​

Audit log export, chain verification, and refresh workflow

​

Export vs stream — pick the right surface

• Export (this page) — a bounded date range, bundled into a file you hand to an auditor and keep as evidence. The export is day-aligned on UTC because the daily Merkle roots the chain-verifier returns anchor one digest per UTC day, and a partial day would anchor against an incomplete root.
• Stream (SIEM sinks) — every audit event pushed continuously to Splunk, Datadog, an S3 bucket, or an HTTPS drain you own. Configure a sink when your SOC policy requires live delivery, and use exports for point-in-time evidence requests.

​

Queue an export

curl "https://api.orbit.devotel.io/api/v1/compliance/audit-export?from=2026-01-01&to=2026-03-31&format=json" \
  -H "X-API-Key: dv_live_sk_..."

{
  "data": {
    "id": "auditExportJob_...",
    "status": "pending",
    "format": "json",
    "from": "2026-01-01",
    "to": "2026-03-31",
    "message": "Audit log export queued. Poll /compliance/audit-export/:jobId for status."
  }
}

​

Job lifecycle: pending → running → complete | failed

​

Signed-URL expiry and refresh

​

Chain-verify: replay the tamper-evident chain

​

How an auditor cross-checks the bundle

1. Run verify against the job id. chain_valid: true with an empty issues list means every link in the range held at verification time.
2. Compare rows_checked against the total_rows on the export job — the counts must agree, proving the bundle contains every row the chain covers.
3. Compare first_hash / last_hash against the first and last rows of the exported bundle.
4. For each entry in daily_roots, the merkle_root commits to the set of rows Orbit recorded on that UTC day, and anchor_url points to the persisted root record the auditor can pin independently. Date-aligned exports make this comparison exact.

​

Worked example — queue → poll → download → verify

# 1. Queue the export
JOB=$(curl -s "https://api.orbit.devotel.io/api/v1/compliance/audit-export?from=2026-01-01&to=2026-03-31" \
  -H "X-API-Key: dv_live_sk_..." | jq -r '.data.id')

# 2. Poll until complete
until curl -s "https://api.orbit.devotel.io/api/v1/compliance/audit-export/$JOB" \
  -H "X-API-Key: dv_live_sk_..." | jq -e '.data.status == "complete"' > /dev/null; do
  sleep 5
done

# 3. Download the bundle and mirror it into your evidence store
URL=$(curl -s "https://api.orbit.devotel.io/api/v1/compliance/audit-export/$JOB" \
  -H "X-API-Key: dv_live_sk_..." | jq -r '.data.download_url')
curl -o audit-export-2026-q1.json.gz "$URL"

# 4. Verify the chain over the same range
curl "https://api.orbit.devotel.io/api/v1/compliance/audit-export/$JOB/verify" \
  -H "X-API-Key: dv_live_sk_..." | jq '.data | {rows_checked, chain_valid, first_hash, last_hash, roots: (.daily_roots | length)}'

​

Worked example — SOC 2 evidence request

1. Queue the export with from=2026-01-01&to=2026-03-31. Choose format=json for the raw ledger, or format=scim when the recipient’s evidence tooling ingests SCIM Event Token (RFC 8417) envelopes.
2. Poll to complete, download inside the 7-day window, and mirror the file into your own store so the evidence survives the URL TTL.
3. Run verify and capture rows_checked, chain_valid, first_hash, last_hash, and the daily_roots list. Attach that JSON alongside the bundle.
4. Hand the auditor both files plus the cross-check steps above. They confirm the row counts agree and the chain endpoints match before reading a single event.
5. If the signed URL lapses before the auditor fetches from your mirror, queue the same range again — do not forward the expired link.

​

Rate limits and roles

• All three endpoints are gated to the workspace owner or admin role (API keys follow the same gate), because the payload exposes every audit event on the workspace — user ids, IP addresses, and event details.
• The queue endpoint (GET /audit-export) is write-weighted: 5 per minute per workspace, so scripted evidence pulls should queue a handful of ranges, not hundreds.
• Status-poll and chain-verify are read-weighted: 120 per minute per workspace, so a 1–2 second poll loop from a dashboard or script stays well under the ceiling.
• Queueing writes a compliance.audit_export_requested audit entry; each verification call writes a compliance.audit_export_verified entry with the verdict and issue count.

​

Tenant-owned posture

​

Related

• Stream audit logs to your SIEM — continuous delivery instead of bounded exports.
• Compliance evidence binder — framework-mapped packs with the chain pre-checked for SOC 2, ISO 27001, GDPR, and HIPAA.
• The export families model — where this export sits among Orbit’s four outbound-data families.
• Audit log — query the ledger directly and subscribe to the signed audit.log.created webhook.
• Immutable archival export — WORM bundles of messages and recordings, the corresponding control for payload evidence.