Skip to main content

diagrid audit verify

Verify the signed audit log of the region management API

Description​

Verify the audit log of the region management API against the identity of the management server that wrote it.

Every authenticated call to a region's management API — through the console, the CLI or the API — is recorded with the caller its credential proved, the call and its result. The management server signs these records with its workload identity. This command reads the organization's records in a time window exactly as they are stored, and checks that each was written by a region's management server, has not been altered since, and that none is missing from a signed range. The signing certificates must chain to the signing authorities your regions publish, or to the bundle passed with --trust-anchor.

Save the records with --export to verify them again later, offline, with --file. The log store keeps them for a few days; a saved file keeps its proof.

The result says when the first and last verified records were written. Check that it spans the window you asked for: records deleted from the start of the window, checkpoints with them, look like a window that starts later.

Exits non-zero when a record was altered, injected or reordered, when records are missing from a signed range, or when no record in the window could be verified.

diagrid audit verify [flags]

Examples​


  # Verify the last 24 hours of the region audit log
  diagrid audit verify --since 24h

  # Save the signed records for an auditor while verifying them
  diagrid audit verify --since 2026-10-29T00:00:00Z --until 2026-10-30T00:00:00Z --export audit-2026-10-29.jsonl

  # Verify a saved file offline, against a CA bundle obtained out of band
  diagrid audit verify --file audit-2026-10-29.jsonl --trust-anchor sentry-ca.pem --org <org-id>

Options​

      --since string          Start of the window: RFC3339 or a duration like 24h (at most 7 days ago) (default "24h")
      --until string          End of the window: RFC3339 or a duration like 1h (default: now)
      --export string         Also save the signed records read to this file, to verify again later with --file
      --file string           Verify records saved with --export instead of reading them ("-" for stdin)
      --trust-anchor string   PEM CA bundle to verify against; if unset, the signing authorities your regions publish are used
      --org string            Organization ID the records were read from; defaults to the current organization
  -o, --output string         Output format: text or json (default "text")
  -h, --help                  help for verify

Options inherited from parent commands​

      --api-key string   Diagrid Cloud API key

SEE ALSO​

Last updated on