Audit API

Query tamper-evident audit logs, verify log integrity, generate compliance reports, manage data retention, and export to SIEM systems. Most endpoints require the ADMIN role.

Tamper-evident logs

NodeLoom audit logs are tamper-evident. Each log entry is cryptographically linked to the previous entry, making it impossible to modify or delete past records without detection.

Get Audit Logs

GET

/api/audit/team/:teamId

List audit logs for a team (requires ADMIN role)

Query Parameters

Parameter	Type	Required	Description
`page`	integer	No	Page number (default: 0)
`size`	integer	No	Page size (default: 50)
`action`	string	No	Filter by action type (e.g. WORKFLOW_CREATED, MEMBER_ADDED)
`userId`	UUID	No	Filter by acting user
`from`	ISO 8601	No	Start date for filtering
`to`	ISO 8601	No	End date for filtering

Response

200 OK

{
  "content": [
    {
      "id": "uuid",
      "teamId": "uuid",
      "userId": "uuid",
      "userName": "Jane Doe",
      "action": "WORKFLOW_CREATED",
      "resourceType": "WORKFLOW",
      "resourceId": "uuid",
      "details": {
        "workflowName": "Order Processing"
      },
      "createdAt": "2026-02-17T10:00:00.000Z"
    }
  ],
  "totalElements": 1250,
  "totalPages": 25,
  "number": 0,
  "size": 50
}

Verify Integrity

GET

/api/audit/team/:teamId/verify

Verify the integrity of the audit log

Verifies that no audit log entries have been tampered with or deleted. This operation can take time for teams with extensive audit history.

Response

200 OK

{
  "valid": true,
  "entriesVerified": 1250,
  "firstEntry": "2026-01-15T10:00:00.000Z",
  "lastEntry": "2026-02-17T10:00:00.000Z",
  "verifiedAt": "2026-02-17T10:05:00.000Z"
}

200 OK (integrity violation)

{
  "valid": false,
  "entriesVerified": 843,
  "brokenAtTimestamp": "2026-02-10T08:30:00.000Z",
  "verifiedAt": "2026-02-17T10:05:00.000Z"
}

Audit Reports

List Reports

GET

/api/audit/team/:teamId/reports

List generated audit reports

200 OK

[
  {
    "id": "uuid",
    "name": "February 2026 Compliance Report",
    "type": "COMPLIANCE",
    "status": "COMPLETED",
    "createdAt": "2026-02-17T09:00:00.000Z",
    "downloadUrl": "/api/audit/team/:teamId/reports/:id/download"
  }
]

Create Report

POST

/api/audit/team/:teamId/reports

Generate a new audit report

Field	Type	Required	Description
`name`	string	Yes	Report name
`type`	string	Yes	Report type: COMPLIANCE, ACTIVITY, SECURITY
`from`	ISO 8601	Yes	Report period start date
`to`	ISO 8601	Yes	Report period end date

Request

{
  "name": "February 2026 Compliance Report",
  "type": "COMPLIANCE",
  "from": "2026-02-01T00:00:00.000Z",
  "to": "2026-02-28T23:59:59.000Z"
}

Get Report

GET

/api/audit/team/:teamId/reports/:id

Get report details and download URL

Retention Management

Get Retention Policy

GET

/api/audit/team/:teamId/retention

Get the current audit log retention policy

200 OK

{
  "retentionDays": 365,
  "autoDeleteEnabled": false,
  "lastPurgedAt": null
}

Update Retention Policy

PUT

/api/audit/team/:teamId/retention

Update the audit log retention policy

Field	Type	Required	Description
`retentionDays`	integer	Yes	Number of days to retain audit logs (minimum: 30)
`autoDeleteEnabled`	boolean	No	Automatically delete logs past the retention period

Purge Old Logs

POST

/api/audit/team/:teamId/purge

Manually purge audit logs older than the retention period

Irreversible

Purged audit logs cannot be recovered. Ensure you have exported or backed up any required data before purging.

200 OK

{
  "purgedCount": 342,
  "oldestRemaining": "2026-01-15T10:00:00.000Z",
  "purgedAt": "2026-02-17T10:15:00.000Z"
}

SIEM Export

GET

/api/audit/team/:teamId/siem

Export audit logs in SIEM-compatible format

Parameter	Type	Required	Description
`format`	string	No	Export format: syslog, cef, or json (default: json)
`from`	ISO 8601	No	Start date
`to`	ISO 8601	No	End date
`limit`	integer	No	Maximum entries to export (default: 10000)

The response Content-Type varies by format. JSON returns application/json, while syslog and CEF return text/plain.

Continuous integration

Set up a scheduled job to poll the SIEM export endpoint periodically and feed logs into your security information and event management system (e.g. Splunk, Elastic SIEM, Datadog).

Error Codes

Status	Meaning
`400`	Invalid query parameters or retention value below minimum
`403`	Insufficient permissions (requires ADMIN role)
`404`	Team or report not found

Teams