---
title: "Who actually read from which vault"
method: GET
path: "/v1/otel/flows"
tags: ["Observability"]
---

# Who actually read from which vault

`GET /v1/otel/flows`

## Request

- Base URL: `https://api.1claw.co`
- URL: `https://api.1claw.co/v1/otel/flows`
- Auth: HTTP bearer

Reachability (the topology's policy edges) says who *could* read a vault. This says who *did*, counted from `audit_events.action = 'secret.read'` — the durable record every read already writes — grouped by agent and vault. That is what lets a Sankey ribbon's width be a count of real reads rather than a guess.

Agent actors only; a human reading a secret through the dashboard is not an agent flow. Deleted agents and vaults are kept and labelled as such — a read that happened is still a read.

## Query parameters

- `window` string

## Response `200`

Read flows, highest first

- object
  - `window` object, required
    - `window_secs` integer
    - `step_secs` integer
  - `edges` object[], required
    - `agent_id` string, uuid, required
    - `agent_name` string, required
    - `vault_id` string, uuid, required
    - `vault_name` string, required
    - `reads` integer, required: secret.read events in the window.
    - `distinct_paths` integer, required: Distinct secret paths touched.
  - `total_reads` integer, required

## Other responses

- `400`: Unparseable window or window over 30d
- `401`: Unauthenticated
- `403`: Not a human user

---

[API](https://skmtc.dev/1claw/apis/1claw-api.md) · [All operations](https://skmtc.dev/1claw/apis/1claw-api/llms.txt) · [OpenAPI document](https://skmtc.dev/1claw/apis/1claw-api/revisions/5fa0918f3b41?raw)