Policy

Get policy audit log

Changed on

Returns a filtered, paginated list of policy audit events. Filters match the gateway handler handleListPolicyAudit semantics: action / agent_id / rule_id / type are case-insensitive exact matches; after / before are lexicographic compares against created_at; search is a substring match across action + actor_id + resource_type + resource_id + message lowercased.

get/api/v1/policy/audit

Request

  • Base URL: http://localhost:8081
  • URL: http://localhost:8081/api/v1/policy/audit
  • Auth: one of:
    • API key in header X-API-Key
    • HTTP bearer

Query parameters

limitinteger

Maximum number of entries to return (default 100).

offsetinteger

Number of entries to skip (default 0).

actionstring

Case-insensitive exact match against the entry action verb.

agent_idstring

Case-insensitive exact match against the entry's agent_id.

afterstring date-time

Inclusive lower-bound on created_at. Lexicographic compare on the raw string the backend stores (typically RFC3339).

beforestring date-time

Exclusive upper-bound on created_at. Lexicographic compare on the raw string the backend stores (typically RFC3339).

searchstring

Case-insensitive substring search across the lowercased concatenation of `action + actor_id + resource_type + resource_id

  • message`.
rule_idstring

Case-insensitive exact match against the entry's resource_id. Named rule_id for the common case where the audited resource is a policy rule.

typestring

Case-insensitive exact match against the entry's resource_type. The special value output returns only the legacy output-rule audit log via a separate code path that omits total / has_more / offset from the response envelope.

Headers

X-Tenant-IDstring required

Tenant isolation header (required on all protected routes).

Response

Audit items envelope

totalinteger

Total entries matching the filter (pre-pagination).

has_moreboolean

True when more entries are available past the current window.

offsetinteger

Echo of the requested offset (default 0).

Changes

  • 12120aad0bfeRevision changes
    • info

      added the optional property to the response with the status

    • info

      added the optional property to the response with the status

  • fc2b4cbefa3bRevision changes
    • breaking

      the response's body type changed from array to object for status

    • info

      added the new optional query request parameter action

    • info

      added the new optional query request parameter after

    • info

      added the new optional query request parameter agent_id

    • info

      added the new optional query request parameter before

    • info

      added the new optional query request parameter limit

    • info

      added the new optional query request parameter offset

    • info

      added the new optional query request parameter rule_id

    • info

      added the new optional query request parameter search

    • info

      added the new optional query request parameter type

    • info

      added the optional property to the response with the status

    • info

      added the optional property to the response with the status

    • info

      added the optional property to the response with the status

    • info

      added the required property to the response with the status