---
title: "oz0 audit verify"
description: "Check the audit log's hash chains."
canonical_url: "https://docs.oz0.ai/reference/cli/oz0/audit/verify"
---
# oz0 audit verify

> Check the audit log's hash chains.

For: Operators and developers looking up a command.

Check the audit log's hash chains. Each tenant has its own chain, and the cluster has one for its own entries. Without --tenant, cluster admins check every chain. With --file, check an export instead, without the cluster: its entries, the head line it ends with, and that every redacted entry is listed by the erasure or retention entry that redacted it. Compare the head it prints with the one this command shows on the cluster.

An export made without the content permission holds blinded entries, whose hashes cannot be checked: their export's signed head covers them, and --key pins whose signature that must be. Such a file fails without --key, since an edit of a blinded entry leaves the head as it was and anyone can sign; --unpinned checks it all the same, and shows only that the file is whole.

An export's head is signed with the audit key. --complete and --key each fail unless that signature is there and verifies; without them a file with an unsigned head, such as an older server's, is checked as far as its own hashes go, and the command says so. Anyone can sign, so --complete also needs --key, or --unpinned to say that showing the file is whole is enough. The command calls a file complete only when --key pinned its signature.

These flags check a file, so they need --file, and an empty --key is refused.

The command fails when a chain is broken, and says at which entry.

## Usage

```bash
oz0 audit verify [flags]
```

## Flags

<table>
<thead>
  <tr>
    <th>
      Flag
    </th>
    
    <th>
      Type
    </th>
    
    <th>
      Default
    </th>
    
    <th>
      Description
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        --cluster
      </code>
    </td>
    
    <td>
      bool
    </td>
    
    <td>
      
    </td>
    
    <td>
      check only the cluster's own chain
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --complete
      </code>
    </td>
    
    <td>
      bool
    </td>
    
    <td>
      
    </td>
    
    <td>
      with --file: fail unless the export runs from the chain's base to its head, and its head's signature verifies; needs --key or --unpinned
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --file
      </code>
    </td>
    
    <td>
      file
    </td>
    
    <td>
      
    </td>
    
    <td>
      check an export file (JSON lines from audit export) instead of the cluster's log; - reads stdin
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --json
      </code>
    </td>
    
    <td>
      bool
    </td>
    
    <td>
      
    </td>
    
    <td>
      print JSON instead of a table
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --key
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      with --file: the audit key's fingerprint (or public key) that must have signed the export's head, as oz0 audit key prints it; an export with no signed head fails
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --tenant
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      check this tenant's chain
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --unpinned
      </code>
    </td>
    
    <td>
      bool
    </td>
    
    <td>
      
    </td>
    
    <td>
      with --file: check an export with blinded entries, or --complete, without --key, which shows only that it is whole: whoever edited it could have signed it again
    </td>
  </tr>
</tbody>
</table>

## Inherited flags

<table>
<thead>
  <tr>
    <th>
      Flag
    </th>
    
    <th>
      Type
    </th>
    
    <th>
      Default
    </th>
    
    <th>
      Description
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        --context
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        $OZ0_CONTEXT or &lt;config dir>/orchestrator-zero/context.json
      </code>
    </td>
    
    <td>
      CLI context file written by server init
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --log-level
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        info
      </code>
    </td>
    
    <td>
      log level: debug, info, warn or error
    </td>
  </tr>
</tbody>
</table>

See [all `oz0` commands](https://docs.oz0.ai/reference/cli/oz0) and the [global flags](https://docs.oz0.ai/reference/cli/oz0#global-flags).


## Sitemap

See the full [sitemap](https://docs.oz0.ai/sitemap.md) for all pages.