Audit API#

Every state-changing runtime operation appends to a per-tenant, SHA-256 hash-chained audit log as a side effect — you do not opt in. Each entry stores the hash of the previous entry, so any later tampering breaks the chain and is detectable. This API lets you query that chain, verify its integrity, and export a signed evidence bundle for a single intent.

Each tenant has its own hash chain and its own signing key. Audit entries never cross the tenant boundary, and evidence is signed with the tenant's own secret.

What the chain stores#

The audit-grade substrate is the AuditEntry record: { id, tenantId, correlationId, intentId, actorId, actorType, eventType, payload, previousHash, entryHash, createdAt }, unique on (tenantId, entryHash). The entryHash is a SHA-256 over the canonical, key-sorted JSON of the entry, and previousHash links to the prior entry's hash (the chain head's previousHash is null). Appends run inside a serializable transaction. There are 40+ eventTypes — INTENT_RECEIVED, AUTHORITY_DECISION, TOKEN_ISSUED, EXECUTION_ATTEMPTED, EXECUTION_RESULT, ESCALATION_EVENT, and so on.

Query Tenant Audit Events#

curl "https://api.intended.so/tenants/tenant_acme_prod/audit?eventType=TOKEN_ISSUED&limit=50" \
  -H "Authorization: Bearer $INTENDED_API_KEY" \
  -H "x-tenant-id: tenant_acme_prod"

Response: { tenantId, total, limit, offset, events: [...] }. Each event carries its eventType, payload, correlationId, entryHash, previousHash, and createdAt.

Verify Chain Integrity#

curl "https://api.intended.so/tenants/tenant_acme_prod/audit/chain-verification" \
  -H "Authorization: Bearer $INTENDED_API_KEY" \
  -H "x-tenant-id: tenant_acme_prod"

Response:

{ "valid": true, "totalEntries": 1284 }

If the chain is broken, valid is false and brokenAt is the index of the first failing entry:

{ "valid": false, "brokenAt": 512, "totalEntries": 1284 }

Generate an Evidence Bundle#

curl "https://api.intended.so/tenants/tenant_acme_prod/intents/8aa3f5f6-b1a9-4c5b-a29f-b489f7d0be58/evidence" \
  -H "Authorization: Bearer $INTENDED_API_KEY" \
  -H "x-tenant-id: tenant_acme_prod"

Response (EvidenceBundle):

{
  "intentId": "8aa3f5f6-b1a9-4c5b-a29f-b489f7d0be58",
  "tenantId": "tenant_acme_prod",
  "correlationId": "a9d903e0-8b45-4a2f-9d30-6f9ce7d04d78",
  "generatedAt": "2026-06-06T12:00:05.000Z",
  "eventCount": 6,
  "events": [ /* the intent's audit entries */ ],
  "integrityHash": "sha256:…",
  "signature": "hmac-sha256:…",
  "chainValid": true
}

Get a Decision Receipt#

A receipt carries the outcome, the risk score, the decision time, this intent's audit entries as a hash-linked chain, the authority token (on ALLOW only), the tenant's public keys, a provenance object, and a receiptHash over all of it.

provenance records which classifier and which rule-set version made the decision:

"provenance": {
  "classifierBackend": "rules",
  "classifierVersion": "oi-2.1+lib-3f9a0c1b2d4e+ie-0.2.0",
  "knowledgePackVersionId": "6f0d2c1e-…",
  "policyVersion": "2b7c9e40-…@v3",
  "policyHash": "9c1f…e07a"
}

Any SDK from 0.6.0 on verifies receipts that carry rulesetVersion and rulesetHash, because the check compares the whole provenance object with the sealed copy.

A field is null when it was not recorded. Receipts for decisions made before provenance was recorded have no provenance object.

The provenance is also sealed as the last entry of the receipt's chain (id: "decision-provenance"), so receiptHash covers it. Check a receipt with the SDK (Node.js):

npx -p @intended-inc/sdk intended-verify-receipt receipt.json

intent      8aa3f5f6-b1a9-4c5b-a29f-b489f7d0be58
tenant      tenant_acme_prod
outcome     DENY
audit chain 3 entries + sealed provenance
token       none
classifier  rules (oi-2.1+lib-3f9a0c1b2d4e+ie-0.2.0)
knowledge   6f0d2c1e-…
rule set    2b7c9e40-…@v3
rule hash   9c1f…e07a
checked as of 2026-06-06T12:00:05.000Z (decision time)
✓ VALID — verified offline, no call to Intended

In code, verifyReceipt from @intended-inc/sdk/receipt checks the receipt and readReceiptProvenance returns the sealed provenance. Verification fails with RECEIPT_TAMPERED or RECEIPT_CHAIN_BROKEN if the sealed provenance was changed, and with RECEIPT_PROVENANCE_MISMATCH if the top-level provenance object does not match the sealed copy.

Run-Stream Endpoints#

The runtime also keeps an unsigned, unchained narrative stream (AuditRun / AuditRunEvent) for replay and export, distinct from the tamper-evident chain above.

Enterprise Export Jobs#

For formal, asynchronous compliance exports, use the admin export jobs. These require the enterprise audit:read permission and resolve through the tenant boundary.

The download response carries the artifact plus x-intended-artifact-digest and x-intended-artifact-signature headers.

curl -X POST https://api.intended.so/admin/audit-exports \
  -H "Authorization: Bearer $INTENDED_API_KEY" \
  -H "x-tenant-id: tenant_acme_prod" \
  -H "Content-Type: application/json" \
  -d '{
    "tenantId": "tenant_acme_prod",
    "includeAnomalies": true,
    "includeRecommendations": true,
    "from": "2026-06-01T00:00:00Z",
    "to": "2026-06-06T00:00:00Z"
  }'

Next steps#

• Audit Export — the operator workflow for evidence exports
• Intents API — the calls that write to this chain
• Tenant Trust Boundary — why each tenant's chain and keys are isolated