# diagrid audit verify

Verify the signed audit log of the region management API

### Description

Verify the audit log of the region management API against the identity of the
management server that wrote it.

Every authenticated call to a region's management API — through the console,
the CLI or the API — is recorded with the caller its credential proved, the
call and its result. The management server signs these records with its
workload identity. This command reads the organization's records in a time
window exactly as they are stored, and checks that each was written by a
region's management server, has not been altered since, and that none is
missing from a signed range. The signing certificates must chain to the
signing authorities your regions publish, or to the bundle passed with
\--trust-anchor.

Save the records with --export to verify them again later, offline, with
\--file. The log store keeps them for a few days; a saved file keeps its proof.

The result says when the first and last verified records were written. Check
that it spans the window you asked for: records deleted from the start of the
window, checkpoints with them, look like a window that starts later.

Exits non-zero when a record was altered, injected or reordered, when records
are missing from a signed range, or when no record in the window could be
verified.

```
diagrid audit verify [flags]
```

### Examples

```

  # Verify the last 24 hours of the region audit log
  diagrid audit verify --since 24h

  # Save the signed records for an auditor while verifying them
  diagrid audit verify --since 2026-10-29T00:00:00Z --until 2026-10-30T00:00:00Z --export audit-2026-10-29.jsonl

  # Verify a saved file offline, against a CA bundle obtained out of band
  diagrid audit verify --file audit-2026-10-29.jsonl --trust-anchor sentry-ca.pem --org <org-id>

```

### Options

```
      --since string          Start of the window: RFC3339 or a duration like 24h (at most 7 days ago) (default "24h")
      --until string          End of the window: RFC3339 or a duration like 1h (default: now)
      --export string         Also save the signed records read to this file, to verify again later with --file
      --file string           Verify records saved with --export instead of reading them ("-" for stdin)
      --trust-anchor string   PEM CA bundle to verify against; if unset, the signing authorities your regions publish are used
      --org string            Organization ID the records were read from; defaults to the current organization
  -o, --output string         Output format: text or json (default "text")
  -h, --help                  help for verify
```

### Options inherited from parent commands

```
      --api-key string   Diagrid Cloud API key
```

### SEE ALSO

- [diagrid audit](./audit.md)	 - View organization audit events (Activity)