Sign in
AuditExport

List audit events from the SIEM feed

Changed on

Returns a paginated list of SIEM audit events for a tenant — the full chained feed (MCP, edge, worker, output policy, delegation, license, ...) sourced from the per-tenant Redis Stream populated by the audit chainer. Distinct from /api/v1/policy/audit, which only surfaces the policy-bundle audit subset.

Reverse-chronological by chain sequence. Filters (event_type / severity / from / to / search) apply in-process after the stream read. Defense-in-depth redaction strips Extra-map keys matching the secret-key pattern (token / password / api_key / private_key / secret) before serialization.

Every successful read appends an audit.read.events event to the same chain so the read surface is itself auditable.

Permission: audit.read (admin/operator/viewer with RBAC; admin via legacy-role fallback). 503 when the audit chainer is not configured.

get/api/v1/audit/events

Request

  • Base URL: http://localhost:8081
  • URL: http://localhost:8081/api/v1/audit/events
  • Auth: one of:
    • API key in header X-API-Key
    • HTTP bearer

Query parameters

tenantstring

Tenant id whose audit stream should be read. Must match caller scope; defaults to the authenticated/header tenant.

limitinteger

Maximum number of events in the response page. Default 100; values above 200 are clamped to 200 silently to bound Redis fetch cost.

cursorstring

Opaque cursor returned as next_cursor by the previous page. Pass back verbatim to fetch the next page. Empty next_cursor means end-of-stream.

event_typestring

Case-insensitive exact match against the event type (e.g. mcp.tool_invocation).

severitystring

Case-insensitive exact match against severity (CRITICAL / HIGH / MEDIUM / LOW / INFO).

fromstring date-time

Inclusive lower-bound on event timestamp (RFC3339).

tostring date-time

Inclusive upper-bound on event timestamp (RFC3339).

searchstring

Case-insensitive substring search over the lowercased concatenation of action + event_type + agent_id + job_id + identity + reason.

Headers

X-Tenant-IDstring required

Tenant isolation header (required on all protected routes).

Response

Audit events envelope

next_cursorstring required

Opaque cursor for the next page; empty when no more events.

returnedinteger required

Number of items in this page (== items.length).

Changes