Skip to content
Kindgi

List authz decision audit events

View as Markdown
GET
/v1/audit/authz
curl --request GET \
  --url 'https://example.com/v1/audit/authz?limit=25&outcome=allowed&order=asc' \
  --header 'Authorization: Bearer <token>'

Cursor-paginated read of authz-decision audit events for the tenant. Filters (all AND-composed): ?actorSubject= / ?onBehalfOf= / ?action= / ?resource= / ?outcome= / ?runId= / ?from= / ?to=. Oldest first; ?order=desc for newest first. Admin@tenant only. Only mounted when CreateAppInput.auditEvents is wired.

Authorizations

Section titled “Authorizations”

Parameters

Section titled “Parameters”

Query Parameters

Section titled “Query Parameters”
limit
integer
default: 25 >= 1 <= 100

1..100. Default 25.

cursor
string

Where the previous page ended: its nextCursor, as it came. A runtime that seals cursors takes one only for the same list, filters and caller, within a day; otherwise 400 bad-input, and the list starts again without it. Absent → first page.

actorSubject
string

Filter to decisions issued for this actor (user:... / agent:...).

onBehalfOf
string

Filter to delegated decisions on-behalf-of this subject.

action
string

Filter by action verb (read | write | admin | execute | …).

resource
string

Filter to decisions on this fully-qualified resource (type:id).

outcome
string
Allowed values: allowed denied

Restrict to allowed or denied decisions.

runId
string

Filter to decisions issued inside this run.

from
string format: date-time

ISO 8601 lower bound (inclusive) on timestamp.

to
string format: date-time

ISO 8601 upper bound (inclusive) on timestamp.

order
string
Allowed values: asc desc

asc (the default): oldest first. desc: newest first. nextCursor continues in the same order.

Responses

Section titled “Responses”

200

Section titled “200”

Page of authz decision audit events.

Media typeapplication/json
object
data
required
Array<object>
object
id
required
string
tenantId
required
string
timestamp
required
string format: date-time
actorSubject
required
string
onBehalfSubject
string
action
required
string
resource
required
string
outcome
required
string
Allowed values: allowed denied
reason
required
string
failing
string
evidence
object
key
additional properties
any
correlationId
string
runId
string
latencyMs
number
hasMore
required
boolean
nextCursor
string
Example
{
  "data": [
    {
      "outcome": "allowed"
    }
  ]
}

400

Section titled “400”

Malformed cursor, from, to, outcome, or order.

Media typeapplication/json
object
error
required
object
code
required

Stable machine-readable discriminant. Values match domain error codes (see docs/API-ROUTE-CONVENTIONS.md §4.3).

string
message
required
string
details

Optional, kind-specific.

object
key
additional properties
any
requestId
required

Server-assigned request id; also echoed via X-Request-Id header.

string
Examplegenerated
{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}

401

Section titled “401”

Missing / malformed / expired / revoked bearer token.

Media typeapplication/json
object
error
required
object
code
required

Stable machine-readable discriminant. Values match domain error codes (see docs/API-ROUTE-CONVENTIONS.md §4.3).

string
message
required
string
details

Optional, kind-specific.

object
key
additional properties
any
requestId
required

Server-assigned request id; also echoed via X-Request-Id header.

string
Examplegenerated
{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}

See also