Sigilbase documentation#

Sigilbase is a tamper-evident audit log for software teams. Your systems append events to named streams over a small HTTP API. Once written, an event cannot be changed, deleted, or reordered without detection.

The guarantee, stated plainly: every event carries a SHA-256 hash chained to the event before it, and every few minutes the new events in each stream are sealed into a Merkle checkpoint signed with Ed25519. Anyone holding an evidence bundle and the public signing keys can recompute every hash and check every signature themselves, with a standalone verifier that does not trust Sigilbase, its database, or the person who exported the bundle. If a single byte of a sealed event were altered, the recomputation would fail.

Sigilbase does not claim your events were true when written. It proves that what was written is exactly what you are reading now, and that nothing in a sealed range has been added, removed, or edited since.

Where to start#

• Quickstart: first event to first seal in ten minutes.
• Sending events: the ingestion endpoint in full, including every error.
• Reading and proofs: list events and verify a single event's inclusion.
• API reference: every endpoint, generated from openapi.yaml.
• Evidence bundles: the export format specification.
• How verification works: written for auditors, printable.
• Security model: claims you can test, and how.