GET /audit/session-chain/{sessionId}
Verify a session's record chain
ivy_ API key (Authorization: Bearer ivy_… or X-Ivy-Api-Key), a Clerk session JWT (Authorization: Bearer …) or the Clerk __session cookie (browser sessions). See Authentication.Re-checks the tamper-evident hash chain of one of your sessions, the record a signed-in POST /orchestrate call (curl, MCP or the terminal) leaves, and reports where, if anywhere, it stops matching. This is the record.verify.api link an orchestrate response returns. A broken chain is returned as a normal 200 with status set to broken; it is a verdict, not an error.
A session that does not exist, was deleted or is not yours answers 404. Verification is limited per user, so repeated calls can return 429 with a Retry-After header. A deployment that writes session records this verifier cannot read yet answers 501.
Request
Path parameters
Session UUID (the sessionId an orchestrate response returns).
Responses
200 OK
Response shape:
verified: every row matched. verified_partial: every checked row matched, but some could not be checked or no committed last event proves that no rows are missing from the end. broken: the chain stopped matching. no_record: the chat has no chained rows. not_verifiable: the chat could not be graded.
True only when status is verified.
Hash at the head of the partition holding the newest chained row.
True when the session has more partitions than are listed.
False when the chain was checked with plain SHA-256 because no deployment key is configured.
400 Bad Request
Response shape: object
401 Unauthorized
Response shape: object
404 Not Found
Response shape: object
429 Too Many Requests
Response shape: object
Was this page helpful?