Export the tamper-evident hash-chained audit ledger
Returns the caller's audit-log rows in ascending chainSeq order — each row carrying a prevHash and rowHash that link it to the one before — together with an EdDSA-signed manifest committing to the window bounds, rowCount, and head rowHash.
Returns the caller's audit-log rows in ascending chainSeq order — each row carrying a prevHash and rowHash that link it to the one before — together with an EdDSA-signed manifest committing to the window bounds, rowCount, and head rowHash. An auditor verifies the manifest against Dairo's published JWKS, then re-derives every rowHash from the rows and confirms the head, detecting any inserted, deleted, or edited row without trusting the response. With neither from nor to set the export defaults to the last 30 days rather than the full history, to avoid accidental over-disclosure; supplying either bound (both are inclusive RFC3339 timestamps on each row's time) requests an explicit, full-history-capable window. A single page holds at most 1000 rows: when more remain, pagination.nextCursor returns this page's head chainSeq — pass it back as ?after=<cursor> to drain the next page, and each page's manifest independently commits to that page's exact window. format is reserved (only JSON is emitted today), and the endpoint is rate-limited to 10 requests per minute per user. The manifest is always signed — if Dairo cannot sign it the call fails with a 500 instead of returning an unsigned export. Requires the account:read scope; a key restricted to specific inboxes is refused with a 403, because the trail spans every inbox.
Scope: account:read. Send the API key as a bearer token; Scopes lists what each one reaches.
Request
Query parameters
| Name | Type | Required | Description |
|---|---|---|---|
from | string (date-time) | no | Lower bound (inclusive) RFC3339 timestamp on created_at. |
to | string (date-time) | no | Upper bound (inclusive) RFC3339 timestamp on created_at. |
after | integer (int64) | no | Keyset cursor: the prior page's pagination.nextCursor (a chainSeq). Returns rows with a strictly greater chainSeq, draining history past the 5000-row page cap. |
format | "json", "ndjson" | no | Reserved; only the JSON form is emitted in V1 (NDJSON streaming is a fast-follow). |
Response
200 Success. Body: application/json, AuditExportResponse.
| Field | Type | Required | Description |
|---|---|---|---|
rows | array of AuditExportRow | yes | |
manifest | AuditExportManifest | yes | |
pagination | object | no | Keyset pagination for draining history past the 5000-row page cap. |
Errors
Every error has the same body, {"error": {"type", "code", "message", "param"}}; branch on code. Errors lists every code.
| Status | Meaning |
|---|---|
400 | The request is malformed or a value is invalid (invalid_request, invalid_domain, idempotency_key_mismatch). |
401 | The API key is missing or invalid. |
403 | The key lacks the scope this endpoint needs (scope_missing) or may not do this (not_permitted). |
404 | No such resource in this account (resource_not_found). |
422 | The request is well-formed but a field failed validation (validation_failed). |
429 | Rate limit, plan limit, budget or spend cap reached (rate_limited, plan_limit_reached, budget_exceeded, spend_cap_reached). |
500 | An unexpected error; retry with backoff, then contact support (internal_error). |
Get the machine-checkable residency assertion
Returns Dairo's data-residency posture as a machine-checkable JSON object your compliance automation can assert on in CI.
List erasure jobs
Lists the erasure jobs in your active organization, newest first (ordered by createdAt descending), each with its current status, deletion tallies, and — once completed — its signed certificate.