# Verifying audit exports with keenauth audit verify

`keenauth audit verify` checks a management audit export on your own machine. It does not contact KeenAuth, needs no API key and no `keenauth login` session, so you do not have to trust the platform to trust the export.

## What it proves

The command takes the export bundle you downloaded (a tar file with `records.ndjson.gz`, `manifest.json` and `manifest.jws`) and the regional `audit-jwks.json`. It then:

1. checks the signature of `manifest.jws` with the audit checkpoint key and that `manifest.json` is its payload;
2. checks the size and SHA-256 of `records.ndjson.gz` against the manifest;
3. recomputes the hash of every record, and checks that the sequence numbers are consecutive and every record points to the hash of the previous one;
4. rebuilds the leaf of each hour and follows its inclusion proof (RFC 9162) to the root of the signed hourly checkpoint.

So it proves that the records in the bundle were not changed, removed or reordered. It does not prove that your filters were applied correctly. The leaf contains the environment ID, so a proof for another environment does not hold for your records.

## Usage

```sh
keenauth audit verify --bundle audit-export.tar --jwks audit-jwks.json --environment-id 0192b6f0-7c1e-7a55-8f3d-2a6f0e9d4b11
```

| Flag | Description |
|---|---|
| `--bundle` | Path of the downloaded export bundle (required). |
| `--jwks` | Path of the regional `audit-jwks.json` (required). |
| `--environment-id` | Environment ID (UUID) the bundle must belong to. Recommended: without it the command prints a warning and does not check the environment. |
| `--output`, `-o` | `table`, `json` or `yaml`. Without the flag the CLI prints a table on a terminal and JSON otherwise. |

On success the command prints a summary (`verified`, `export_id`, `environment_id`, `cell`, `stream`, `from`, `to`, `record_count`, `line_count`, `windows`, `key_id`, `include_ip`) and exits with code 0. `record_count` counts the records that match your filter; `line_count` also counts the placeholder lines for records outside the filter.

If any check fails, the command prints nothing to standard output, writes `audit verification failed (<kind>)` to standard error and exits with code 1. The kind is `signature`, `manifest`, `chain`, `proof` or `format`. An unreadable file or a missing flag exits with code 2.

See [the audit export API](/docs/api/management/audit-exports/create) for how to create and download an export.