Audit

Qeet ID writes an append-only audit log where each entry is SHA-256 hash-chained to the previous one. Because every record commits the hash of its predecessor, altering or deleting any entry breaks the chain — and a /verify endpoint proves the chain is intact.

Read the log

curl "https://api.id.qeet.in/v1/tenants/$TENANT/audit?limit=50&action=role.assigned&actor_user_id=$USER" \
  -H "Authorization: ApiKey $QEETID_API_KEY"

action, resource_type, and actor_user_id filter server-side; cursor (the id of the last-seen event) keyset-paginates through the rest.

Verify integrity

The verify endpoint recomputes the chain and reports whether it's intact (and where it breaks, if it doesn't).

curl "https://api.id.qeet.in/v1/tenants/$TENANT/audit/verify" \
  -H "Authorization: ApiKey $QEETID_API_KEY"
# → { "ok": true, "rows_checked": 12840 }

What's recorded

Security-relevant state changes are audited: sign-ins (success + failure), MFA events, refresh-token theft detection, role/permission and policy changes, session creation/revocation, admin configuration changes, API-key lifecycle, and GDPR operations. After a GDPR erasure, the audit record of the deletion survives with PII redacted — you keep a provable trail without retaining personal data.

Anomaly detection

A background sweep builds a rolling behavioral baseline per (tenant, actor) — which action types they take, what hours they're normally active, which IPs they act from — and flags new events that deviate: a first-time action type, an unusual hour, or a brand-new IP. It's a transparent, weighted-novelty score (0–1), not a black-box model — every flag names exactly which signals fired.

{
  "action": "billing.plan_changed",
  "actor_email": "admin@acme.example",
  "score": 0.7,
  "reasons": ["new_action_type", "new_ip"],
  "status": "open"
}

Also in the console: Security & Compliance → Audit Intelligence, alongside a finally- wired UI for the /verify integrity check above.