Docs · Reference

Tamper-evident Audit Log

The manager audit log is hash-chained: each entry carries a SHA-256 hash that chains the one before it. Change or delete any row and the chain breaks — so the log becomes an integrity-proof record you can stand behind for compliance and forensics.

Topic: Compliance · Forensics
Integrity: SHA-256 hash chain
Maps to: UU PDP · ISO 27001
API: /audit · /audit/verify

What it does

Every audited action the manager records is linked to the previous entry by a SHA-256 hash. The result is a chain: the hash of each row depends on the row before it, so editing or removing any entry in the middle invalidates everything after it. That makes silent tampering detectable — you do not just have a log, you have a log you can provewasn't altered.

Hash-chained — each entry chains the previous with SHA-256.
Verifiable — a single command re-walks the chain and tells you if it holds.
Forensic-grade — pinpoints the first tampered entry, not just "something is wrong".

How to use it

Read the log

Pull the most recent entries (default paging via --limit).

bash

nexus-cli audit --limit 200

Verify the chain

Re-walk the chain and confirm integrity. The result reports whether it is intact and where it first broke if not.

bash

nexus-cli audit-verify

The verifier returns ok, the number of entries checked, tampered_at_id (the first broken entry, if any) and the current tip_hash of the chain.

REST API

endpoints

GET /audit          # list audit entries
GET /audit/verify   # { ok, entries, tampered_at_id, tip_hash }

Why it matters for compliance

Auditors and incident responders need to trust the record. A hash-chained trail gives them cryptographic assurance that the history of who-did-what-when has not been quietly rewritten — directly supporting integrity controls in UU PDP and ISO 27001, and standing up as evidence during forensics.

Upgrades stay honest. On upgrade, existing rows are backfilled into the chain to establish a baseline — so the log is tamper-evident from that point forward, with no gap.

Tips

Run nexus-cli audit-verify on a schedule and alert if ok is false.
Record the tip_hash externally (e.g. in a ticket) to anchor a point in time.
A non-null tampered_at_id tells you the exact entry to investigate first.

PreviousTips & Best Practices Next Compliance Mapping (UU PDP & ISO 27001)