diff --git a/src/ZB.MOM.WW.ScadaBridge.CLI/Commands/AuditCommands.cs b/src/ZB.MOM.WW.ScadaBridge.CLI/Commands/AuditCommands.cs
index 9b588e35..e608aa9e 100644
--- a/src/ZB.MOM.WW.ScadaBridge.CLI/Commands/AuditCommands.cs
+++ b/src/ZB.MOM.WW.ScadaBridge.CLI/Commands/AuditCommands.cs
@@ -6,13 +6,15 @@ namespace ZB.MOM.WW.ScadaBridge.CLI.Commands;
 /// <summary>
 /// The <c>scadabridge audit</c> command group (Audit Log #23 M8). Provides read access to
 /// the centralized append-only Audit Log via the Bundle B REST endpoints
-/// (<c>GET /api/audit/query</c>, <c>GET /api/audit/export</c>), plus a v1 no-op
-/// <c>verify-chain</c> placeholder for the deferred hash-chain tamper-evidence feature.
+/// (<c>GET /api/audit/query</c>, <c>GET /api/audit/export</c>,
+/// <c>GET /api/audit/tree</c>), plus a v1 no-op <c>verify-chain</c> placeholder
+/// for the deferred hash-chain tamper-evidence feature.
 /// </summary>
 public static class AuditCommands
 {
     /// <summary>
-    /// Builds the <c>audit</c> command group with query, export, and verify-chain sub-commands.
+    /// Builds the <c>audit</c> command group with query, export, tree, and verify-chain
+    /// sub-commands.
     /// </summary>
     /// <param name="urlOption">Global <c>--url</c> option for the management API endpoint.</param>
     /// <param name="formatOption">Global <c>--format</c> option for output format.</param>
@@ -25,6 +27,7 @@ public static class AuditCommands
 
         command.Add(BuildQuery(urlOption, formatOption, usernameOption, passwordOption));
         command.Add(BuildExport(urlOption, formatOption, usernameOption, passwordOption));
+        command.Add(BuildTree(urlOption, formatOption, usernameOption, passwordOption));
         command.Add(BuildVerifyChain(urlOption, formatOption, usernameOption, passwordOption));
 
         return command;
@@ -224,6 +227,44 @@ public static class AuditCommands
         return cmd;
     }
 
+    private static Command BuildTree(Option<string> urlOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
+    {
+        var executionIdOption = new Option<string>("--execution-id")
+        {
+            Description = "Execution ID (GUID) to look up — may be any node in the chain",
+            Required = true,
+        };
+
+        var cmd = new Command("tree") { Description = "Display the full execution-chain tree for an audit execution" };
+        cmd.Add(executionIdOption);
+
+        cmd.SetAction(async (ParseResult result) =>
+        {
+            var connection = AuditCommandHelpers.ResolveConnection(result, urlOption, usernameOption, passwordOption);
+            if (connection.Error != null)
+            {
+                OutputFormatter.WriteError(connection.Error, connection.ErrorCode!);
+                return 1;
+            }
+
+            var rawId = result.GetValue(executionIdOption);
+            if (!Guid.TryParse(rawId, out var executionId))
+            {
+                OutputFormatter.WriteError(
+                    $"Invalid execution ID '{rawId}'. Expected a GUID (e.g. 11111111-1111-1111-1111-111111111111).",
+                    "INVALID_ARGUMENT");
+                return 1;
+            }
+
+            var format = AuditCommandHelpers.ResolveFormat(result, formatOption);
+
+            using var client = new ManagementHttpClient(connection.Url!, connection.Username!, connection.Password!);
+            return await AuditTreeHelpers.RunTreeAsync(client, executionId, format, Console.Out);
+        });
+
+        return cmd;
+    }
+
     private static Command BuildVerifyChain(Option<string> urlOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var monthOption = new Option<string>("--month") { Description = "Month to verify (YYYY-MM)", Required = true };
diff --git a/src/ZB.MOM.WW.ScadaBridge.CLI/Commands/AuditTreeHelpers.cs b/src/ZB.MOM.WW.ScadaBridge.CLI/Commands/AuditTreeHelpers.cs
new file mode 100644
index 00000000..66662949
--- /dev/null
+++ b/src/ZB.MOM.WW.ScadaBridge.CLI/Commands/AuditTreeHelpers.cs
@@ -0,0 +1,208 @@
+using System.Text;
+using System.Text.Json;
+
+namespace ZB.MOM.WW.ScadaBridge.CLI.Commands;
+
+/// <summary>
+/// Arguments for an <c>audit tree</c> invocation.
+/// </summary>
+public sealed class AuditTreeArgs
+{
+    /// <summary>
+    /// The execution ID (GUID) to look up. May be any node in the chain — the
+    /// server walks to the root and returns the full tree.
+    /// </summary>
+    public string ExecutionId { get; set; } = string.Empty;
+}
+
+/// <summary>
+/// Represents one execution node as returned by <c>GET /api/audit/tree</c>.
+/// Property names match the server's camelCase JSON serialisation of
+/// <c>ExecutionTreeNode</c>.
+/// </summary>
+internal sealed class AuditTreeNodeDto
+{
+    public Guid ExecutionId { get; init; }
+    public Guid? ParentExecutionId { get; init; }
+    public int RowCount { get; init; }
+    public string[] Channels { get; init; } = Array.Empty<string>();
+    public string[] Statuses { get; init; } = Array.Empty<string>();
+    public string? SourceSiteId { get; init; }
+    public string? SourceInstanceId { get; init; }
+    public DateTime? FirstOccurredAtUtc { get; init; }
+    public DateTime? LastOccurredAtUtc { get; init; }
+}
+
+/// <summary>
+/// Pure helpers for the <c>audit tree</c> subcommand: builds the query string,
+/// calls <c>GET /api/audit/tree</c>, and renders the result as either an
+/// indented ASCII tree (table format) or raw JSON. Kept separate from the
+/// command wiring so each piece is unit-testable without standing up the
+/// command tree.
+/// </summary>
+public static class AuditTreeHelpers
+{
+    private static readonly JsonSerializerOptions JsonReadOptions = new()
+    {
+        PropertyNameCaseInsensitive = true,
+    };
+
+    private static readonly JsonSerializerOptions JsonWriteOptions = new()
+    {
+        PropertyNamingPolicy = JsonNamingPolicy.CamelCase,
+        WriteIndented = true,
+    };
+
+    /// <summary>
+    /// Builds the query string for <c>GET /api/audit/tree</c>.
+    /// </summary>
+    /// <param name="executionId">The execution ID GUID.</param>
+    /// <returns>A relative path + query string ready to append to the base URL.</returns>
+    public static string BuildUrl(Guid executionId)
+        => $"api/audit/tree?executionId={executionId:D}";
+
+    /// <summary>
+    /// Executes the tree lookup: GETs <c>/api/audit/tree</c> and renders the result
+    /// in the requested format. Returns the process exit code (0 = success,
+    /// 1 = error, 2 = authorization failure).
+    /// </summary>
+    /// <param name="client">The management HTTP client.</param>
+    /// <param name="executionId">The execution ID to look up.</param>
+    /// <param name="format">"table" (default) or "json".</param>
+    /// <param name="output">The output writer for results.</param>
+    /// <returns>A task that resolves to the process exit code.</returns>
+    public static async Task<int> RunTreeAsync(
+        ManagementHttpClient client,
+        Guid executionId,
+        string format,
+        TextWriter output)
+    {
+        var url = BuildUrl(executionId);
+        var response = await client.SendGetAsync(url, TimeSpan.FromSeconds(30));
+
+        if (response.JsonData == null)
+        {
+            OutputFormatter.WriteError(
+                response.Error ?? "Audit tree request failed.", response.ErrorCode ?? "ERROR");
+            return CommandHelpers.IsAuthorizationFailure(response) ? 2 : 1;
+        }
+
+        var nodes = ParseNodes(response.JsonData);
+
+        if (format == "json")
+        {
+            WriteJson(nodes, output);
+        }
+        else
+        {
+            WriteTable(nodes, executionId, output);
+        }
+
+        output.Flush();
+        return 0;
+    }
+
+    /// <summary>
+    /// Parses the JSON array from the server into an array of
+    /// <see cref="AuditTreeNodeDto"/>.
+    /// </summary>
+    /// <param name="json">The raw JSON response body.</param>
+    /// <returns>An array of deserialized tree nodes (empty on parse failure).</returns>
+    internal static AuditTreeNodeDto[] ParseNodes(string json)
+    {
+        try
+        {
+            return JsonSerializer.Deserialize<AuditTreeNodeDto[]>(json, JsonReadOptions)
+                   ?? Array.Empty<AuditTreeNodeDto>();
+        }
+        catch (JsonException)
+        {
+            return Array.Empty<AuditTreeNodeDto>();
+        }
+    }
+
+    /// <summary>
+    /// Renders the nodes as pretty-printed JSON to <paramref name="output"/>.
+    /// </summary>
+    internal static void WriteJson(AuditTreeNodeDto[] nodes, TextWriter output)
+    {
+        output.WriteLine(JsonSerializer.Serialize(nodes, JsonWriteOptions));
+    }
+
+    /// <summary>
+    /// Renders the nodes as an indented ASCII tree. The root node (null
+    /// <c>ParentExecutionId</c>) is printed first; each child is indented
+    /// two spaces per depth level. The queried/entry-point node is marked
+    /// with <c> [*]</c>.
+    /// </summary>
+    internal static void WriteTable(
+        AuditTreeNodeDto[] nodes,
+        Guid queriedExecutionId,
+        TextWriter output)
+    {
+        if (nodes.Length == 0)
+        {
+            output.WriteLine("(no execution tree found)");
+            return;
+        }
+
+        // Build a parent → children lookup (keyed by non-null parent Guid).
+        // Nodes whose ParentExecutionId is null are roots and are not placed in
+        // the lookup; they are identified separately below.
+        var childrenOf = new Dictionary<Guid, List<AuditTreeNodeDto>>();
+        foreach (var node in nodes)
+        {
+            if (node.ParentExecutionId is { } parentId)
+            {
+                if (!childrenOf.ContainsKey(parentId))
+                    childrenOf[parentId] = new List<AuditTreeNodeDto>();
+                childrenOf[parentId].Add(node);
+            }
+        }
+
+        // Identify roots: nodes whose ParentExecutionId is null, or whose parent
+        // is not present in the node set (stub-root case).
+        var nodeIds = new HashSet<Guid>(nodes.Select(n => n.ExecutionId));
+        var roots = nodes
+            .Where(n => n.ParentExecutionId == null || !nodeIds.Contains(n.ParentExecutionId.Value))
+            .ToList();
+
+        // Render depth-first.
+        var sb = new StringBuilder();
+        foreach (var root in roots)
+        {
+            RenderNode(root, depth: 0, childrenOf, queriedExecutionId, sb);
+        }
+
+        output.Write(sb.ToString());
+    }
+
+    private static void RenderNode(
+        AuditTreeNodeDto node,
+        int depth,
+        Dictionary<Guid, List<AuditTreeNodeDto>> childrenOf,
+        Guid queriedExecutionId,
+        StringBuilder sb)
+    {
+        var indent = new string(' ', depth * 2);
+        var marker = node.ExecutionId == queriedExecutionId ? " [*]" : string.Empty;
+        var channels = node.Channels.Length > 0 ? string.Join(",", node.Channels) : "-";
+        var statuses = node.Statuses.Length > 0 ? string.Join(",", node.Statuses) : "-";
+        var site = node.SourceSiteId ?? "-";
+        var instance = node.SourceInstanceId ?? "-";
+        var first = node.FirstOccurredAtUtc.HasValue
+            ? node.FirstOccurredAtUtc.Value.ToString("yyyy-MM-ddTHH:mm:ssZ")
+            : "-";
+
+        sb.AppendLine(
+            $"{indent}{node.ExecutionId:D}{marker}  rows={node.RowCount}  channels=[{channels}]  statuses=[{statuses}]  site={site}  instance={instance}  first={first}");
+
+        if (childrenOf.TryGetValue(node.ExecutionId, out var children))
+        {
+            foreach (var child in children)
+            {
+                RenderNode(child, depth + 1, childrenOf, queriedExecutionId, sb);
+            }
+        }
+    }
+}
diff --git a/src/ZB.MOM.WW.ScadaBridge.ManagementService/AuditEndpoints.cs b/src/ZB.MOM.WW.ScadaBridge.ManagementService/AuditEndpoints.cs
index a66481f8..631ce5e6 100644
--- a/src/ZB.MOM.WW.ScadaBridge.ManagementService/AuditEndpoints.cs
+++ b/src/ZB.MOM.WW.ScadaBridge.ManagementService/AuditEndpoints.cs
@@ -18,13 +18,17 @@ namespace ZB.MOM.WW.ScadaBridge.ManagementService;
 
 /// <summary>
 /// Minimal-API endpoints exposing the central Audit Log (#23) over HTTP for the
-/// ScadaBridge CLI (M8). Two routes:
+/// ScadaBridge CLI (M8). Three routes:
 /// <list type="bullet">
 ///   <item><c>GET /api/audit/query</c> — keyset-paged JSON page, gated on the
 ///   <see cref="AuthorizationPolicies.OperationalAudit"/> permission.</item>
 ///   <item><c>GET /api/audit/export</c> — streamed bulk export (csv / jsonl;
 ///   parquet returns HTTP 501), gated on the
 ///   <see cref="AuthorizationPolicies.AuditExport"/> permission.</item>
+///   <item><c>GET /api/audit/tree</c> — execution-chain tree rooted at the
+///   topmost ancestor of a given <c>executionId</c>, returned as a JSON array
+///   of <see cref="ExecutionTreeNode"/>; gated on
+///   <see cref="AuthorizationPolicies.OperationalAudit"/>.</item>
 /// </list>
 ///
 /// <para>
@@ -86,7 +90,8 @@ public static class AuditEndpoints
     };
 
     /// <summary>
-    /// Registers the <c>/api/audit/query</c> and <c>/api/audit/export</c> minimal-API endpoints.
+    /// Registers the <c>/api/audit/query</c>, <c>/api/audit/export</c>, and
+    /// <c>/api/audit/tree</c> minimal-API endpoints.
     /// </summary>
     /// <param name="endpoints">The endpoint route builder to register routes on.</param>
     /// <returns>The same <paramref name="endpoints"/> builder, for chaining.</returns>
@@ -94,6 +99,7 @@ public static class AuditEndpoints
     {
         endpoints.MapGet("/api/audit/query", (Delegate)HandleQuery);
         endpoints.MapGet("/api/audit/export", (Delegate)HandleExport);
+        endpoints.MapGet("/api/audit/tree", (Delegate)HandleTree);
         return endpoints;
     }
 
@@ -232,6 +238,47 @@ public static class AuditEndpoints
         return Results.Empty;
     }
 
+    // ─────────────────────────────────────────────────────────────────────
+    // GET /api/audit/tree
+    // ─────────────────────────────────────────────────────────────────────
+
+    /// <summary>
+    /// Handles <c>GET /api/audit/tree?executionId=...</c>: authenticates, checks the
+    /// OperationalAudit permission, and returns the full execution-chain tree rooted at
+    /// the topmost ancestor of the supplied <c>executionId</c>. The response is a JSON
+    /// array of <see cref="ExecutionTreeNode"/> objects (empty array when the id is
+    /// not found). Returns HTTP 400 when <c>executionId</c> is absent or not a valid
+    /// GUID.
+    /// </summary>
+    /// <param name="context">The HTTP context for the current request.</param>
+    /// <returns>A task that resolves to the HTTP result (200 JSON array, 400, 401, or 403).</returns>
+    internal static async Task<IResult> HandleTree(HttpContext context)
+    {
+        var auth = await AuthenticateAsync(context);
+        if (auth.Failure is not null)
+        {
+            return auth.Failure;
+        }
+
+        if (!HasAnyRole(auth.User!, AuthorizationPolicies.OperationalAuditRoles))
+        {
+            return Forbidden("OperationalAudit");
+        }
+
+        var raw = context.Request.Query["executionId"].ToString();
+        if (string.IsNullOrWhiteSpace(raw) || !Guid.TryParse(raw, out var executionId))
+        {
+            return Results.Json(
+                new { error = "Missing or invalid 'executionId' query parameter (expected a GUID).", code = "BAD_REQUEST" },
+                statusCode: 400);
+        }
+
+        var repo = context.RequestServices.GetRequiredService<IAuditLogRepository>();
+        var nodes = await repo.GetExecutionTreeAsync(executionId, context.RequestAborted);
+
+        return Results.Json(nodes, JsonOptions);
+    }
+
     /// <summary>
     /// Streams every matching row as RFC 4180 CSV, paging the repository with its
     /// keyset cursor and flushing after each page so a large export starts
diff --git a/tests/ZB.MOM.WW.ScadaBridge.CLI.Tests/Commands/AuditTreeCommandTests.cs b/tests/ZB.MOM.WW.ScadaBridge.CLI.Tests/Commands/AuditTreeCommandTests.cs
new file mode 100644
index 00000000..cae5687c
--- /dev/null
+++ b/tests/ZB.MOM.WW.ScadaBridge.CLI.Tests/Commands/AuditTreeCommandTests.cs
@@ -0,0 +1,346 @@
+using System.CommandLine;
+using System.Net;
+using System.Text;
+using System.Text.Json;
+using ZB.MOM.WW.ScadaBridge.CLI;
+using ZB.MOM.WW.ScadaBridge.CLI.Commands;
+
+namespace ZB.MOM.WW.ScadaBridge.CLI.Tests.Commands;
+
+/// <summary>
+/// Tests for the <c>scadabridge audit tree</c> subcommand (Audit Log #23 M5.1-T8):
+/// tree rendering (table format), JSON output, error handling, and CLI parsing.
+/// </summary>
+[Collection("Console")]
+public class AuditTreeCommandTests
+{
+    // ─────────────────────────────────────────────────────────────────────
+    // JSON parsing helpers
+    // ─────────────────────────────────────────────────────────────────────
+
+    private static string NodeJson(
+        string executionId,
+        string? parentId = null,
+        int rowCount = 3,
+        string[]? channels = null,
+        string[]? statuses = null,
+        string? siteId = "plant-a",
+        string? instanceId = "inst-1",
+        string? first = "2026-05-20T10:00:00Z",
+        string? last = "2026-05-20T10:01:00Z")
+    {
+        var parentStr = parentId != null ? $"\"{parentId}\"" : "null";
+        var channelArr = channels is { Length: > 0 }
+            ? "[" + string.Join(",", channels.Select(c => $"\"{c}\"")) + "]"
+            : "[\"ApiOutbound\"]";
+        var statusArr = statuses is { Length: > 0 }
+            ? "[" + string.Join(",", statuses.Select(s => $"\"{s}\"")) + "]"
+            : "[\"Delivered\"]";
+        var siteStr = siteId != null ? $"\"{siteId}\"" : "null";
+        var instanceStr = instanceId != null ? $"\"{instanceId}\"" : "null";
+        var firstStr = first != null ? $"\"{first}\"" : "null";
+        var lastStr = last != null ? $"\"{last}\"" : "null";
+
+        return $@"{{
+""executionId"":""{executionId}"",
+""parentExecutionId"":{parentStr},
+""rowCount"":{rowCount},
+""channels"":{channelArr},
+""statuses"":{statusArr},
+""sourceSiteId"":{siteStr},
+""sourceInstanceId"":{instanceStr},
+""firstOccurredAtUtc"":{firstStr},
+""lastOccurredAtUtc"":{lastStr}
+}}";
+    }
+
+    // ─────────────────────────────────────────────────────────────────────
+    // ParseNodes
+    // ─────────────────────────────────────────────────────────────────────
+
+    [Fact]
+    public void ParseNodes_ValidArray_ReturnsDtos()
+    {
+        var root = "11111111-1111-1111-1111-111111111111";
+        var child = "22222222-2222-2222-2222-222222222222";
+        var json = $"[{NodeJson(root)},{NodeJson(child, parentId: root)}]";
+
+        var nodes = AuditTreeHelpers.ParseNodes(json);
+
+        Assert.Equal(2, nodes.Length);
+        Assert.Equal(Guid.Parse(root), nodes[0].ExecutionId);
+        Assert.Null(nodes[0].ParentExecutionId);
+        Assert.Equal(Guid.Parse(child), nodes[1].ExecutionId);
+        Assert.Equal(Guid.Parse(root), nodes[1].ParentExecutionId);
+        Assert.Equal(3, nodes[0].RowCount);
+    }
+
+    [Fact]
+    public void ParseNodes_EmptyArray_ReturnsEmpty()
+    {
+        var nodes = AuditTreeHelpers.ParseNodes("[]");
+        Assert.Empty(nodes);
+    }
+
+    [Fact]
+    public void ParseNodes_InvalidJson_ReturnsEmpty()
+    {
+        var nodes = AuditTreeHelpers.ParseNodes("not-json");
+        Assert.Empty(nodes);
+    }
+
+    // ─────────────────────────────────────────────────────────────────────
+    // WriteTable — ASCII tree rendering
+    // ─────────────────────────────────────────────────────────────────────
+
+    [Fact]
+    public void WriteTable_EmptyNodes_PrintsFallbackMessage()
+    {
+        var output = new StringWriter();
+        AuditTreeHelpers.WriteTable(Array.Empty<AuditTreeNodeDto>(), Guid.NewGuid(), output);
+        Assert.Contains("no execution tree found", output.ToString());
+    }
+
+    [Fact]
+    public void WriteTable_SingleRootNode_PrintsWithNoIndent()
+    {
+        var rootId = Guid.Parse("11111111-1111-1111-1111-111111111111");
+        var nodes = AuditTreeHelpers.ParseNodes($"[{NodeJson(rootId.ToString())}]");
+
+        var output = new StringWriter();
+        AuditTreeHelpers.WriteTable(nodes, rootId, output);
+        var text = output.ToString();
+
+        // Root node printed at column 0 (no leading spaces).
+        var line = text.Split('\n', StringSplitOptions.RemoveEmptyEntries).First();
+        Assert.StartsWith(rootId.ToString("D"), line);
+        Assert.Contains("[*]", line);  // queried node marked
+    }
+
+    [Fact]
+    public void WriteTable_MultiLevelTree_IndentsChildrenCorrectly()
+    {
+        var rootId = "11111111-1111-1111-1111-111111111111";
+        var childId = "22222222-2222-2222-2222-222222222222";
+        var grandChildId = "33333333-3333-3333-3333-333333333333";
+        var json = $"[{NodeJson(rootId)},{NodeJson(childId, parentId: rootId)},{NodeJson(grandChildId, parentId: childId)}]";
+        var nodes = AuditTreeHelpers.ParseNodes(json);
+
+        var output = new StringWriter();
+        AuditTreeHelpers.WriteTable(nodes, Guid.Parse(rootId), output);
+        var lines = output.ToString().Split('\n', StringSplitOptions.RemoveEmptyEntries);
+
+        // Root: no indent.
+        Assert.True(lines[0].StartsWith(rootId, StringComparison.OrdinalIgnoreCase) ||
+                    lines[0].StartsWith(rootId.ToUpper(), StringComparison.OrdinalIgnoreCase));
+
+        // Child: 2-space indent (exactly 2, not 4+).
+        var childLine = lines.First(l => l.Contains(childId));
+        Assert.StartsWith("  ", childLine);
+        Assert.False(childLine.StartsWith("    ", StringComparison.Ordinal), "child should be indented exactly 2, not 4+");
+
+        // Grandchild: 4-space indent.
+        var grandLine = lines.First(l => l.Contains(grandChildId));
+        Assert.StartsWith("    ", grandLine);
+    }
+
+    [Fact]
+    public void WriteTable_QueriedNodeIsMarked_OthersAreNot()
+    {
+        var rootId = Guid.Parse("11111111-1111-1111-1111-111111111111");
+        var childId = Guid.Parse("22222222-2222-2222-2222-222222222222");
+        var json = $"[{NodeJson(rootId.ToString())},{NodeJson(childId.ToString(), parentId: rootId.ToString())}]";
+        var nodes = AuditTreeHelpers.ParseNodes(json);
+
+        // Query via child ID — child should be marked, root should not.
+        var output = new StringWriter();
+        AuditTreeHelpers.WriteTable(nodes, childId, output);
+        var lines = output.ToString().Split('\n', StringSplitOptions.RemoveEmptyEntries);
+
+        var childLine = lines.First(l => l.Contains(childId.ToString("D")));
+        var rootLine = lines.First(l => l.Contains(rootId.ToString("D")));
+        Assert.Contains("[*]", childLine);
+        Assert.DoesNotContain("[*]", rootLine);
+    }
+
+    // ─────────────────────────────────────────────────────────────────────
+    // WriteJson
+    // ─────────────────────────────────────────────────────────────────────
+
+    [Fact]
+    public void WriteJson_ValidNodes_EmitsValidJsonArray()
+    {
+        var rootId = "11111111-1111-1111-1111-111111111111";
+        var childId = "22222222-2222-2222-2222-222222222222";
+        var nodes = AuditTreeHelpers.ParseNodes($"[{NodeJson(rootId)},{NodeJson(childId, parentId: rootId)}]");
+
+        var output = new StringWriter();
+        AuditTreeHelpers.WriteJson(nodes, output);
+        var text = output.ToString();
+
+        using var doc = JsonDocument.Parse(text);
+        Assert.Equal(JsonValueKind.Array, doc.RootElement.ValueKind);
+        Assert.Equal(2, doc.RootElement.GetArrayLength());
+    }
+
+    [Fact]
+    public void WriteJson_EmptyNodes_EmitsEmptyArray()
+    {
+        var output = new StringWriter();
+        AuditTreeHelpers.WriteJson(Array.Empty<AuditTreeNodeDto>(), output);
+        var text = output.ToString().Trim();
+
+        using var doc = JsonDocument.Parse(text);
+        Assert.Equal(JsonValueKind.Array, doc.RootElement.ValueKind);
+        Assert.Equal(0, doc.RootElement.GetArrayLength());
+    }
+
+    // ─────────────────────────────────────────────────────────────────────
+    // RunTreeAsync — HTTP execution
+    // ─────────────────────────────────────────────────────────────────────
+
+    private sealed class FixedHandler : HttpMessageHandler
+    {
+        private readonly HttpStatusCode _status;
+        private readonly string _body;
+
+        public FixedHandler(HttpStatusCode status, string body)
+        {
+            _status = status;
+            _body = body;
+        }
+
+        public string? LastRequestUri { get; private set; }
+
+        protected override Task<HttpResponseMessage> SendAsync(
+            HttpRequestMessage request, CancellationToken cancellationToken)
+        {
+            LastRequestUri = request.RequestUri!.PathAndQuery;
+            return Task.FromResult(new HttpResponseMessage(_status)
+            {
+                Content = new StringContent(_body, Encoding.UTF8, "application/json"),
+            });
+        }
+    }
+
+    [Fact]
+    public async Task RunTree_Success_ReturnsZeroAndWritesOutput()
+    {
+        var rootId = "11111111-1111-1111-1111-111111111111";
+        var json = $"[{NodeJson(rootId)}]";
+        var handler = new FixedHandler(HttpStatusCode.OK, json);
+        var client = new ManagementHttpClient(new HttpClient(handler), "http://localhost:9001", "u", "p");
+        var output = new StringWriter();
+
+        var exit = await AuditTreeHelpers.RunTreeAsync(
+            client, Guid.Parse(rootId), "table", output);
+
+        Assert.Equal(0, exit);
+        Assert.Contains(rootId, output.ToString());
+    }
+
+    [Fact]
+    public async Task RunTree_EmptyResponse_ReturnsZeroWithFallbackMessage()
+    {
+        var handler = new FixedHandler(HttpStatusCode.OK, "[]");
+        var client = new ManagementHttpClient(new HttpClient(handler), "http://localhost:9001", "u", "p");
+        var output = new StringWriter();
+
+        var exit = await AuditTreeHelpers.RunTreeAsync(
+            client, Guid.NewGuid(), "table", output);
+
+        Assert.Equal(0, exit);
+        Assert.Contains("no execution tree found", output.ToString());
+    }
+
+    [Fact]
+    public async Task RunTree_JsonFormat_EmitsValidJson()
+    {
+        var rootId = "11111111-1111-1111-1111-111111111111";
+        var handler = new FixedHandler(HttpStatusCode.OK, $"[{NodeJson(rootId)}]");
+        var client = new ManagementHttpClient(new HttpClient(handler), "http://localhost:9001", "u", "p");
+        var output = new StringWriter();
+
+        var exit = await AuditTreeHelpers.RunTreeAsync(
+            client, Guid.Parse(rootId), "json", output);
+
+        Assert.Equal(0, exit);
+        using var doc = JsonDocument.Parse(output.ToString());
+        Assert.Equal(JsonValueKind.Array, doc.RootElement.ValueKind);
+    }
+
+    [Fact]
+    public async Task RunTree_Http403_ReturnsExitCode2()
+    {
+        var handler = new FixedHandler(HttpStatusCode.Forbidden, "{\"error\":\"nope\",\"code\":\"UNAUTHORIZED\"}");
+        var client = new ManagementHttpClient(new HttpClient(handler), "http://localhost:9001", "u", "p");
+        var output = new StringWriter();
+
+        var exit = await AuditTreeHelpers.RunTreeAsync(
+            client, Guid.NewGuid(), "table", output);
+
+        Assert.Equal(2, exit);
+    }
+
+    [Fact]
+    public async Task RunTree_Http500_ReturnsExitCode1()
+    {
+        var handler = new FixedHandler(HttpStatusCode.InternalServerError, "{\"error\":\"boom\",\"code\":\"INTERNAL\"}");
+        var client = new ManagementHttpClient(new HttpClient(handler), "http://localhost:9001", "u", "p");
+        var output = new StringWriter();
+
+        var exit = await AuditTreeHelpers.RunTreeAsync(
+            client, Guid.NewGuid(), "table", output);
+
+        Assert.Equal(1, exit);
+    }
+
+    [Fact]
+    public async Task RunTree_RequestUrlContainsExecutionId()
+    {
+        var id = Guid.Parse("11111111-1111-1111-1111-111111111111");
+        var handler = new FixedHandler(HttpStatusCode.OK, "[]");
+        var client = new ManagementHttpClient(new HttpClient(handler), "http://localhost:9001", "u", "p");
+        var output = new StringWriter();
+
+        await AuditTreeHelpers.RunTreeAsync(client, id, "table", output);
+
+        Assert.Contains("11111111-1111-1111-1111-111111111111", handler.LastRequestUri);
+        Assert.Contains("executionId", handler.LastRequestUri);
+    }
+
+    // ─────────────────────────────────────────────────────────────────────
+    // CLI parsing — audit tree subcommand
+    // ─────────────────────────────────────────────────────────────────────
+
+    [Fact]
+    public void Tree_Subcommand_ExistsInAuditCommandGroup()
+    {
+        var root = AuditCommandTestHarness.BuildRoot();
+        var parse = root.Parse(new[] { "audit", "tree", "--help" });
+        // --help is never an error, exit 0.
+        Assert.Empty(parse.Errors);
+    }
+
+    [Fact]
+    public void Tree_ExecutionIdOption_IsRequired()
+    {
+        // Invoking without --execution-id must produce an error (the option is Required).
+        var root = AuditCommandTestHarness.BuildRoot();
+        var (exit, _, err) = AuditCommandTestHarness.Invoke(root, "audit", "tree");
+        // System.CommandLine returns non-zero for a missing required option.
+        Assert.NotEqual(0, exit);
+    }
+
+    [Fact]
+    public void Tree_HelpText_DescribesExecutionId()
+    {
+        var root = AuditCommandTestHarness.BuildRoot();
+        var output = new StringWriter();
+        var exit = root.Parse(new[] { "audit", "tree", "--help" })
+            .Invoke(new InvocationConfiguration { Output = output });
+
+        Assert.Equal(0, exit);
+        Assert.Contains("execution-id", output.ToString());
+    }
+}
diff --git a/tests/ZB.MOM.WW.ScadaBridge.ManagementService.Tests/AuditEndpointsTests.cs b/tests/ZB.MOM.WW.ScadaBridge.ManagementService.Tests/AuditEndpointsTests.cs
index 0013617a..53b95fa9 100644
--- a/tests/ZB.MOM.WW.ScadaBridge.ManagementService.Tests/AuditEndpointsTests.cs
+++ b/tests/ZB.MOM.WW.ScadaBridge.ManagementService.Tests/AuditEndpointsTests.cs
@@ -610,4 +610,179 @@ public class AuditEndpointsTests
         Assert.NotNull(result);
         Assert.Equal(new[] { "plant-a" }, result!.SourceSiteIds);
     }
+
+    // ─────────────────────────────────────────────────────────────────────
+    // /api/audit/tree
+    // ─────────────────────────────────────────────────────────────────────
+
+    /// <summary>
+    /// Builds a TestServer with the audit-log endpoints wired up and the repository
+    /// stub returning the supplied <paramref name="treeNodes"/> for
+    /// <c>GetExecutionTreeAsync</c>.
+    /// </summary>
+    private static async Task<(HttpClient Client, IAuditLogRepository Repo, IHost Host)> BuildHostWithTreeAsync(
+        string[] roles,
+        IReadOnlyList<ExecutionTreeNode>? treeNodes = null)
+    {
+        var repo = Substitute.For<IAuditLogRepository>();
+
+        // Default QueryAsync stub so the shared host initialisation does not fail.
+        repo.QueryAsync(Arg.Any<AuditLogQueryFilter>(), Arg.Any<AuditLogPaging>(), Arg.Any<CancellationToken>())
+            .Returns(Task.FromResult<IReadOnlyList<AuditEvent>>(Array.Empty<AuditEvent>()));
+
+        var returnNodes = treeNodes ?? Array.Empty<ExecutionTreeNode>();
+        repo.GetExecutionTreeAsync(Arg.Any<Guid>(), Arg.Any<CancellationToken>())
+            .Returns(Task.FromResult<IReadOnlyList<ExecutionTreeNode>>(returnNodes));
+
+        var ldap = Substitute.For<ILdapAuthService>();
+        ldap.AuthenticateAsync(Arg.Any<string>(), Arg.Any<string>(), Arg.Any<CancellationToken>())
+            .Returns(LdapAuthResult.Success("auditor", "Auditor", new[] { "audit" }));
+
+        var roleMapper = Substitute.For<RoleMapper>(Substitute.For<ISecurityRepository>());
+        roleMapper.MapGroupsToRolesAsync(Arg.Any<IReadOnlyList<string>>(), Arg.Any<CancellationToken>())
+            .Returns(new RoleMappingResult(roles, Array.Empty<string>(), IsSystemWideDeployment: true));
+
+        var hostBuilder = new HostBuilder()
+            .ConfigureWebHost(web =>
+            {
+                web.UseTestServer();
+                web.ConfigureServices(services =>
+                {
+                    services.AddRouting();
+                    services.AddSingleton(repo);
+                    services.AddSingleton(ldap);
+                    services.AddSingleton(roleMapper);
+                });
+                web.Configure(app =>
+                {
+                    app.UseRouting();
+                    app.UseEndpoints(endpoints => endpoints.MapAuditAPI());
+                });
+            });
+
+        var host = await hostBuilder.StartAsync();
+        return (host.GetTestClient(), repo, host);
+    }
+
+    private static ExecutionTreeNode MakeNode(Guid id, Guid? parentId = null, int rowCount = 2) =>
+        new ExecutionTreeNode(
+            ExecutionId: id,
+            ParentExecutionId: parentId,
+            RowCount: rowCount,
+            Channels: new[] { "ApiOutbound" },
+            Statuses: new[] { "Delivered" },
+            SourceSiteId: "plant-a",
+            SourceInstanceId: "inst-1",
+            FirstOccurredAtUtc: new DateTime(2026, 5, 20, 10, 0, 0, DateTimeKind.Utc),
+            LastOccurredAtUtc: new DateTime(2026, 5, 20, 10, 1, 0, DateTimeKind.Utc));
+
+    [Fact]
+    public async Task Tree_ValidExecutionId_ReturnsJsonArray()
+    {
+        var root = Guid.Parse("aaaaaaaa-0000-0000-0000-000000000001");
+        var child = Guid.Parse("aaaaaaaa-0000-0000-0000-000000000002");
+        var nodes = new[]
+        {
+            MakeNode(root),
+            MakeNode(child, parentId: root),
+        };
+
+        var (client, repo, host) = await BuildHostWithTreeAsync(
+            roles: new[] { "Administrator" },
+            treeNodes: nodes);
+        using (host)
+        {
+            var response = await client.SendAsync(Get($"/api/audit/tree?executionId={root:D}"));
+
+            Assert.Equal(HttpStatusCode.OK, response.StatusCode);
+            Assert.Equal("application/json", response.Content.Headers.ContentType!.MediaType);
+
+            using var doc = JsonDocument.Parse(await response.Content.ReadAsStringAsync());
+            Assert.Equal(JsonValueKind.Array, doc.RootElement.ValueKind);
+            Assert.Equal(2, doc.RootElement.GetArrayLength());
+
+            await repo.Received(1).GetExecutionTreeAsync(root, Arg.Any<CancellationToken>());
+        }
+    }
+
+    [Fact]
+    public async Task Tree_RepoReturnsEmpty_ReturnsEmptyArray()
+    {
+        var id = Guid.NewGuid();
+        var (client, _, host) = await BuildHostWithTreeAsync(
+            roles: new[] { "Administrator" },
+            treeNodes: Array.Empty<ExecutionTreeNode>());
+        using (host)
+        {
+            var response = await client.SendAsync(Get($"/api/audit/tree?executionId={id:D}"));
+
+            Assert.Equal(HttpStatusCode.OK, response.StatusCode);
+
+            using var doc = JsonDocument.Parse(await response.Content.ReadAsStringAsync());
+            Assert.Equal(JsonValueKind.Array, doc.RootElement.ValueKind);
+            Assert.Equal(0, doc.RootElement.GetArrayLength());
+        }
+    }
+
+    [Fact]
+    public async Task Tree_MissingExecutionId_Returns400()
+    {
+        var (client, _, host) = await BuildHostWithTreeAsync(roles: new[] { "Administrator" });
+        using (host)
+        {
+            var response = await client.SendAsync(Get("/api/audit/tree"));
+
+            Assert.Equal(HttpStatusCode.BadRequest, response.StatusCode);
+        }
+    }
+
+    [Fact]
+    public async Task Tree_InvalidExecutionId_Returns400()
+    {
+        var (client, _, host) = await BuildHostWithTreeAsync(roles: new[] { "Administrator" });
+        using (host)
+        {
+            var response = await client.SendAsync(Get("/api/audit/tree?executionId=not-a-guid"));
+
+            Assert.Equal(HttpStatusCode.BadRequest, response.StatusCode);
+            var body = await response.Content.ReadAsStringAsync();
+            Assert.Contains("BAD_REQUEST", body);
+        }
+    }
+
+    [Fact]
+    public async Task Tree_WithoutOperationalAudit_Returns403()
+    {
+        var (client, _, host) = await BuildHostWithTreeAsync(roles: new[] { "Designer" });
+        using (host)
+        {
+            var response = await client.SendAsync(Get($"/api/audit/tree?executionId={Guid.NewGuid():D}"));
+
+            Assert.Equal(HttpStatusCode.Forbidden, response.StatusCode);
+        }
+    }
+
+    [Fact]
+    public async Task Tree_WithoutCredentials_Returns401()
+    {
+        var (client, _, host) = await BuildHostWithTreeAsync(roles: new[] { "Administrator" });
+        using (host)
+        {
+            var response = await client.SendAsync(Get($"/api/audit/tree?executionId={Guid.NewGuid():D}", credential: ""));
+
+            Assert.Equal(HttpStatusCode.Unauthorized, response.StatusCode);
+        }
+    }
+
+    [Fact]
+    public async Task Tree_ViewerRole_IsAllowed()
+    {
+        var (client, _, host) = await BuildHostWithTreeAsync(roles: new[] { "Viewer" });
+        using (host)
+        {
+            var response = await client.SendAsync(Get($"/api/audit/tree?executionId={Guid.NewGuid():D}"));
+
+            Assert.Equal(HttpStatusCode.OK, response.StatusCode);
+        }
+    }
 }