---
title: "GET /audit-rules/"
method: GET
path: "/audit-rules/"
tags: ["audit-rules"]
---

# GET /audit-rules/

`GET /audit-rules/`

List all fired rules

## Query parameters

- `name` string
- `ordering` string
- `page` integer
- `page_size` integer

## Response `200`

Return a list of fired rules.

- PaginatedAuditRuleListList
  - `count` integer
  - `next` string, uri, nullable
  - `previous` string, uri, nullable
  - `page_size` integer, nullable
  - `page` integer, nullable
  - `results` AuditRuleList[]
    - `id` integer, required — ID of the fired rule
    - `name` string, required — Name of the fired rule
    - `status` string — Status of the fired rule
    - `activation_instance` object, required
      - `id` integer, nullable
      - `name` string
    - `organization` object, required
      - `id` integer
      - `name` string
      - `description` string
    - `fired_at` string, date-time, required — The fired timestamp of the rule

## Changes

- **2024-04-23** `cbf68ddd9760` — 4 info
  - the endpoint scheme security `EDAJWTAuthentication` was added to the API
  - the endpoint scheme security `jwtAuth` was added to the API
  - added the new optional `query` request parameter `ordering`
  - added the required property `results/items/organization` to the response with the `200` status
- **2023-08-21** `c84b4813cab1` — 3 breaking, 5 warning, 3 info
  - removed the required property `results/items/activation_instance_id` from the response with the `200` status
  - removed the required property `results/items/created_at` from the response with the `200` status
  - removed the required property `results/items/job_instance_id` from the response with the `200` status
  - removed the optional property `results/items/definition` from the response with the `200` status
  - …7 more
- **2023-05-19** `f84d9240fdf2` — 2 warning, 3 info
  - removed the optional property `results/items/activation_instance` from the response with the `200` status
  - removed the optional property `results/items/job_instance` from the response with the `200` status
  - the endpoint scheme security `cookieAuth` was removed from the API
  - added the required property `results/items/activation_instance_id` to the response with the `200` status
  - …1 more
- …earlier changes not shown

[Full history](https://skmtc.dev/ansible/apis/event-driven-ansible-api/changes/audit-rules/get.md)

---

[API](https://skmtc.dev/ansible/apis/event-driven-ansible-api.md) · [All operations](https://skmtc.dev/ansible/apis/event-driven-ansible-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/ansible/event-driven-ansible-api/revisions/c04fc5f09692/schema)