Immutable audit history

What you configure

getAuditHistory

Read the workflow's immutable audit snapshot.

verifyAuditHistory

Verify ordering and hash consistency in the supplied history.

persistAudit

Append entries to a customer-controlled durable ledger when required.

Integration code example

1. Provide meaningful actor IDs and roles when submitting or approving workflow operations.
2. Retain audit entries through the optional backend adapter.
3. Verify retrieved history and anchor or sign checkpoints outside the browser when your assurance requirements call for it.

Copy this TypeScript into your application, not the browser console. Replace YOUR_WTS_LICENSE_KEY with an entitlement issued for your deployment origin. A WTS license is not a Google, Microsoft or CalDAV credential. These examples are documentation only and never execute on this page.

npm install @wts-calendar/core

import { verifyCalendarLicense } from '@wts-calendar/core';
import { EnterpriseCalendarWorkflow } from '@wts-calendar/core/enterprise-workflow';

const license = await verifyCalendarLicense('YOUR_WTS_LICENSE_KEY');
const workflow = new EnterpriseCalendarWorkflow({
  license,
  actor: { id: 'editor-1', roles: ['editor'] },
  online: false,
  autoFlush: false,
  events: [
    {
      id: 'release',
      title: 'Release window',
      start: '2026-09-07T09:00:00Z',
      end: '2026-09-07T10:00:00Z',
    },
  ],
  defaultPermission: 'deny',
  permissionPolicies: [
    {
      id: 'editor-update',
      effect: 'allow',
      actions: ['update', 'flush'],
      roles: ['editor'],
    },
  ],
});

await workflow.submit({
  type: 'update',
  eventId: 'release',
  changes: { title: 'Reviewed release' },
});
workflow.setOnline(true);
await workflow.flush();
export const history = workflow.getAuditHistory();
export const intact = await workflow.verifyAuditHistory(history);
console.log(intact, history);

Application responsibilities

This sample is runtime-only and initially offline. No database or WTS backend is required. Without your own backend adapter, flush commits only in memory and reload loses the state.

Actor IDs and roles are sample data, not authentication. A shared backend must authenticate users and independently enforce permissions, approval stages and event versions.

Frozen, hash-chained snapshots detect edits within a retained chain. They are not durable or tamper-proof if an attacker replaces the whole chain; regulated systems need an external append-only ledger and trusted checkpoints.

Behavior and lifecycle

• Audit appends are serialized and entries include both their own hash and the previous hash.
• Verification can detect reordered, removed, or modified entries in the supplied chain.