How to read, and design, a verification audit log
APIZONE
·
·updated 8 Sep 2026 ·
1 min read
When a regulator, an auditor, or the customer asks what you checked and why, your audit log is the answer. Here is what it must contain.
On this page
Per-check fields
For every verification call: timestamp, the acting user or system, the purpose and linked case id, the identifier checked (masked in the log where possible), the source, the raw result reference, and the decision your system made from it.
Immutability and retention
The log should be append-only and retained for at least your longest statutory requirement. If you can quietly edit a verification record, it is not an audit log.
Make it queryable
You will be asked to show every check on a customer and every check for a purpose in a quarter. Design the schema so both are a simple query, not a log-scraping exercise.