Cognethics Console

Audit Log Explorer

Every API write on the Cognethics platform is recorded in an immutable, SHA-256 hash-chained audit trail. Tenants can query it, export it, and verify the chain themselves to prove no entry has been modified, deleted, or back-dated.

Compliance-grade hash chain across all events

Both the operational and governance audit logs are backed by the same compliance-grade hash chain. Each row carries:

If anyone — including a database administrator — alters, deletes, or back-dates a row, the chain breaks at that point and the next call to verify-chain flags the first offending entry.

Two audit ledgers, one chain primitive

1. Operational Audit Log (SystemAuditLog)

Records every CRUD operation across the platform.

Properties:

Fields captured:

Use case: Compliance review, DSAR requests, operational debugging, data lineage, chain-of-custody proofs.

2. Governance Audit Ledger (GovernanceAuditEntry)

Records policy decisions, delegations, escalations, and state transitions — with the same hash chain primitive, additionally bound to distributed-tracing identifiers.

Properties:

Fields captured:

Use case: Compliance audits (SOC 2, HIPAA), governance verification, delegation audit trail, cross-system correlation.

How to query

REST API

List audit log entries:

curl -H "Authorization: Bearer <token>" \
  "https://<tenant>.cognethics.com/api/audit/?action=create&entity_type=invoice&date_from=2026-05-01&date_to=2026-05-21&page=1&page_size=50"

Export as CSV:

curl -H "Authorization: Bearer <token>" \
  "https://<tenant>.cognethics.com/api/audit/export/?action=update&date_from=2026-05-01&date_to=2026-05-21" \
  > audit_export.csv

Verify the hash chain

Both ledgers expose a verifier. The operational ledger's verifier runs across the caller's whole tenant slice (or a sequence range you specify).

Verify the operational ledger:

curl -X POST -H "Authorization: Bearer <token>" \
  "https://<tenant>.cognethics.com/api/audit/verify-chain/" \
  -H "Content-Type: application/json" \
  -d '{}'

Optional body fields:

Response:

{
  "is_valid": true,
  "total_entries": 218010,
  "first_invalid_entry_id": null,
  "error_details": null,
  "sequence_from": 1,
  "sequence_to": 218010,
  "tenant_id": "8a2e8037-96f9-47d1-aef3-3f9c42d48fd0",
  "verified_at": "2026-05-21T20:12:25.165646+00:00"
}

If any row has been altered — even at the database layer with the immutability trigger bypassed — the response identifies the first offending entry: 

{
  "is_valid": false,
  "total_entries": 218010,
  "first_invalid_entry_id": "0e97604e-3887-46c3-a3d6-6b3236d59968",
  "error_details": "Entry 218009 entry_hash mismatch (possible tampering). Expected: 4df9cb7f515bf398..., Got: d148f12ea2707b21..."
}

Verify the governance ledger:

curl -X GET -H "Authorization: Bearer <token>" \
  "https://<tenant>.cognethics.com/api/agents/governance-audit/verify_chain/?governed_agent=<id>"

MCP (programmatic)

Call from any agent with the admin.view_audit_logs permission:

from cognethics.mcp.client import PrismClient

client = PrismClient(token="...")
response = client.call(
    app="core",
    entity="audit_log",
    operation="list",
    filters={
        "action": "create",
        "entity_type": "invoice",
        "date_from": "2026-05-01",
        "date_to": "2026-05-21"
    },
    page=1,
    page_size=50
)

for entry in response["results"]:
    print(f"{entry['timestamp']} | {entry['action']} | {entry['entity_type']} | {entry['user_id']}")

Filters & fields

Available filters:

Sortable fields:

Compliance notes

Examples

DSAR (Data Subject Access Request)

Find all operations on a specific customer's record:

curl -H "Authorization: Bearer <token>" \
  "https://tenant.cognethics.com/api/audit/?entity_type=Contact&entity_id=contact-uuid&date_from=2025-01-01"

Incident investigation

Find all changes to a sensitive field in the last 7 days:

curl -H "Authorization: Bearer <token>" \
  "https://tenant.cognethics.com/api/audit/?action=update&entity_type=PaymentRecord&date_from=2026-05-14&date_to=2026-05-21" \
  | jq '.results[] | select(.changes.amount_usd != null)'

Chain verification (compliance review)

Run a periodic chain check across a tenant's whole audit history:

curl -X POST -H "Authorization: Bearer <token>" \
  "https://tenant.cognethics.com/api/audit/verify-chain/" \
  -d '{}'

Or verify a specific range — useful when the chain is long and you want to anchor evidence to a previously-signed sequence number: 

curl -X POST -H "Authorization: Bearer <token>" \
  "https://tenant.cognethics.com/api/audit/verify-chain/" \
  -d '{"sequence_from": 1, "sequence_to": 100000}'

Tenant permissions

By default, the audit log is accessible to users with the admin.view_audit_logs permission (typically security officers, compliance teams, and system admins). Your organization may assign this permission to compliance roles as needed.

Questions?

For questions about the audit log or your compliance posture, contact our Security & Compliance team through the form below.

Contact Security & Compliance

Pick a topic and we'll route your message to the right team.

← Back to Trust Center