Overview
Stateway provides a complete, tamper-evident audit trail for every process execution. Every definition version, every gateway decision, every timer fire, and every decision rule evaluation is recorded and cryptographically linked.
Hash Verification
Every definition version stores a SHA-256 hash of its source content (source_hash). This hash lets you prove — without privileged database access — that a specific file is byte-for-byte identical to what Stateway stored and executed.
Audit Log
Stateway maintains a unified audit log that records both API-level and engine-level events in a single sequence. Every action — from creating a process instance to the engine resolving a gateway — appears in this log.
Chain Integrity
Stateway's audit log is tamper-evident. Each entry includes a cryptographic hash (entryHash) computed over the entry's own content plus the hash of the immediately preceding entry (prevEntryHash). This creates an unbroken chain: deleting, inserting, or modifying any entry in the middle produces a detectable mismatch.
Hash Chain Algorithm
Chain Integrity describes GET /v1/audit/verify, which checks the audit log's hash chain on Stateway's servers. This page documents the underlying algorithm precisely enough that you can recompute and verify the same hash chain independently — for example, over audit log entries you've retrieved or exported yourself — without calling that endpoint.
Decision Trail
Every DMN decision evaluation — whether triggered directly via the API or by a businessRuleTask inside a running process — is automatically persisted. The record captures the exact inputs, which rules matched, and the outputs produced.