IndyKite Audit Logs - read and export the tamper-proof audit trail

Every audit event of a project that reached one of its Outbound Events sinks - Capture ingests and deletes, configuration changes, token introspections, AuthZEN decisions and searches, ContX IQ executes, CDC changes - is appended to that project's chain, provided the project has an Audit Signing configuration. Events are collected into batches; each batch is hashed and signed, a signed manifest links it to the previous batch, and a checkpoint periodically fixes the chain's head under a signature. The Audit Log API pages through those artefacts and publishes the signing keys, so an export can be kept and checked independently of the API that served it.

This skill covers reading and exporting the trail; the Audit Log guide is the full reference for the API, including how an export is checked against the published keys. Choosing the signing key (platform-managed or your own KMS key) is a Config API object, POST /configs/v1/audit-signings, documented in the Audit Signing guide; today the platform-managed key signs every record, and a customer-managed configuration is stored for the upcoming support without changing which key signs.

When to use

Activate this skill when the user wants to:

• export or browse a project's audit events - "what happened in this project last night?", "pull every AuthZEN decision for the compliance archive", "feed our SIEM from IndyKite";
• archive the chain with its keys - keep manifests, checkpoints, and the JWKS next to the events so the export stays checkable later: "give the auditor a self-contained copy of the trail";
• understand the chain model - batches, manifests, prev_hash / head_hash, checkpoints, the kid that names the signing key;
• debug 401 / 403 / 400 on /audit/v1/* - almost always the missing Audit API permission, a project_id that is not the credential's project, or a hand-built cursor.

Do not activate this skill when the user wants to: