Skip to content
GitmoapAPIBeta
Organizeaudit
GET/admin/audit-log/verify

Verify any audit trail's chain integrity

verify_admin_audit_log

For platform administrators only. Recomputes the hash chain of one audit trail — the platform's own unless scope names another — over a range of months, by default the twelve months before the current one through the current one, and says whether it is intact and, if not, where it breaks.

Parameters

Query
  • scopestringoptionalThe audit trail to verify: PLATFORM (the default), ROOT# followed by an organization's top-level group id, or USER# followed by a user id
  • from_monthstringoptionalFirst month to check (YYYY-MM; default 12 months before to_month)
  • to_monthstringoptionalLast month to check (YYYY-MM; default the current month)

Responses

200Chain verification resultapplication/json
  • checked_countinteger · int640–∞
  • scopestring
  • verifiedboolean
  • broken_at_seqinteger · int64 or nulloptional0–∞
  • failure_reasonChainFailureReasonhash_mismatchprev_hash_mismatchseq_gapmonth_link_mismatchor nulloptionalWhy a chain failed verification.
  • first_seqinteger · int64 or nulloptional0–∞
  • last_seqinteger · int64 or nulloptional0–∞
200 exampleSynthesized example
{
"checked_count": 0,
"scope": "scope-1d6d",
"verified": false,
"broken_at_seq": 59,
"failure_reason": "hash_mismatch",
"first_seq": 79,
"last_seq": 53
}
401Unauthenticated — no credential, or an invalid oneapplication/json
Error codes
  • UNAUTHORIZEDNo credential was sent, or the one sent is invalid, expired or revoked
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
401 exampleSynthesized example
{
"error": {
"code": "code-b7cc",
"message": "Inline scalar newtypes but keep their brand"
}
}
403Not a platform administratorapplication/json
Error codes
  • FORBIDDENYou are signed in but may not do this here; reason names the permission or the rule that refused it
  • INSUFFICIENT_SCOPEThe access token lacks the scope this operation needs; required_scope names it
  • PERMISSION_REQUIREDYou need a permission you do not hold here; the message names it
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
403 exampleSynthesized example
{
"error": {
"code": "code-7cdf",
"message": "Pin a page's payload to the build that rendered it"
}
}
501The audit log is not configured on this deploymentapplication/json
Error codes
  • NOT_IMPLEMENTEDThis deployment has not configured the feature the operation needs; the message names it
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
501 exampleSynthesized example
{
"error": {
"code": "code-ae16",
"message": "Label every synthesized example"
}
}

CLI

gitmoap audit verify-admin-audit-log

  • --from-monthstringoptionalFirst month to check (YYYY-MM; default 12 months before `to_month`)
  • --scopestringoptionalThe audit trail to verify: `PLATFORM` (the default), `ROOT#` followed by an organization's top-level group id, or `USER#` followed by a user id
  • --to-monthstringoptionalLast month to check (YYYY-MM; default the current month)

Used in these guides