API reference
2 operations in audit. Raw spec: openapi.json.
GET
/api/v1/audit-eventsGET /api/audit-events — append-only audit trail. Newest first by default; `order=asc` + `after` turns it into a forward-only export tail.
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
before | query | — | No | Legacy cursor (kept for compatibility): strictly older than this. |
cursor | query | — | No | Keyset cursor from a previous page's `next_cursor`; strictly older than this position (newest-first mode). |
after | query | — | No | EXPORT cursor: a previous page's `next_cursor` in ascending mode. Rows strictly AFTER this position, oldest first, so an external consumer can resume exactly where it stopped. Mutually exclusive with `cursor`. |
order | query | — | No | `desc` (default) for a human list, `asc` for an export tail. `after` implies `asc`. |
actor | query | — | No | Actor filter: user uuid or "system". |
action | query | — | No | Action prefix filter, e.g. "auth" matches every auth.* event. |
from | query | — | No | Inclusive lower bound on occurred_at. |
to | query | — | No | Inclusive upper bound on occurred_at. |
limit | query | integer | No |
Responses
| Status | Description |
|---|---|
200 | |
400 | cursor and after are mutually exclusive, order is not asc|desc, or a cursor does not decode |
Security: bearer
GET
/api/v1/provenanceGET /api/provenance — the provenance read model: who / record+field / before-after / actor kind / agent session+skill+rule-set hash / when, newest first, filterable, cursor-paged. Extends the 2.3 audit-log query API with provenance-grade filters backed by the materialized projection (no raw-row scans).
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
cursor | query | — | No | Keyset cursor from a previous page's `next_cursor`. |
actor_kind | query | — | No | Actor-kind filter (the write-trail vocabulary: human, agent, import, ...). |
actor | query | — | No | The "who" filter: a user uuid. Ignored (forced to the caller) for callers without the audit permission. |
entity | query | — | No | Entity family, e.g. "ticket". Required by `entity_id` and `field`. |
entity_id | query | — | No | Record id; requires `entity`. |
field | query | — | No | Single-field provenance; requires `entity`. |
session_id | query | — | No | Agent session filter (rows carry it when present). |
skill | query | — | No | Agent skill filter (rows carry it when present). |
ruleset_hash | query | — | No | Rule-set hash filter (rows carry it when present). |
undo | query | — | No | Restrict to undo reverts (`true`) or exclude them (`false`). |
from | query | — | No | Inclusive lower bound on occurred_at. |
to | query | — | No | Inclusive upper bound on occurred_at. |
limit | query | integer | No |
Responses
| Status | Description |
|---|---|
200 |
Security: bearer