Verify the hash chain
Requires audit:read. Recomputes the chain over a range without
exporting it, covering at most 100,000 records. Each record is an HMAC
over the whole record and its predecessor’s hash, so editing any field
of any record breaks every link after it.
gaps are distinguished from broken_links deliberately. A filtered
query legitimately produces gaps, and so does an authorised purge; a
broken link is the finding that matters. Purge windows are consulted, so
a gap explained by a recorded purge is listed under
explained_by_purge rather than reported as tampering.
Chains are maintained per node, so verifying one instance_id at a time
is the normal way to use this.
This endpoint accepts every filter the query endpoint accepts. The ones
below are the ones worth using; page and per_page are accepted and
ignored.
Authorizations
A machine credential, qk_ followed by its secret. Only a hash of the
secret is stored, so a key is displayed exactly once, when it is created
or rotated. A key reaches only the configurations it is linked to.
It may also be sent as Authorization: Bearer qk_..., which is
recognised by the prefix.
Query Parameters
Only records at or after this instant.
Only records at or before this instant.
Only records written by this cluster node. Hash chains are maintained per node, so this is the natural unit for chain verification.
"node-01"
An exact action, or a kms.* style prefix that matches a whole
namespace.
"encryption.encrypt"
"kms.*"
Only records attributed to this principal: a user id or an API key id.
Only records attributed to this configuration.
Response
The chain verified over the range examined.
False when any link is broken, or when a gap is not accounted for by a recorded purge and the filters do not explain it.
Records examined.
The finding that matters: the id of each record whose hash does not follow from its predecessor, which means it was edited after it was written.
The id of each record whose predecessor is missing. Expected whenever the query is filtered, and expected after an authorised purge, so this is reported separately from a broken link rather than raised as tampering.
The subset of gaps that a recorded purge accounts for. Those
records live on in the export that the purge produced.
Whether the filters themselves narrow the range, in which case gaps carry no information.