SIEM ingestion: pull the audit log
Stream the whole tenant audit trail into your SIEM with the since-and-cursor endpoint, know what each entry carries, and verify the daily hash anchors so an altered entry cannot hide.
Two patterns move Veritome events into your own systems. Push is the webhooks — four events, signed, in real time. Pull is the audit-log endpoint, built for batch ingestion of everything: every change, by whom, from where. This article is the pull side.
The endpoint
GET /api/v1/audit-log?since=<iso timestamp>&limit=<n> with an API key as the bearer token returns entries created at or after since, newest window first, with a nextCursor. Follow the cursor until it is null, then advance since to the last createdAt you stored and poll again on your SIEM's schedule. Page size is capped at 100; the endpoint is rate-limited per key, so a large backfill runs in windows rather than one pull.
What an entry carries
action (the event, such as an obligation status change, a key rotation or a document issue), entityType and entityId, userId and userName, ip and userAgent, metadata (the event's details) and createdAt — enough to reconstruct who did what, when, from where. Entries are the same records the Audit trail screen shows; nothing is filtered out for the API beyond your key's organisation.
Anchored daily
Once a day, each organisation's previous day of audit entries is hashed — SHA-256 over the rows in order — together with the previous day's anchor, forming a linked chain of daily anchors. Recomputing the hash over the stored rows detects any later edit, insertion or deletion in an anchored day, and the chain link makes removing a whole day detectable too. The Audit trail screen can verify the anchor chain on demand and says when an anchored day no longer matches its recorded hash. If your SIEM stores the anchors alongside the entries, you hold an independent copy of the proof.
A read-only key is enough
Ingestion needs no write scope. Mint a read-only key for the SIEM under Organisation → API keys & webhooks, name it for the consumer, and rotate it on your usual schedule; rotation keeps the entry and issues a new secret, and every rotation is itself an audit entry your pipeline will see. See API keys and organisation data export for keys and Webhooks for the push side.