Audit Trail Verify in the Public API and Generated Reference Pages

Audit Trail verify for API tokens

Plans: Plans that include the Audit Trail (The Growth and above) Where: API Tokens; GET /api/v1/audit-trail/verify Who benefits: CTOs, IT managers and auditors who want to check the integrity of the Audit Trail from a script instead of the console.

API tokens can now run the Audit Trail hash chain check. It needs the new scope audit_log:verify, which only an Owner can grant (longest expiry 180 days). The scope allows the integrity check and nothing else, and it is part of the Read everything preset.

For tokens the result is cached for 60 seconds per organisation, so read verifiedAt to see how fresh it is. The token response leaves out approver identities, hashes and free-text references.

How to use it

1. As an Owner, click the user menu, then API Tokens and Create Token. Tick audit_log:verify, choose an expiry of 180 days or less and click Create Token.
2. Call GET /api/v1/audit-trail/verify with Authorization: Bearer <token>. See Verify the audit trail hash chain.
3. Auditors: read Audit Trail Integrity and Accepted Link Breaks for what the token result contains.

REST pages are now generated reference pages

The hand-written pages for the Supply Chain, Onboarding, Off-boarding, Supplier Questionnaires and Audit Trail Verify APIs are gone. Every operation now has a generated reference page under API reference that always matches the live API. The old page addresses redirect to the new pages, so existing bookmarks and links keep working. The guides, such as Upload an SBOM from CI, link to the operation pages instead of repeating them.