---
title: "List audit checkpoints"
description: "Signed checkpoints for this organisation’s audit chain, including public verification metadata. Checkpoint rows are read through the reporting connection and are always limited to this organisation’s chain; private signing keys are never exposed.\n\n### Quire permissions\n\nRequired capability: `report/viewAudit`.\n\nCredential scopes: `audit:read`.\n\nThe acting subject must also be allowed to perform this action in the organisation."
image: "https://docs.quirelms.com/og.png"
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.quirelms.com/llms.txt
> Use this file to discover all available pages before exploring further.

Path: Quire API › audit

`GET /audit_checkpoints`

Signed checkpoints for this organisation’s audit chain, including public verification metadata. Checkpoint rows are read through the reporting connection and are always limited to this organisation’s chain; private signing keys are never exposed.

\### Quire permissions

Required capability: `report/viewAudit`.

Credential scopes: `audit:read`.

The acting subject must also be allowed to perform this action in the organisation.

## Authentication

Requires one of the following:

- `apiKey`, http, header `Authorization`, scopes: `audit:read`
- `oauth2`, oauth2, scopes: `audit:read`

## Query parameters

- `listAuditCheckpoints.query.cursor` (string, optional)
- `listAuditCheckpoints.query.limit` (integer, optional)
  - min 1; max 9007199254740991
- `listAuditCheckpoints.query.updated_since` (string, optional) — Only rows changed at or after this instant, sorted by updated_at then id. At most 90 days ago; a sync older than that has to start again from the beginning.
  - format `date-time`; pattern `^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.\d+)?(?:Z|([+-](?:[01]\d|2[0-3]):[0-5]\d)))$`

## Header parameters

- `listAuditCheckpoints.header.Quire-Version` (string, optional) — The dated API revision to serve this request at. Omitted, the request is served at the revision the credential was issued against. The response echoes the revision actually applied.
  - format `date`

## Code samples

### cURL

```curl
curl --request GET \
  --url https://your-organisation.quirelms.com/api/v1/audit_checkpoints \
  --header 'Authorization: Bearer <token>'
```

### TypeScript

```typescript
const url = 'https://your-organisation.quirelms.com/api/v1/audit_checkpoints';
const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

fetch(url, options)
  .then(res => res.json())
  .then(json => console.log(json))
  .catch(err => console.error(err));
```

### Python

```python
import requests

url = "https://your-organisation.quirelms.com/api/v1/audit_checkpoints"

headers = {"Authorization": "Bearer <token>"}

response = requests.get(url, headers=headers)

print(response.text)
```

## Responses

### 200

Success.

#### Example

```json
{
  "data": [
    {
      "id": "string",
      "chain_scope": "string",
      "from_seq": "string",
      "to_seq": "string",
      "entry_count": "string",
      "head_link_hash": "string",
      "prev_head_hash": "string",
      "covers_from": "string",
      "covers_to": "string",
      "created_at": "string",
      "updated_at": "string",
      "key_id": "string",
      "algorithm": "string",
      "signature": "string",
      "cosignature": "string",
      "cosign_key_id": "string"
    }
  ],
  "page": {
    "next_cursor": "string",
    "has_more": true,
    "limit": -9007199254740991
  }
}
```

- `listAuditCheckpoints.response.200.data` (array<object>, required)
  - `listAuditCheckpoints.response.200.data.id` (string, required)
  - `listAuditCheckpoints.response.200.data.chain_scope` (string, required) — The audit chain scope for this organisation.
  - `listAuditCheckpoints.response.200.data.from_seq` (string, required) — First audit sequence covered, as a decimal string.
  - `listAuditCheckpoints.response.200.data.to_seq` (string, required) — Last audit sequence covered, as a decimal string.
  - `listAuditCheckpoints.response.200.data.entry_count` (string, required) — Number of audit entries covered, as a decimal string.
  - `listAuditCheckpoints.response.200.data.head_link_hash` (string, required) — Hex-encoded hash at the checkpoint boundary.
  - `listAuditCheckpoints.response.200.data.prev_head_hash` (any of, required)
    - any of: `string`, `null`
  - `listAuditCheckpoints.response.200.data.covers_from` (string, required) — RFC 3339 timestamp in UTC.
  - `listAuditCheckpoints.response.200.data.covers_to` (string, required) — RFC 3339 timestamp in UTC.
  - `listAuditCheckpoints.response.200.data.created_at` (string, required) — RFC 3339 timestamp in UTC.
  - `listAuditCheckpoints.response.200.data.updated_at` (string, required) — The same as created_at: a signed checkpoint never changes.
  - `listAuditCheckpoints.response.200.data.key_id` (string, required) — Identifier of the public verification key; contains no key material.
  - `listAuditCheckpoints.response.200.data.algorithm` (string, required)
  - `listAuditCheckpoints.response.200.data.signature` (string, required) — Hex-encoded public signature for the checkpoint.
  - `listAuditCheckpoints.response.200.data.cosignature` (any of, required)
    - any of: `string`, `null`
  - `listAuditCheckpoints.response.200.data.cosign_key_id` (any of, required)
    - any of: `string`, `null`
- `listAuditCheckpoints.response.200.page` (object, required)
  - `listAuditCheckpoints.response.200.page.next_cursor` (string | null, required)
  - `listAuditCheckpoints.response.200.page.has_more` (boolean, required)
  - `listAuditCheckpoints.response.200.page.limit` (integer, required)
    - min -9007199254740991; max 9007199254740991

### 401

The credential is missing, malformed, expired or revoked.

#### Example

```json
{
  "type": "http://example.com",
  "title": "string",
  "status": 0,
  "code": "string",
  "category": "validation",
  "detail": "string",
  "request_id": "string",
  "errors": [
    {
      "path": "string",
      "code": "string",
      "detail": "string"
    }
  ],
  "retry_after": 0,
  "docs_url": "http://example.com"
}
```

- `listAuditCheckpoints.response.401.type` (string, required)
  - format `uri`
- `listAuditCheckpoints.response.401.title` (string, required)
- `listAuditCheckpoints.response.401.status` (integer, required)
- `listAuditCheckpoints.response.401.code` (string, required)
- `listAuditCheckpoints.response.401.category` (string, required)
  - one of `"validation"`, `"authentication"`, `"authorization"`, `"not_found"`, `"conflict"`, `"precondition"`, `"quota"`, `"rate_limit"`, `"upstream"`, `"internal"`
- `listAuditCheckpoints.response.401.detail` (string, required)
- `listAuditCheckpoints.response.401.request_id` (string, required)
- `listAuditCheckpoints.response.401.docs_url` (string, required)
  - format `uri`
- `listAuditCheckpoints.response.401.errors` (array<object>, optional)
  - `listAuditCheckpoints.response.401.errors.path` (string, required) — RFC 6901 JSON Pointer into the request body.
  - `listAuditCheckpoints.response.401.errors.code` (string, required)
  - `listAuditCheckpoints.response.401.errors.detail` (string, required)
- `listAuditCheckpoints.response.401.retry_after` (integer | null, optional)

### 403

The credential lacks the scope this operation requires, or the acting subject lacks the capability.

#### Example

```json
{
  "type": "http://example.com",
  "title": "string",
  "status": 0,
  "code": "string",
  "category": "validation",
  "detail": "string",
  "request_id": "string",
  "errors": [
    {
      "path": "string",
      "code": "string",
      "detail": "string"
    }
  ],
  "retry_after": 0,
  "docs_url": "http://example.com"
}
```

- `listAuditCheckpoints.response.403.type` (string, required)
  - format `uri`
- `listAuditCheckpoints.response.403.title` (string, required)
- `listAuditCheckpoints.response.403.status` (integer, required)
- `listAuditCheckpoints.response.403.code` (string, required)
- `listAuditCheckpoints.response.403.category` (string, required)
  - one of `"validation"`, `"authentication"`, `"authorization"`, `"not_found"`, `"conflict"`, `"precondition"`, `"quota"`, `"rate_limit"`, `"upstream"`, `"internal"`
- `listAuditCheckpoints.response.403.detail` (string, required)
- `listAuditCheckpoints.response.403.request_id` (string, required)
- `listAuditCheckpoints.response.403.docs_url` (string, required)
  - format `uri`
- `listAuditCheckpoints.response.403.errors` (array<object>, optional)
  - `listAuditCheckpoints.response.403.errors.path` (string, required) — RFC 6901 JSON Pointer into the request body.
  - `listAuditCheckpoints.response.403.errors.code` (string, required)
  - `listAuditCheckpoints.response.403.errors.detail` (string, required)
- `listAuditCheckpoints.response.403.retry_after` (integer | null, optional)

### 422

The request was understood and its content is not valid. `errors` names each field.

#### Example

```json
{
  "type": "http://example.com",
  "title": "string",
  "status": 0,
  "code": "string",
  "category": "validation",
  "detail": "string",
  "request_id": "string",
  "errors": [
    {
      "path": "string",
      "code": "string",
      "detail": "string"
    }
  ],
  "retry_after": 0,
  "docs_url": "http://example.com"
}
```

- `listAuditCheckpoints.response.422.type` (string, required)
  - format `uri`
- `listAuditCheckpoints.response.422.title` (string, required)
- `listAuditCheckpoints.response.422.status` (integer, required)
- `listAuditCheckpoints.response.422.code` (string, required)
- `listAuditCheckpoints.response.422.category` (string, required)
  - one of `"validation"`, `"authentication"`, `"authorization"`, `"not_found"`, `"conflict"`, `"precondition"`, `"quota"`, `"rate_limit"`, `"upstream"`, `"internal"`
- `listAuditCheckpoints.response.422.detail` (string, required)
- `listAuditCheckpoints.response.422.request_id` (string, required)
- `listAuditCheckpoints.response.422.docs_url` (string, required)
  - format `uri`
- `listAuditCheckpoints.response.422.errors` (array<object>, optional)
  - `listAuditCheckpoints.response.422.errors.path` (string, required) — RFC 6901 JSON Pointer into the request body.
  - `listAuditCheckpoints.response.422.errors.code` (string, required)
  - `listAuditCheckpoints.response.422.errors.detail` (string, required)
- `listAuditCheckpoints.response.422.retry_after` (integer | null, optional)

### 429

A rate limit or a concurrency cap was reached. `Retry-After` says when to try again.

#### Example

```json
{
  "type": "http://example.com",
  "title": "string",
  "status": 0,
  "code": "string",
  "category": "validation",
  "detail": "string",
  "request_id": "string",
  "errors": [
    {
      "path": "string",
      "code": "string",
      "detail": "string"
    }
  ],
  "retry_after": 0,
  "docs_url": "http://example.com"
}
```

- `listAuditCheckpoints.response.429.type` (string, required)
  - format `uri`
- `listAuditCheckpoints.response.429.title` (string, required)
- `listAuditCheckpoints.response.429.status` (integer, required)
- `listAuditCheckpoints.response.429.code` (string, required)
- `listAuditCheckpoints.response.429.category` (string, required)
  - one of `"validation"`, `"authentication"`, `"authorization"`, `"not_found"`, `"conflict"`, `"precondition"`, `"quota"`, `"rate_limit"`, `"upstream"`, `"internal"`
- `listAuditCheckpoints.response.429.detail` (string, required)
- `listAuditCheckpoints.response.429.request_id` (string, required)
- `listAuditCheckpoints.response.429.docs_url` (string, required)
  - format `uri`
- `listAuditCheckpoints.response.429.errors` (array<object>, optional)
  - `listAuditCheckpoints.response.429.errors.path` (string, required) — RFC 6901 JSON Pointer into the request body.
  - `listAuditCheckpoints.response.429.errors.code` (string, required)
  - `listAuditCheckpoints.response.429.errors.detail` (string, required)
- `listAuditCheckpoints.response.429.retry_after` (integer | null, optional)

### 500

Something failed at our end. Quote `request_id` when reporting it.

#### Example

```json
{
  "type": "http://example.com",
  "title": "string",
  "status": 0,
  "code": "string",
  "category": "validation",
  "detail": "string",
  "request_id": "string",
  "errors": [
    {
      "path": "string",
      "code": "string",
      "detail": "string"
    }
  ],
  "retry_after": 0,
  "docs_url": "http://example.com"
}
```

- `listAuditCheckpoints.response.500.type` (string, required)
  - format `uri`
- `listAuditCheckpoints.response.500.title` (string, required)
- `listAuditCheckpoints.response.500.status` (integer, required)
- `listAuditCheckpoints.response.500.code` (string, required)
- `listAuditCheckpoints.response.500.category` (string, required)
  - one of `"validation"`, `"authentication"`, `"authorization"`, `"not_found"`, `"conflict"`, `"precondition"`, `"quota"`, `"rate_limit"`, `"upstream"`, `"internal"`
- `listAuditCheckpoints.response.500.detail` (string, required)
- `listAuditCheckpoints.response.500.request_id` (string, required)
- `listAuditCheckpoints.response.500.docs_url` (string, required)
  - format `uri`
- `listAuditCheckpoints.response.500.errors` (array<object>, optional)
  - `listAuditCheckpoints.response.500.errors.path` (string, required) — RFC 6901 JSON Pointer into the request body.
  - `listAuditCheckpoints.response.500.errors.code` (string, required)
  - `listAuditCheckpoints.response.500.errors.detail` (string, required)
- `listAuditCheckpoints.response.500.retry_after` (integer | null, optional)


Source: https://docs.quirelms.com/api/audit/listAuditCheckpoints/index.md