> ## Documentation Index
> Fetch the complete documentation index at: https://docs.trulayer.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Verifying the audit-log chain

> Cross-check TruLayer's tamper-evident audit log against the Ed25519-signed daily manifest.

TruLayer writes a daily head-hash anchor for every tenant's audit log. The manifest itself is stored in S3 Object Lock (WORM) and signed with an Ed25519 key; `GET /v1/audit/verify` returns a Postgres mirror of that anchor so third-party auditors can cross-check without pulling the S3 artifact on every query.

## Endpoint — `GET /v1/audit/verify`

Unauthenticated by design — anchors are public evidence.

```bash theme={null}
curl -G https://api.trulayer.ai/v1/audit/verify \
  --data-urlencode "tenant_id=$TENANT_ID" \
  --data-urlencode "date=2026-04-23"
```

Response:

```json theme={null}
{
  "tenant_id": "1f3b...",
  "date": "2026-04-23",
  "head_hash": "a7c4...",
  "manifest_url": "https://s3.amazonaws.com/trulayer-audit-anchors/1f3b/2026-04-23.json",
  "signature": "base64(ed25519-signature)",
  "public_key": "base64(ed25519-pubkey)"
}
```

## Supplying an expected hash

Pass `expected_head_hash=<hex>` to receive a `hash_matches: bool` field alongside the anchor — saves a round-trip in automated checks.

```bash theme={null}
curl -G https://api.trulayer.ai/v1/audit/verify \
  --data-urlencode "tenant_id=$TENANT_ID" \
  --data-urlencode "date=2026-04-23" \
  --data-urlencode "expected_head_hash=a7c4..."
```

## Verification recipe

1. Fetch the anchor for a day.
2. Download the S3 manifest at `manifest_url`.
3. Verify the Ed25519 signature over the manifest JSON using the published `public_key`.
4. Compute the Merkle head of your local copy of the audit log for that day and compare against `head_hash`.

Any mismatch indicates tampering — either of the local log or of the mirror. Because the manifest is WORM, TruLayer cannot alter it after the fact.

## See also

* [Audit log](/dashboard/settings-audit-log)
* [API reference — verifyAuditAnchor](/api-reference/introduction)