---
title: "List Shroud activity events"
method: GET
path: "/v1/shroud/activity"
tags: ["Shroud"]
---

# List Shroud activity events

`GET /v1/shroud/activity`

## Request

- Base URL: `https://api.1claw.co`
- URL: `https://api.1claw.co/v1/shroud/activity`
- Auth: HTTP bearer

Returns recent Shroud proxy activity for the organization (LLM requests, inspections, policy actions).

## Query parameters

- `agent_id` string
- `action` string
- `limit` integer
- `offset` integer

## Response `200`

Activity events

- object
  - `events` ShroudActivityEvent[]
    - `id` string, uuid
    - `org_id` string, uuid
    - `agent_id` string
    - `provider` string
    - `model` string
    - `action` string: Action taken (allowed, blocked, warned)
    - `request_tokens` integer
    - `response_tokens` integer
    - `latency_ms` integer
    - `had_secrets_redacted` boolean
    - `had_pii_detected` boolean
    - `injection_score` number
    - `policy_violations` string[]
    - `response_injection_score` number: Response-side prompt-injection score (0.0–1.0).
    - `response_context_injection_score` number: Response-side context-injection score (0.0–1.0).
    - `response_injection_categories` string[]: Category tags emitted by the response-side filters (e.g. `markdown_image_exfil`, `data_uri_blob`, `echoed_instruction`).
    - `external_urls_flagged` string[]: URLs emitted by the model that were flagged as potential exfil / callback targets.
    - `unexpected_code_blocks` integer: Number of code fences in the response that were not expected for the agent's allowed task set.
    - `content_filtered` boolean: True when Shroud rewrote or blocked response content before returning it to the agent.
    - `metadata` object
    - `timestamp` string, date-time
  - `total` integer

## Other responses

- `401`: Unauthorized

---

[API](https://skmtc.dev/1claw/apis/1claw-api.md) · [All operations](https://skmtc.dev/1claw/apis/1claw-api/llms.txt) · [OpenAPI document](https://skmtc.dev/1claw/apis/1claw-api/revisions/ae109b496830?raw)