Get an audit record

{
  "id": "sess_abc123_0",
  "session_id": "sess_abc123",
  "business_id": "biz_42",
	"environment": "sandbox",
	"credential_profile": "utopia-id-pass",
  "stage": 0,
  "primitive": "age_verify",
  "wallet": "google-wallet",
  "delivery_mode": "DC_API",
  "proof": {
    "satisfied": true,
    "min_age": 21,
    "evidence_digest": "sha256:3e8a..."
  },
  "signer_sealed": { "alg": "AES-256-GCM+GCPKMS", "key_id": "projects/.../cryptoKeyVersions/7", "aad_v": 1, "enc": "...", "dek": "..." },
  "wallet_evidence_sealed": { "alg": "AES-256-GCM+GCPKMS", "key_id": "projects/.../cryptoKeyVersions/7", "aad_v": 1, "enc": "...", "dek": "..." },
  "occurred_at": "2026-07-13T12:01:30.000000000Z",
  "prev_hash": "0x000",
  "record_hash": "sha256:9f86d081...",
  "alentra_signature": {
    "version": "alentra-audit-signature/v1",
    "alg": "ES256",
    "kid": "projects/.../cryptoKeyVersions/3",
    "issuer": "https://alentra.app",
    "signed": "record_hash",
    "value": "MEUCIQ..."
  },
  "ts_status": "ok",
  "ts_token": "MIIE..."
}

{
  "id": "sess_abc123_0",
  "session_id": "sess_abc123",
  "business_id": "biz_42",
	"environment": "sandbox",
	"credential_profile": "utopia-id-pass",
  "stage": 0,
  "primitive": "age_verify",
  "wallet": "google-wallet",
  "delivery_mode": "DC_API",
  "proof": {
    "satisfied": true,
    "min_age": 21,
    "evidence_digest": "sha256:3e8a..."
  },
  "signer_sealed": { "alg": "AES-256-GCM+GCPKMS", "key_id": "projects/.../cryptoKeyVersions/7", "aad_v": 1, "enc": "...", "dek": "..." },
  "wallet_evidence_sealed": { "alg": "AES-256-GCM+GCPKMS", "key_id": "projects/.../cryptoKeyVersions/7", "aad_v": 1, "enc": "...", "dek": "..." },
  "occurred_at": "2026-07-13T12:01:30.000000000Z",
  "prev_hash": "0x000",
  "record_hash": "sha256:9f86d081...",
  "alentra_signature": {
    "version": "alentra-audit-signature/v1",
    "alg": "ES256",
    "kid": "projects/.../cryptoKeyVersions/3",
    "issuer": "https://alentra.app",
    "signed": "record_hash",
    "value": "MEUCIQ..."
  },
  "ts_status": "ok",
  "ts_token": "MIIE..."
}

GET https://api.alentra.app/v1/audits/{id} · Auth: Bearer API key

Returns the owning business’s audit disclosure for one verified step. It includes the canonical record hash, per-session chain link, Alentra public signature, RFC 3161 status/token, primitive proof, and the encrypted blocks required to reproduce the hash. For identify, light_sign, and sign, it also decrypts signer and the available wallet_evidence so you can re-run wallet verification. A simulated development result has no wallet evidence. age_verify deliberately withholds both and returns only its boolean/threshold proof. The audit id is {session_id}_{stage}. You receive it on the step.completed webhook and on every result in GET /v1/sessions/{id}.

Path parameters

string

required

The audit id, e.g. sess_abc123_0.

Response

string

The audit id.

string

The source session.

string

The owning business; part of the canonical hash/AAD context.

string

Signed trust/data plane.

string

Signed credential trust profile id.

string

Signed route jurisdiction; withheld from the business tier for age_verify.

integer

Zero-based step position.

string

identify · age_verify · light_sign · sign.

string

The wallet adapter that fulfilled the step.

string

The response transport, currently DC_API.

object

Cleartext, PII-minimized proof fields plus evidence_digest when wallet evidence was captured.

Show proof by primitive

string

identify — RFC 8785/SHA-256 commitment to the disclosed claims.

boolean

age_verify — threshold result.

integer

age_verify — requested threshold.

string

sign/light_sign — signed manifest/terms digest.

string

sign/light_sign — compact DeviceAuth signature value. Verify it with wallet_evidence; it is not a standalone proof.

string

light_sign — exact canonical terms.

object[]

sign — ordered per-file { id, hash } manifest.

string

Commitment to the complete wallet evidence object.

object

Decrypted signer claims for non-age primitives only.

object

For wallet-backed non-age primitives, decrypted ISO mdoc verification material: exact DeviceResponse, transcript, nonce/content binding, origin, profile, and verification time.

object

Encrypted signer block retained so an offline tool can reproduce record_hash without plaintext.

object

Encrypted wallet-evidence block retained for canonical hash reproduction.

string

Previous stage’s record_hash, or 0x000 at stage 0.

string

SHA-256 over the RFC 8785 canonical record content.

object

Sandbox/production only. Alentra’s P-256/SHA-256 signature over the record digest: { version, alg: "ES256", kid, issuer, signed, value }. value is base64url ASN.1 DER ECDSA, not a compact JWS.

string

Present when trusted timestamping is configured. Immutable synchronous outcome: ok when the initial RFC 3161 request returned a validated token; deferred when it failed. A recovered record keeps deferred and adds ts_backfilled.

string

Base64 RFC 3161 token captured initially or merged after recovery.

boolean

true when a deferred token was recovered in the append-only timestamp collection.

string

ISO 8601 verification time.

{
  "id": "sess_abc123_0",
  "session_id": "sess_abc123",
  "business_id": "biz_42",
	"environment": "sandbox",
	"credential_profile": "utopia-id-pass",
  "stage": 0,
  "primitive": "age_verify",
  "wallet": "google-wallet",
  "delivery_mode": "DC_API",
  "proof": {
    "satisfied": true,
    "min_age": 21,
    "evidence_digest": "sha256:3e8a..."
  },
  "signer_sealed": { "alg": "AES-256-GCM+GCPKMS", "key_id": "projects/.../cryptoKeyVersions/7", "aad_v": 1, "enc": "...", "dek": "..." },
  "wallet_evidence_sealed": { "alg": "AES-256-GCM+GCPKMS", "key_id": "projects/.../cryptoKeyVersions/7", "aad_v": 1, "enc": "...", "dek": "..." },
  "occurred_at": "2026-07-13T12:01:30.000000000Z",
  "prev_hash": "0x000",
  "record_hash": "sha256:9f86d081...",
  "alentra_signature": {
    "version": "alentra-audit-signature/v1",
    "alg": "ES256",
    "kid": "projects/.../cryptoKeyVersions/3",
    "issuer": "https://alentra.app",
    "signed": "record_hash",
    "value": "MEUCIQ..."
  },
  "ts_status": "ok",
  "ts_token": "MIIE..."
}

404 if the record doesn’t exist or isn’t owned by your business. An archived or billing-frozen business’s API key is rejected during authentication (401).

Offline verification

Download the public keys from https://api.alentra.app/.well-known/alentra-audit-jwks.json, save this response, and use cmd/verify-audit from the alentra-services source tree. It reproduces the record hash and verifies the required sandbox/production Alentra signature; when wallet_evidence is present, it also re-runs the ISO mdoc proof against roots you supply. See Verification & trust.

Integrity verification does not by itself establish admissibility, legal effect, or suitability for your transaction. Preserve the complete response and original signed files, and obtain legal advice where needed.

Re-running the withheld age_verify wallet proof requires an approved legal-tier disclosure. It is not available through a customer API key.

Overview

Sessions

Audits

Discovery

Webhooks

Path parameters

Response

Offline verification

​Path parameters

​Response

​Offline verification

Path parameters

Response

Offline verification