Rensei docs
API ReferenceAudit

Account-free signed audit-entry verification sample.

Fully unauthenticated worked example for independently verifying a signed audit entry. The response includes the signed entry, canonicalization material, Ed25519 verification data, JWKS discovery URL, and public catalog URL.

GET
/.well-known/audit-sample

Response Body

Static signed audit entry and offline verification material.

application/json
  1. response
$schema_version*string
name*string
description*string
provenance*string
workspace_id*string
jwks_url*string
catalog_url*string
Formaturi
entry*
verification*
verification_steps*array<string>
verify_command*string
notes*array<string>
Example Request
curl -X GET 'https://app.rensei.ai/.well-known/audit-sample'
Example Response
{  "$schema_version": "1.0",  "name": "string",  "description": "string",  "provenance": "string",  "workspace_id": "string",  "jwks_url": "string",  "catalog_url": "http://example.com",  "entry": {    "workspace_id": "string",    "sequence_number": -9007199254740991,    "event_type": "string",    "actor_id": "string",    "occurred_at": "2019-08-24T14:15:22Z",    "prev_hash": "string",    "payload": {      "action": "string",      "reason": "string",      "context": {        "same_org": true,        "environment": "string",        "workspace_id": "string",        "project_match": true,        "correlation_id": "string"      },      "decision": "string",      "matchedPolicies": [        "string"      ],      "evaluationTimeUs": -9007199254740991    }  },  "verification": {    "algorithm": "Ed25519",    "signed_payload": "sha256(canonical(entry))",    "entry_canonicalization": "string",    "signing_key_id": "string",    "canonical_preimage": "string",    "entry_hash": "string",    "signature": "string",    "public_key_base64": "string",    "public_key_base64url": "string",    "jwks_url": "string"  },  "verification_steps": [    "string"  ],  "verify_command": "string",  "notes": [    "string"  ]}

Per-workspace JWKS for audit signature verification.

Fully unauthenticated RFC 7517 JWKS endpoint. Returns active and revoked Ed25519 keys so third parties can verify historical audit signatures without a Rensei account. Unknown workspaces return `200 {"keys":[]}` to avoid revealing workspace existence. Both `/{workspace_id}` and `/{workspace_id}.json` are accepted.

List tamper-evident audit events

Returns hash-chain audit events for the authenticated org. Events include a `prevHash` / `entryHash` linkage for integrity verification. Accepts optional filters by `entityId` and/or `entityType`.