Audit API

Ask the system that made the decision.

These paths read the product record: who, which file, which version, allowed or refused. They do not rewrite it. Usage dashboards live elsewhere so nobody “groups the evidence” to draw a chart.

Scope audit or organisation. Recipients never call this. A channel token that creates tenants is refused here.

Paths

	Path	What it is for
GET	`/v1/audit/events`	Search. Filter by actor, object, action, outcome, time.
GET	`/v1/audit/actors`	Who appears in the record — staff, machine, recipient.
GET	`/v1/audit/event-actions`	The verbs you can filter on, so clients do not guess strings.
POST	`/v1/audit/chain/verify`	Confirm the record has not been edited. You can run this yourself.
	`/v1/audit/checkpoints`	Periodic seals on the chain.
	`/v1/audit/investigations`	A working folder of pinned events. Not yet evidence you hand over.
	`/v1/audit/evidence-exports`	Ask for a sealed package. Download when it is ready. Verify offline.
GET	`/v1/reports`	Usage facts. Different scope (`reports`). Do not treat this as evidence.

Explorer results are a candidate set. An investigation is your selection. An evidence export is a signed artefact with a defined range. Mixing those three jobs in one call is how products accidentally ship a screenshot. Casewelt keeps them apart.

GET Search events

/v1/audit/events

GET /v1/audit/events?file_id=…&outcome=ALLOW
Authorization: Bearer …

POST Pin an investigation

/v1/audit/investigations

{
  "title": "Board pack — who saw v3",
  "event_ids": ["…"]
}

POST Ask for a sealed package

/v1/audit/evidence-exports

{
  "investigation_id": "…",
  "from": "2026-08-01",
  "to": "2026-08-31"
}

POST Verify the chain

/v1/audit/chain/verify

You run this. There is no edit endpoint for an old event. Bytes for an opened file still travel through Casewelt transfer, and only if you are allowed them. Events stay inside the organisation boundary.

POST /v1/audit/chain/verify
Authorization: Bearer …

In a walkthrough

Run the same search in the console and on GET /v1/audit/events. Same events, same outcomes.
Call POST /v1/audit/chain/verify and read the result yourself — not a green badge.
Ask for an evidence export, then open the package with the product closed.

Start with a question

Bring “who opened version 3?” and watch the query.

Then pin it, export it, and open the package with the product closed.

Request a demo