Account-free signed audit-entry verification sample.
Fully unauthenticated worked example for independently verifying a signed audit entry. The response includes the signed entry, canonicalization material, Ed25519 verification data, JWKS discovery URL, and public catalog URL.
Response Body
application/json
curl -X GET "https://example.com/.well-known/audit-sample"{
"$schema_version": "1.0",
"name": "string",
"description": "string",
"provenance": "string",
"workspace_id": "string",
"jwks_url": "string",
"catalog_url": "http://example.com",
"entry": {
"workspace_id": "string",
"sequence_number": -9007199254740991,
"event_type": "string",
"actor_id": "string",
"occurred_at": "2019-08-24T14:15:22Z",
"prev_hash": "string",
"payload": {
"action": "string",
"reason": "string",
"context": {
"same_org": true,
"environment": "string",
"workspace_id": "string",
"project_match": true,
"correlation_id": "string"
},
"decision": "string",
"matchedPolicies": [
"string"
],
"evaluationTimeUs": -9007199254740991
}
},
"verification": {
"algorithm": "Ed25519",
"signed_payload": "sha256(canonical(entry))",
"entry_canonicalization": "string",
"signing_key_id": "string",
"canonical_preimage": "string",
"entry_hash": "string",
"signature": "string",
"public_key_base64": "string",
"public_key_base64url": "string",
"jwks_url": "string"
},
"verification_steps": [
"string"
],
"verify_command": "string",
"notes": [
"string"
]
}Per-workspace JWKS for audit signature verification.
Fully unauthenticated RFC 7517 JWKS endpoint. Returns active and revoked Ed25519 keys so third parties can verify historical audit signatures without a Rensei account. Unknown workspaces return `200 {"keys":[]}` to avoid revealing workspace existence. Both `/{workspace_id}` and `/{workspace_id}.json` are accepted.
List tamper-evident audit events
Returns hash-chain audit events for the authenticated org. Events include a `prevHash` / `entryHash` linkage for integrity verification. Accepts optional filters by `entityId` and/or `entityType`.