> ## Documentation Index
> Fetch the complete documentation index at: https://docs.manthan.systems/llms.txt
> Use this file to discover all available pages before exploring further.

# Trust Chain Audit

> Reading a Business Transaction's full history for audit purposes

`GET /trust-records/:id` is the only endpoint that returns a transaction's complete history in one call — every other read endpoint (`GET /verification/:id`, `GET /receipt/latest/:id`) returns only the single most recent entry from the corresponding array.

## Fetch the full record

<CodeGroup>
  ```bash cURL theme={null}
  curl http://localhost:3000/trust-records/b6f1c8de-1a2b-4c3d-8e9f-0a1b2c3d4e5f
  ```

  ```ts TypeScript SDK theme={null}
  const trustRecord = await client.trustRecord(businessTransactionId);
  ```

  ```python Python SDK theme={null}
  trust_record = client.trust_records.get(business_transaction_id)
  ```
</CodeGroup>

## What to look at

```ts theme={null}
interface ExecutionTrustRecord {
  transaction: BusinessTransaction;   // the original request — Authority, Authorization, Intent, Policy, signals
  executions: Execution[];            // each references the Decision that authorized it
  verifications: Verification[];      // one per POST /verify call
  receipts: Receipt[];                // one per POST /receipt call
  overrides: Override[];              // human corrections, if any — see below
  trustRecordHash: string;
  createdAt: Date;
  updatedAt: Date;
}
```

Because every one of these arrays is append-only (see [Architecture → Security Model](/docs/architecture/security-model)), the full audit trail for a transaction is always exactly what you see here — nothing has been edited in place, and a transaction re-verified five times will show five `Verification` entries, not one overwritten five times.

## What an audit can and can't currently confirm

* **Can confirm**: the record hasn't been altered since it was written (`POST /replay` or `POST /verify` — both run the same hash check today, see [Deterministic Replay](/docs/guides/deterministic-replay)).
* **Can confirm**: exactly which Decision, Execution, Verification(s), and Receipt(s) exist for this transaction, in the order they were appended.
* **Cannot yet confirm, through this API**: whether the recorded Decision matches what the referenced Policy would produce today, given the recorded signals — that's what [`@parmana/replay`](/docs/packages/replay)'s `ReplayEngine` does, but it isn't wired into any endpoint (see [Deterministic Replay](/docs/guides/deterministic-replay)).
* **Cannot yet confirm, through this API**: whether a human Override was recorded — the array exists on the type, but there is currently no way to create one over HTTP or through either SDK (see [Human Override](/docs/guides/human-override)). An empty `overrides: []` today does not distinguish "nothing was overridden" from "the platform has no way to record an override yet."

<Note>
  `examples/04-trust-record`'s `run.ts` is currently an unimplemented stub (`console.log("Parmana Example 04 - Trust Record")`) — there's no runnable example of this flow in the monorepo yet.
</Note>

## Related

<CardGroup cols={2}>
  <Card title="Trust Records (REST API)" href="/docs/api/trust-records">The endpoint reference.</Card>
  <Card title="Execution Trust Record" href="/docs/concepts/execution-trust-record">The full model.</Card>
  <Card title="Deterministic Replay" href="/docs/guides/deterministic-replay">What auditing can't yet confirm on its own.</Card>
  <Card title="Human Override" href="/docs/guides/human-override">The other gap in what's confirmable today.</Card>
</CardGroup>