Audit

Verify a signed caller-authentication audit event

Verifies a signed caller-authentication audit event’s signature, the same unauthenticated, third-party-verifiable capability as POST /refusal/verify, over the durable caller_audit_events audit trail instead of Refusal Records. No database lookup involved, pure signature-over-bytes verification against the event and signature supplied in the request body. Only production (Supabase) audit sinks sign; in-memory test sinks never produce a genuinely valid signature for this route to confirm.

POST

audit

verify

curl --request POST \
  --url http://localhost:3000/audit/verify \
  --header 'Content-Type: application/json' \
  --data '
{
  "event": {
    "type": "caller_authenticated",
    "occurredAt": "2026-09-15T03:00:00.000Z",
    "route": "/version"
  },
  "signature": {
    "algorithm": "ed25519",
    "keyId": "default",
    "value": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="
  }
}
'

import requests

url = "http://localhost:3000/audit/verify"

payload = {
    "event": {
        "type": "caller_authenticated",
        "occurredAt": "2026-09-15T03:00:00.000Z",
        "route": "/version"
    },
    "signature": {
        "algorithm": "ed25519",
        "keyId": "default",
        "value": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="
    }
}
headers = {"Content-Type": "application/json"}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {'Content-Type': 'application/json'},
  body: JSON.stringify({
    event: {
      type: 'caller_authenticated',
      occurredAt: '2026-09-15T03:00:00.000Z',
      route: '/version'
    },
    signature: {
      algorithm: 'ed25519',
      keyId: 'default',
      value: 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=='
    }
  })
};

fetch('http://localhost:3000/audit/verify', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_PORT => "3000",
  CURLOPT_URL => "http://localhost:3000/audit/verify",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'event' => [
        'type' => 'caller_authenticated',
        'occurredAt' => '2026-09-15T03:00:00.000Z',
        'route' => '/version'
    ],
    'signature' => [
        'algorithm' => 'ed25519',
        'keyId' => 'default',
        'value' => 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=='
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "http://localhost:3000/audit/verify"

	payload := strings.NewReader("{\n  \"event\": {\n    \"type\": \"caller_authenticated\",\n    \"occurredAt\": \"2026-09-15T03:00:00.000Z\",\n    \"route\": \"/version\"\n  },\n  \"signature\": {\n    \"algorithm\": \"ed25519\",\n    \"keyId\": \"default\",\n    \"value\": \"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==\"\n  }\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("http://localhost:3000/audit/verify")
  .header("Content-Type", "application/json")
  .body("{\n  \"event\": {\n    \"type\": \"caller_authenticated\",\n    \"occurredAt\": \"2026-09-15T03:00:00.000Z\",\n    \"route\": \"/version\"\n  },\n  \"signature\": {\n    \"algorithm\": \"ed25519\",\n    \"keyId\": \"default\",\n    \"value\": \"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==\"\n  }\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("http://localhost:3000/audit/verify")

http = Net::HTTP.new(url.host, url.port)

request = Net::HTTP::Post.new(url)
request["Content-Type"] = 'application/json'
request.body = "{\n  \"event\": {\n    \"type\": \"caller_authenticated\",\n    \"occurredAt\": \"2026-09-15T03:00:00.000Z\",\n    \"route\": \"/version\"\n  },\n  \"signature\": {\n    \"algorithm\": \"ed25519\",\n    \"keyId\": \"default\",\n    \"value\": \"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==\"\n  }\n}"

response = http.request(request)
puts response.read_body

{
  "valid": false
}

{
  "error": "Request body must be { event, signature } (event: type, occurredAt, route; signature: algorithm, keyId, value required)."
}

Body

application/json

Request body for POST /audit/verify: the signed caller-authentication audit event and its stored signature, not a lookup by ID. Checked structurally on the server before signature verification runs. Verification operates on canonical bytes and the signature alone, never on event.type.

event

object

required

The caller-authentication audit event as stored. Only type, occurredAt, and route are structurally required; the event may carry further fields depending on what produced it.

Show child attributes

signature

object

required

The signature stored alongside the event. Only production (Supabase) audit sinks sign; in-memory test sinks never produce a genuine one of these.

Show child attributes

Response

Verification completed. A 200 does not by itself mean the signature verified, see the valid field.

Response shared by POST /refusal/verify and POST /audit/verify: a bare signature-validity result, no wrapper, no partial-failure detail. Both routes verify a signature over bytes with no database lookup, so there is nothing more specific to report than valid or not.

valid

boolean

required

Whether the signature verifies against Parmana's public key for the stated algorithm and key ID.

Verify a signed caller-authentication audit event

curl --request POST \
  --url http://localhost:3000/audit/verify \
  --header 'Content-Type: application/json' \
  --data '
{
  "event": {
    "type": "caller_authenticated",
    "occurredAt": "2026-09-15T03:00:00.000Z",
    "route": "/version"
  },
  "signature": {
    "algorithm": "ed25519",
    "keyId": "default",
    "value": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="
  }
}
'

import requests

url = "http://localhost:3000/audit/verify"

payload = {
    "event": {
        "type": "caller_authenticated",
        "occurredAt": "2026-09-15T03:00:00.000Z",
        "route": "/version"
    },
    "signature": {
        "algorithm": "ed25519",
        "keyId": "default",
        "value": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="
    }
}
headers = {"Content-Type": "application/json"}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {'Content-Type': 'application/json'},
  body: JSON.stringify({
    event: {
      type: 'caller_authenticated',
      occurredAt: '2026-09-15T03:00:00.000Z',
      route: '/version'
    },
    signature: {
      algorithm: 'ed25519',
      keyId: 'default',
      value: 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=='
    }
  })
};

fetch('http://localhost:3000/audit/verify', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_PORT => "3000",
  CURLOPT_URL => "http://localhost:3000/audit/verify",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'event' => [
        'type' => 'caller_authenticated',
        'occurredAt' => '2026-09-15T03:00:00.000Z',
        'route' => '/version'
    ],
    'signature' => [
        'algorithm' => 'ed25519',
        'keyId' => 'default',
        'value' => 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=='
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "http://localhost:3000/audit/verify"

	payload := strings.NewReader("{\n  \"event\": {\n    \"type\": \"caller_authenticated\",\n    \"occurredAt\": \"2026-09-15T03:00:00.000Z\",\n    \"route\": \"/version\"\n  },\n  \"signature\": {\n    \"algorithm\": \"ed25519\",\n    \"keyId\": \"default\",\n    \"value\": \"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==\"\n  }\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("http://localhost:3000/audit/verify")
  .header("Content-Type", "application/json")
  .body("{\n  \"event\": {\n    \"type\": \"caller_authenticated\",\n    \"occurredAt\": \"2026-09-15T03:00:00.000Z\",\n    \"route\": \"/version\"\n  },\n  \"signature\": {\n    \"algorithm\": \"ed25519\",\n    \"keyId\": \"default\",\n    \"value\": \"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==\"\n  }\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("http://localhost:3000/audit/verify")

http = Net::HTTP.new(url.host, url.port)

request = Net::HTTP::Post.new(url)
request["Content-Type"] = 'application/json'
request.body = "{\n  \"event\": {\n    \"type\": \"caller_authenticated\",\n    \"occurredAt\": \"2026-09-15T03:00:00.000Z\",\n    \"route\": \"/version\"\n  },\n  \"signature\": {\n    \"algorithm\": \"ed25519\",\n    \"keyId\": \"default\",\n    \"value\": \"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==\"\n  }\n}"

response = http.request(request)
puts response.read_body

{
  "valid": false
}

{
  "error": "Request body must be { event, signature } (event: type, occurredAt, route; signature: algorithm, keyId, value required)."
}

Get Started

Core Concepts

Guides

SDKs

REST API

Security & Deployment

Integrations

Tutorials

Advanced

Support

Changelog

Verify a signed caller-authentication audit event

Body

Response