Security feed and audit

Security events for your SIEM

GET /api/security/events?format=cef&after=<cursor>&minSeverity=4&limit=1000

• format: json (default), cef (ArcSight Common Event Format lines) or ocsf (Open Cybersecurity Schema Framework).
• Returns events oldest first with a cursor for the next call and more, so nothing is skipped or repeated.
• Events cover sign-ins and refusals, account and role changes, SCIM provisioning, agent tokens, supplier bank changes, documents kept from the AI provider, legal holds, exports and hourly ledger.checkpoint signatures.

Poll it with a session for a service account that holds audit.view only.

Verify the ledger

GET /api/audit/verify checks the tenant’s hash chain from the first event and every stored checkpoint.

Each hour the server signs each tenant’s ledger head (HMAC-SHA256 over its sequence number and hash, under a key derived from the tenant’s data key) and emits it as a ledger.checkpoint security event, so your SIEM holds copies outside Spend. To catch a ledger that was cut short, or rewritten and re-hashed by someone with database access, post your SIEM’s copies:

POST /api/audit/verify
{ "checkpoints": [{ "seq": 48000, "hash": "...", "at": "2026-10-28T17:00:00Z", "mac": "..." }] }

Export a tenant

GET /api/admin/export (administrators only) streams newline-delimited JSON: every record, every stored original document and the full ledger, ending with counts, a ledger verification result and a SHA-256 checksum. The export is itself recorded on the ledger.