Verify the hash chain
Recomputes the chain over a range without exporting it. Each record is an HMAC over the whole record and its predecessor’s hash, so editing any field of any record breaks every link after it.
gaps are distinguished from broken_links deliberately. A filtered
query legitimately produces gaps, and so does an authorised purge; a
broken link is the finding that matters. Purge windows are consulted, so
a gap explained by a recorded purge is reported as such rather than as
tampering.
Authorizations
A machine credential, qk_ followed by its secret. The first twelve
characters are an indexed prefix; the rest is compared in constant time
against a stored SHA-256 hash. A key reaches only the configurations it is
linked to.
It may also be sent as Authorization: Bearer qk_..., which is
recognised by the prefix.
Query Parameters
Chains are per node, so verifying one node at a time is normal.
Response
The verification summary.
Records examined.
The finding that matters: a record whose hash does not follow from its predecessor, which means the row was edited after it was written.
A missing predecessor. Expected whenever the query is filtered, and expected after an authorised purge, so this is reported separately from a broken link rather than raised as tampering.
Whether the filters themselves narrow the range.