Verify the audit hash chain

GET 
/audit-events/verify

Walks the append-only hash chain and reports the head sequence, head hash, and any tamper location detected. A truthy ok field indicates chain integrity. Requires the audit:read permission.

Request

Responses

200

Chain verification report — ok, checkedFromSeq, totalHead, headHash, and problem details when applicable.

401

Missing or invalid access token.

403

Caller lacks the required permission.

422

The request is syntactically valid but violates a business invariant — a referral state transition not permitted from the current status, a wallet withdrawal exceeding the available balance, or a POP being confirmed before it has been ZFA-verified. error.code is one of INVALID_TRANSITION, INVARIANT_VIOLATION, or a domain-specific value; error.message explains the invariant.

429

Rate limit exceeded. Global default is 120 requests/minute per IP; auth-flow, OTP, self-registration, WebAuthn, IRA lookup, and public-lead endpoints carry tighter per-endpoint limits. Retry after the delay indicated by the Retry-After header.

Response Headers

Retry-After

Seconds to wait before retrying.

500

Unhandled server error. The response carries a meta.requestId correlator you can hand to platform operations to trace the failure through structured logs and the hash-chained audit trail. Retry with the same Idempotency-Key header if the endpoint accepts idempotency.