Prove overview

A record you can hand to an auditor

Every governed action leaves evidence: the checks it passed, who approved it and exactly what it changed. Prove → Overview brings the evidence chain, approval history, checks and release gates, incidents, reviewers and the audit log together in one place.

The evidence chain

Open Prove → Evidence. Each governed write adds two entries: the decision (dispatched, approval required or denied) and, once the write is dispatched, the result (succeeded or failed). Checks runs, release gate decisions, overrides, connector validation runs, signed webhook deliveries and uploaded files are recorded on the same chain.

Each entry records:

Raw inputs, provider payloads, error messages and secrets are never stored. The hashes let you prove what was sent without keeping the data itself.

How the chain holds

Every entry carries the hash of the entry before it, starting from genesis. Entries are numbered without gaps per workspace and written one at a time, so the order is fixed. The database refuses to update or delete an entry. Changing or removing any entry breaks every hash after it.

Verify

Choose Verify now on the Evidence page. Nexra recomputes the whole chain from the first entry and reports whether it holds and, if not, the first entry that breaks it. Each verification is itself recorded.

GET /api/console/connect/governance/evidence/verify

{
  "valid": true,
  "checked": 18342,
  "brokenAtSequence": null,
  "verifiedAt": "2026-10-09T08:30:12.904Z"
}

Timeline

Open any entry to see its action's timeline: the decision, the approval request, the approval decision, the execution and the result, with who acted and when. A write that waited for approval and then ran is shown as one story.

GET /api/console/connect/governance/actions/:actionId/timeline

Export

Choose Export evidence and pick a date range. The download is a JSON document in the nexra.connect.governed-action-evidence.v1 format with an integrity block that always covers the whole chain, so an auditor can recompute every hash independently.

{
  "format": "nexra.connect.governed-action-evidence.v1",
  "workspaceId": "<workspace id>",
  "exportedAt": "2026-10-09T08:31:02.441Z",
  "hashAlgorithm": "sha256",
  "chainGenesis": "genesis",
  "integrity": {
    "valid": true,
    "brokenAtSequence": null,
    "entries": 18342,
    "headHash": "5e0b9d4c…"
  },
  "truncated": false,
  "range": { "from": "2026-10-01T00:00:00.000Z", "to": "2026-10-08T23:59:59.999Z" },
  "entries": [
    {
      "sequence": 18120,
      "actionId": "<action id>",
      "eventType": "decision",
      "connectorKey": "quickbooks-online",
      "operationKey": "invoices.create",
      "source": "flow",
      "decision": "require_approval",
      "decisionRule": "policy_require_approval",
      "outcome": "approval_required",
      "inputHash": "a3f1…",
      "previousHash": "77c2…",
      "hash": "d904…",
      "occurredAt": "2026-10-03T10:14:51.007Z"
    }
  ]
}

Exporting needs both connect.audit.read and audit.export (Owner, Admin, Security administrator and Compliance reviewer), and each export is written to the audit log.

The audit log

Prove → Audit log lists who changed keys, credentials, policies, grants, triggers, templates and members in the workspace, and when. Secret values are removed before anything is stored.

Export signed log downloads the filtered events as newline-delimited JSON with its SHA-256 digest and an HMAC-SHA256 signature, so a copy can be checked against tampering after it leaves Nexra.

GET /api/developer-portal/audit-events/export?from=2026-10-01&to=2026-10-08

{
  "format": "application/x-ndjson",
  "algorithm": "HMAC-SHA256",
  "count": 412,
  "generatedAt": "2026-10-09T08:40:00.000Z",
  "window": { "from": "2026-10-01T00:00:00.000Z", "to": "2026-10-08T00:00:00.000Z" },
  "sha256": "c0ffee12…",
  "hmac": "8b1d77e0…",
  "content": "{\"action\":\"connect.policy.updated\", …}\n…"
}

Measures

Measures show governance at a glance for the last 7 or 30 days. They appear on Govern → Overview and Prove → Overview.

GET /api/console/connect/governance/measures?window=30d

{
  "window": "30d",
  "since": "2026-09-09T08:45:00.000Z",
  "writes": { "allowed": 1284, "approvalRequired": 96, "denied": 14 },
  "approvals": {
    "pending": 3,
    "approved": 88,
    "rejected": 5,
    "expired": 2,
    "medianDecisionMinutes": 11.5
  },
  "denialsByRule": [
    { "rule": "amount_per_action_exceeded", "count": 9 },
    { "rule": "risk_tier_r4_denied", "count": 5 }
  ],
  "evidence": { "entries": 18342, "lastVerifiedAt": "2026-10-09T08:30:12.904Z", "valid": true },
  "checks": { … }
}

The checks block summarises checks runs, reviews and incidents (see Checks and release gates).

API

All routes are under /api/console/connect/governance and need connect.audit.read.

Next