

Error response

application/json · Response schema

errorstringrequired
messagestringrequired

View JSON schema

{
  "type": "object",
  "required": [
    "error",
    "message"
  ],
  "properties": {
    "error": {
      "type": "string"
    },
    "message": {
      "type": "string"
    }
  }
}

Response 403

Error response

application/json · Response schema

errorstringrequired
messagestringrequired

View JSON schema

{
  "type": "object",
  "required": [
    "error",
    "message"
  ],
  "properties": {
    "error": {
      "type": "string"
    },
    "message": {
      "type": "string"
    }
  }
}

← All public operations