--- title: "ListAgentHookEvents" method: GET path: "/v1/namespaces/{tenant_meta.namespace}/agent-hook-events" tags: ["AgentHookEventService"] --- # ListAgentHookEvents `GET /v1/namespaces/{tenant_meta.namespace}/agent-hook-events` ## Request - Base URL: `https://api.endorlabs.com` - URL: `https://api.endorlabs.com/v1/namespaces/{tenant_meta.namespace}/agent-hook-events` - Auth: none declared Lists all AgentHookEvents visible in a namespace. ## Path parameters - `tenant_meta.namespace` string, required ## Query parameters - `list_parameters.filter` string - `list_parameters.page_token` integer - `list_parameters.page_size` integer - `list_parameters.action` string - `list_parameters.mask` string - `list_parameters.traverse` boolean - `list_parameters.sort.path` string - `list_parameters.sort.order` 'SORT_ENTRY_ORDER_UNSPECIFIED' | 'SORT_ENTRY_ORDER_ASC' | 'SORT_ENTRY_ORDER_DESC' - `list_parameters.count` boolean - `list_parameters.group.aggregation_paths` string - `list_parameters.group.show_aggregation_uuids` boolean - `list_parameters.group.unique_count_paths` string - `list_parameters.group.unique_value_paths` string - `list_parameters.ci_run_uuid` string - `list_parameters.page_id` string - `list_parameters.group_by_time.aggregation_paths` string - `list_parameters.group_by_time.show_aggregation_uuids` boolean - `list_parameters.group_by_time.interval` 'GROUP_BY_TIME_INTERVAL_UNSPECIFIED' | 'GROUP_BY_TIME_INTERVAL_YEAR' | 'GROUP_BY_TIME_INTERVAL_QUARTER' | 'GROUP_BY_TIME_INTERVAL_MONTH' | 'GROUP_BY_TIME_INTERVAL_WEEK' | 'GROUP_BY_TIME_INTERVAL_DAY' | 'GROUP_BY_TIME_INTERVAL_HOUR' | 'GROUP_BY_TIME_INTERVAL_MINUTE' | 'GROUP_BY_TIME_INTERVAL_SECOND' - `list_parameters.group_by_time.group_size` integer - `list_parameters.group_by_time.start_time` string, date-time - `list_parameters.group_by_time.end_time` string, date-time - `list_parameters.group_by_time.mode` string - `list_parameters.group_by_time.aggregation_value_field` string - `list_parameters.group_by_time.aggregation_operator` string - `list_parameters.disable_pagination` boolean ## Response `200` A successful response. - V1ListAgentHookEventsResponse: Response to the request to list agent hook events. - `count_response` V1CountResponse: Response to a list count request. - `count` integer: Number of objects matching the given list parameters. - `group_response` V1GroupResponse: Response to a list group request. - `groups` object: Map indexed by values of the fields specified in aggregation_paths, for example, {"[{"key":"meta.kind","value":"Project"}]": { "aggregation_count": { "count": 1649 } } }. - `list` V1ListAgentHookEventsResponseList - `objects` V1AgentHookEvent[] - `consumers_failed` string[]: Consumer keys that failed to process this event. Used for retry. - `meta` V1Meta, required: Common fields for all Endor Labs resources. - `annotations` object: Annotations can be used to attach metadata to a resource message. Annotation values can be small or large, structured or unstructured, and may include characters not permitted by labels. The keys may contain alphanumerics, underscores (_), dots (.) and dashes (-). The values of an annotation must be 16384 bytes or smaller. - `create_time` string, date-time: Time the resource was created. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `created_by` string: Name and authentication source of the user who created the object, for example, ewok@endor.ai@google@api-key. - `description` string: Resource description. Must be less than 1024 bytes. - `index_data` V1IndexData: IndexData is used to index the resource for search. It's an internal object. - `data` string[] - `search_score` number, float: search_score is the score of the resource for search. Internal use only. - `tenant` string - `will_be_deleted_at` string, date-time: Time that the resource will be deleted. - `kind` string: Resource kind, for example, HelloResponse. Auto-generated using the protobuf message proto.MessageName().Name(). - `name` string, required: Resource name. Must be 63 characters or less. - `parent_kind` string: Parent object resource kind, for example, Project. - `parent_uuid` string: Parent object UUID. - `references` object: Map of objects referenced in a query API. - `tags` string[]: List of tags attached to the resource. Tags can be used to select objects and to find collections of objects that satisfy certain conditions. A tag must be 255 characters or less. - `update_time` string, date-time: Time the resource was last updated. Note: Updated on all create/patch/delete operations. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `updated_by` string: Name and authentication source of the last user who updated the object, for example, vulnerabilityingestor@endor.ai@x509. - `upsert_time` string, date-time: Time the resource was last upserted. Note: create_time is only set the first time the resource is created. upsert_time is set every time the resource is upseted. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `version` string: Message version. - `processing_result` 'PROCESSING_RESULT_UNSPECIFIED' | 'PROCESSING_RESULT_COMPLETED' | 'PROCESSING_RESULT_FAILED': ProcessingResult indicates the downstream processing result of an event. - `spec` V1AgentHookEventSpec - `agent` 'AGENT_UNSPECIFIED' | 'AGENT_CURSOR' | 'AGENT_CLAUDE' | 'AGENT_CODEX' | 'AGENT_COPILOT' - `agent_version` string: Agent version if available. - `cmd_line` V1CmdHook: CmdHook contains payload for command-line related hooks. - `cmd_line` string: Command line that was executed. - `tool_input` object: Tool invocation input; structure is tool-specific (use Struct for JSON). - `tool_response` object: Tool result; structure is tool-specific (e.g. stdout/stderr or filenames). - `command_risk_categories` V1CommandRiskCategory[]: Risk categories the command matched, independent of policy enablement. - `command_risk_findings` V1CommandRiskFinding[]: Command fragments that evidenced each risk category. - `category` 'COMMAND_RISK_CATEGORY_UNSPECIFIED' | 'COMMAND_RISK_CATEGORY_DESTRUCTIVE_FILESYSTEM' | 'COMMAND_RISK_CATEGORY_PRIVILEGE_ESCALATION' | 'COMMAND_RISK_CATEGORY_INLINE_CODE_EXECUTION' | 'COMMAND_RISK_CATEGORY_DOWNLOAD_AND_EXECUTE' | 'COMMAND_RISK_CATEGORY_DANGEROUS_GIT_OPERATION' | 'COMMAND_RISK_CATEGORY_FORCE_PUSH' | 'COMMAND_RISK_CATEGORY_PACKAGE_PUBLISH' | 'COMMAND_RISK_CATEGORY_NETWORK_EXFILTRATION' | 'COMMAND_RISK_CATEGORY_SECRET_FILE_READ' | 'COMMAND_RISK_CATEGORY_SHELL_PROFILE_WRITE' | 'COMMAND_RISK_CATEGORY_NETWORK_ACCESS' | 'COMMAND_RISK_CATEGORY_RECURSIVE_GREP' | 'COMMAND_RISK_CATEGORY_ENV_VAR_EXPORT' | 'COMMAND_RISK_CATEGORY_PUSH_TO_MAIN' | 'COMMAND_RISK_CATEGORY_PACKAGE_INSTALL' | 'COMMAND_RISK_CATEGORY_PACKAGE_MANAGER_BYPASS' | 'COMMAND_RISK_CATEGORY_PUBLIC_GITHUB_PUBLISHING' | 'COMMAND_RISK_CATEGORY_CREDENTIAL_DISCOVERY': CommandRiskCategory identifies the system command-policy family that matched. Values are permanent classifier keys and do not depend on policy names. - COMMAND_RISK_CATEGORY_UNSPECIFIED: No risk classification was performed. - COMMAND_RISK_CATEGORY_DESTRUCTIVE_FILESYSTEM: Destructive filesystem operations, such as recursive root deletion. - COMMAND_RISK_CATEGORY_PRIVILEGE_ESCALATION: Privilege escalation or broad permission and ownership changes. - COMMAND_RISK_CATEGORY_INLINE_CODE_EXECUTION: Interpreter one-liners that expose dangerous execution capabilities. - COMMAND_RISK_CATEGORY_DOWNLOAD_AND_EXECUTE: Remote content that runs directly in a shell. - COMMAND_RISK_CATEGORY_DANGEROUS_GIT_OPERATION: Git operations that discard work or skip local safeguards. - COMMAND_RISK_CATEGORY_FORCE_PUSH: Force pushes that rewrite remote history. - COMMAND_RISK_CATEGORY_PACKAGE_PUBLISH: Package or artifact publication to a registry. - COMMAND_RISK_CATEGORY_NETWORK_EXFILTRATION: Raw network transfer tools used against remote endpoints. - COMMAND_RISK_CATEGORY_SECRET_FILE_READ: Shell reads of credential, key, or secret files. - COMMAND_RISK_CATEGORY_SHELL_PROFILE_WRITE: Shell writes to startup files that can establish persistence. - COMMAND_RISK_CATEGORY_NETWORK_ACCESS: Network download or remote access commands. - COMMAND_RISK_CATEGORY_RECURSIVE_GREP: Recursive searches that can expose secrets in transcripts. - COMMAND_RISK_CATEGORY_ENV_VAR_EXPORT: Export of credential-shaped environment variables. - COMMAND_RISK_CATEGORY_PUSH_TO_MAIN: Direct pushes to main or master branches. - COMMAND_RISK_CATEGORY_PACKAGE_INSTALL: Package installation or container run and pull commands. - COMMAND_RISK_CATEGORY_PACKAGE_MANAGER_BYPASS: Commands that bypass the package firewall. - COMMAND_RISK_CATEGORY_PUBLIC_GITHUB_PUBLISHING: Content publication to a public GitHub repository, gist, or release. - COMMAND_RISK_CATEGORY_CREDENTIAL_DISCOVERY: Discovery or staging of credentials and related secret material. - `matched_text` string: Text from the command after heredoc removal. The value is capped at 256 Unicode code points. Truncated values end with the literal `...` marker, which is included in the cap. - `cwd` string: Working directory when the event was captured. - `deny_source` 'DENY_SOURCE_UNSPECIFIED' | 'DENY_SOURCE_OS_SANDBOX' | 'DENY_SOURCE_PROXY' | 'DENY_SOURCE_APP_HOOK': DenySource identifies the layer that blocked a sandboxed execution. - DENY_SOURCE_UNSPECIFIED: No denying layer was reported. - DENY_SOURCE_OS_SANDBOX: The operating-system sandbox blocked the execution. - DENY_SOURCE_PROXY: A network proxy blocked the execution. - DENY_SOURCE_APP_HOOK: An agent hook or application policy blocked the execution. - `device_id` string: Device ID if available. - `duration_msec` number, float: Duration in milliseconds. - `error_message` string: Error message if the hook event failed. - `file` V1FileHook: FileHook contains payload for file-related hooks. - `file_name` string: File name or path. - `operation` 'FILE_OPERATION_UNSPECIFIED' | 'FILE_OPERATION_READ' | 'FILE_OPERATION_WRITE' | 'FILE_OPERATION_DELETE' | 'FILE_OPERATION_EDIT': FileOperation identifies the type of file access. - `tool_input` object: Tool invocation input; structure is tool-specific (use Struct for JSON). - `tool_response` object: Tool result; structure is tool-specific (e.g. stdout/stderr or filenames). - `has_policy_violation` boolean: Set to true when policy_matches is non-empty. - `hook_event_category` 'HOOK_EVENT_CATEGORY_UNSPECIFIED' | 'HOOK_EVENT_CATEGORY_TOOL' | 'HOOK_EVENT_CATEGORY_SESSION' | 'HOOK_EVENT_CATEGORY_CMD' | 'HOOK_EVENT_CATEGORY_FILE' | 'HOOK_EVENT_CATEGORY_USER_PROMPT' | 'HOOK_EVENT_CATEGORY_CONFIG': - HOOK_EVENT_CATEGORY_CONFIG: Changes to the agent's own configuration, which are governance events rather than work the agent performed. Counted under AgenticInventory.config_hook_events, not file_hook_events, even though the event still carries a FileHook payload. - `hook_event_name` 'HOOK_EVENT_NAME_UNSPECIFIED' | 'HOOK_EVENT_NAME_SESSION_START' | 'HOOK_EVENT_NAME_SESSION_STOP' | 'HOOK_EVENT_NAME_USER_PROMPT_SUBMIT' | 'HOOK_EVENT_NAME_PRE_TOOL_USE' | 'HOOK_EVENT_NAME_POST_TOOL_USE' | 'HOOK_EVENT_NAME_PRE_CMD' | 'HOOK_EVENT_NAME_POST_CMD' | 'HOOK_EVENT_NAME_PRE_FILE_OPERATION' | 'HOOK_EVENT_NAME_POST_FILE_OPERATION' | 'HOOK_EVENT_NAME_CONFIG_CHANGE': HookEventName identifies the kind of agent lifecycle or tool event. Different agents use different names, so here we will have a normalized list. - HOOK_EVENT_NAME_CONFIG_CHANGE: Agent configuration changed mid-session (e.g. a settings file edit or a /sandbox toggle). Distinct from a file operation so that queries can name it and so file-activity counters exclude settings churn: AgenticAggregate keys file_access_events and edit_operations on this name, and AgenticInventory counts these under config_hook_events rather than file_hook_events. - `identity` V1AgentIdentity: AgentIdentity is the org identity resolved for the account behind an event, sourced from the agent provider's org directory. Only the caller's own identity is ever resolved on a client (self-scoped). - `display_name` string: Display name of the resolved user. - `email` string: Corporate email of the resolved user. - `groups` string[]: Org groups / teams the user belongs to. - `roles` string[]: Org roles the user holds. - `internal_tool` V1InternalToolHook: InternalToolHook contains payload for internal tool-related hooks. - `tool_input` object: Tool invocation input; structure is tool-specific (use Struct for JSON). - `tool_name` string: Name of the tool (e.g. "Bash", "Glob", "AskUserQuestion", "Skill"). - `tool_response` object: Tool result; structure is tool-specific (e.g. stdout/stderr or filenames). - `is_interrupted` boolean: Whether the hook event was interrupted. - `llm_judgments` V1LlmJudgment[]: Judgments the LLM judge made while this event was evaluated. Repeated because the judge will be asked more than one kind of question (prompt injection is Phase 1), not because one command produces several judgments: one command is one judge call, and a command that matches two policies still carries exactly one. A judgment here does NOT by itself mean the event violated a policy. Under JUDGE_SCOPE_ALL_COMMANDS most commands come back benign and match nothing, and those events carry a judgment with has_policy_violation unset. So does a command whose every match the judge released. The released matches are in LlmJudgment.judged_matches. - `ai_request_uuid` string: Join key to the AIRequest row for this call, which carries CompletionUsage and the credit accounting. Cost is derived from that row and the price table of the day, never stored here: a stored currency figure goes stale on a price change and cannot be recomputed. Note the derived figure is a FLOOR — the hook client retries a failed POST and each retry bills another inference, while only the attempt that returned leaves its uuid here. - `cached_tokens` integer: Tokens served from the provider's prompt cache. The rubric is a standing prefix, so this reports whether it is actually being cached — something the RFC's cost table assumes rather than measures. - `completion_tokens` integer: Tokens the label itself cost. Small by design: a large value means the model is explaining itself rather than answering. - `confidence` number, float: The model's own 0.0-1.0 self-report, advisory only: recorded so a threshold can be calibrated against real data rather than guessed. - `error` string: Set when the judge could not be reached, timed out, or returned something unusable. Without it a fail-open allow reads in the data as a real allow and the fail-open rate cannot be measured at all. - `judged_matches` V1AgentHookPolicyMatch[]: The policy matches handed to the judge, as the patterns produced them and before the label acted on them. This is the only record of what the judge decided against. A benign label removes these matches from policy_matches, and a review or suspicious label rewrites their action, so without this copy an event cannot say which policy fired or what it would have done. Empty when the judge ruled on a command no pattern matched, which JUDGE_SCOPE_ALL_COMMANDS does for most commands. - `cmd_line` V1CmdLineMatch: CmdLineMatch describes a command-line invocation that matched a policy. - … - `dependency_risk` V1DependencyRiskMatch: DependencyRiskMatch describes a known-vulnerable dependency found by the dependency-risk check. - … - `file_access` V1FileAccessMatch: FileAccessMatch describes a file access that matched a policy. - … - `malware` V1MalwareMatch: MalwareMatch describes a package flagged by the malware check. The verdict comes from a MALWARE-status, non-contested record in Endor's malware feed. - … - `match_type` 'AGENT_HOOK_POLICY_MATCH_TYPE_UNSPECIFIED' | 'AGENT_HOOK_POLICY_MATCH_TYPE_MCP_TOOL_CALL' | 'AGENT_HOOK_POLICY_MATCH_TYPE_CMD_LINE' | 'AGENT_HOOK_POLICY_MATCH_TYPE_FILE_ACCESS' | 'AGENT_HOOK_POLICY_MATCH_TYPE_SKILL' | 'AGENT_HOOK_POLICY_MATCH_TYPE_MCP_SERVER' | 'AGENT_HOOK_POLICY_MATCH_TYPE_SESSION' | 'AGENT_HOOK_POLICY_MATCH_TYPE_MALWARE' | 'AGENT_HOOK_POLICY_MATCH_TYPE_SECRETS' | 'AGENT_HOOK_POLICY_MATCH_TYPE_DEPENDENCY_RISK' | 'AGENT_HOOK_POLICY_MATCH_TYPE_TOOL_SANDBOX': The type of policy match. - AGENT_HOOK_POLICY_MATCH_TYPE_MALWARE: A package flagged as malware by the malware check. - AGENT_HOOK_POLICY_MATCH_TYPE_SECRETS: A secret detected in file content by the secrets check. - AGENT_HOOK_POLICY_MATCH_TYPE_DEPENDENCY_RISK: A known-vulnerable dependency detected by the dependency-risk check. - AGENT_HOOK_POLICY_MATCH_TYPE_TOOL_SANDBOX: Runtime sandbox state of a tool call. - `mcp_server` V1McpServerMatch: McpServerMatch describes an MCP server that matched a policy. Carries only the matched server's name; consumers can fetch the full McpMeta from AgenticInventory if more detail is needed. Server-level match; for individual tool calls, see McpToolMatch. - … - `mcp_tool_call` V1McpToolMatch: McpToolMatch describes a tool call that matched a policy. - … - `policy_matched` V1AgentHookPolicy: AgentHookPolicy describes a policy to apply when agent hook events match a given activity. When the activity matches, the action (e.g. feedback, block, alert) is applied. - … - `secrets` V1SecretsMatch: SecretsMatch describes a secret detected by the secrets check. It carries only the rule and location, never the secret value, so a finding can be surfaced without leaking the credential. - … - `session` V1SessionMatch: SessionMatch describes a session that matched a policy. Unlike SkillMatch or McpServerMatch, the source data (SessionHook + AgentConfigSnapshot) is already carried by the surrounding AgentHookEvent, so this match only describes what fired. - … - `skill` V1SkillMatch: SkillMatch describes a skill that matched a policy. Carries only the matched skill's name; consumers can fetch the full SkillMeta from AgenticInventory if more detail is needed. - … - `tool_sandbox` V1ToolSandboxMatch: ToolSandboxMatch describes the sandbox state that matched a policy. - … - `kind` 'KIND_UNSPECIFIED' | 'KIND_COMMAND_RISK': What the judge was asked to rule on. - KIND_COMMAND_RISK: Risk of a shell command the agent proposed to run. - `label` 'LABEL_UNSPECIFIED' | 'LABEL_BENIGN' | 'LABEL_SUSPICIOUS' | 'LABEL_REVIEW': Label is the judgment on one command. Each value maps to an action the agent hook already has. - LABEL_UNSPECIFIED: No label was produced. Never treat this as a benign result. - LABEL_BENIGN: The command shows nothing concerning on its own. - LABEL_SUSPICIOUS: The command shows something concerning. - LABEL_REVIEW: The decision turns on context the model does not have, so the command belongs in front of the user rather than being cleared or blocked. - `latency_ms` string, int64: Round trip as the client measured it, covering assembling the request and mapping the answer back. The one number here that the server-side AIRequest row cannot produce. - `model` string: The model that produced the label, as served — the backend rewrites the requested model when aliasing or fallback applies. - `prompt_tokens` integer: Tokens the prompt cost. - `reason` string: One clause naming the concrete thing the model saw. This is also the text the agent is shown when a judgment raises an ask or a block, which is why an AUTO policy carries no message of its own. - `rubric_version` string: Version of the rubric the label was produced under. A label recorded today is not comparable to one recorded after the rubric changed, which is the whole reason the rubric is embedded verbatim rather than assembled per call. - `mcp_tool` V1McpToolHook: McpToolHook contains payload for MCP tool-related hooks. - `cmd_line` string: Shell command this call runs, when the tool is a shell (Claude Desktop's local agent mode exposes server "workspace", tool "bash"). Such a call is indistinguishable in what it can do from the agent's own Bash tool, but the command arrives inside tool_input, where nothing that reads CmdHook.cmd_line can find it. Lifting it here gives the two paths one field to read, so a consumer does not have to re-derive the shell-tool vocabulary to see the highest-signal action an agent takes. Empty for every non-shell tool. - `server_host` string: Host or URL of the server (e.g. "localhost", "https://api.example.com"). - `server_name` string: Name of the server (e.g. "filesystem", "postgres-mcp", "github-mcp", "enfor-cli-tools"). - `server_type` 'SERVER_TYPE_UNSPECIFIED' | 'SERVER_TYPE_LOCAL' | 'SERVER_TYPE_REMOTE': ServerType indicates whether a tool server runs locally or remotely. - `source` 'MCP_SERVER_SOURCE_UNSPECIFIED' | 'MCP_SERVER_SOURCE_PROJECT_CONFIG' | 'MCP_SERVER_SOURCE_USER_CONFIG' | 'MCP_SERVER_SOURCE_ENTERPRISE_CONFIG' | 'MCP_SERVER_SOURCE_PLUGIN' | 'MCP_SERVER_SOURCE_VENDOR_CONNECTOR' | 'MCP_SERVER_SOURCE_CLIENT_RESERVED' | 'MCP_SERVER_SOURCE_CLIENT_INJECTED': McpServerSource is where an MCP server came from. Orthogonal to ServerType, which answers "where does it run": a vendor connector is a connector by source and REMOTE by type at the same time. Declared here rather than in agentic_inventory.proto because that file imports this one, not the reverse. - MCP_SERVER_SOURCE_UNSPECIFIED: Not classified: no config snapshot was available to check the server against. Distinct from "checked and absent", which is CLIENT_INJECTED. - MCP_SERVER_SOURCE_PROJECT_CONFIG: Registered in the workspace's own checked-in agent config. - MCP_SERVER_SOURCE_USER_CONFIG: Registered in the user's home-directory agent config. - MCP_SERVER_SOURCE_ENTERPRISE_CONFIG: Registered in the OS-managed enterprise agent config. - MCP_SERVER_SOURCE_PLUGIN: Supplied by an agent plugin's manifest rather than by an mcp_servers entry. - MCP_SERVER_SOURCE_VENDOR_CONNECTOR: Vendor hosted connector enabled on the user's agent account, for example a claude.ai connector. Never present in local config. - MCP_SERVER_SOURCE_CLIENT_RESERVED: A name the client reserves for one of its own built in servers, so user config cannot register under it. Highest confidence verdict. - MCP_SERVER_SOURCE_CLIENT_INJECTED: Injected by the client at runtime but not on the reserved list: other product surfaces, IDE bridges, host applications. Absent from a config snapshot that was loaded. - `tool_input` object: Tool invocation input; structure is tool-specific (use Struct for JSON). - `tool_name` string: Name of the tool (e.g. "Bash", "Glob", "AskUserQuestion", "Skill"). - `tool_response` object: Tool result; structure is tool-specific (e.g. stdout/stderr or filenames). - `model` string: Model involved. - `no_sandbox_reason` 'NO_SANDBOX_REASON_UNSPECIFIED' | 'NO_SANDBOX_REASON_DISABLED' | 'NO_SANDBOX_REASON_UNAVAILABLE' | 'NO_SANDBOX_REASON_MANUAL_APPROVAL' | 'NO_SANDBOX_REASON_EXCLUDED_COMMAND' | 'NO_SANDBOX_REASON_ESCALATED' | 'NO_SANDBOX_REASON_DANGEROUS_OVERRIDE' | 'NO_SANDBOX_REASON_ESCALATION_PENDING': NoSandboxReason explains an unsandboxed or unresolved sandbox outcome. - NO_SANDBOX_REASON_UNSPECIFIED: No reason was reported. - NO_SANDBOX_REASON_DISABLED: Sandboxing was disabled by configuration. - NO_SANDBOX_REASON_UNAVAILABLE: The sandbox was unavailable on this host. - NO_SANDBOX_REASON_MANUAL_APPROVAL: Manual approval allowed the execution outside the sandbox. - NO_SANDBOX_REASON_EXCLUDED_COMMAND: The command matched an agent exclusion rule. - NO_SANDBOX_REASON_ESCALATED: The execution was escalated out of the sandbox. - NO_SANDBOX_REASON_DANGEROUS_OVERRIDE: A dangerous override disabled sandbox enforcement. - NO_SANDBOX_REASON_ESCALATION_PENDING: An escalation request is pending. Pair with TOOL_SANDBOX_UNKNOWN, not TOOL_SANDBOX_UNSPECIFIED. - `os_user` string: Operating-system login of the account running the agent, carried alongside user rather than instead of it, and populated even when it repeats user. This is the key that links one person's agent accounts, because the same developer is an email to one agent and a GitHub handle to another while staying one OS login underneath. Pair it with device_id: on a shared machine or a CI runner the login is a generic name such as "runner" or "root", and joining on it alone merges unrelated people. - `permission_mode` string: Permission mode at capture time (e.g. "default", "acceptEdits"). - `policy_matches` V1AgentHookPolicyMatch[]: List of policy matches (if any). - `cmd_line` V1CmdLineMatch: CmdLineMatch describes a command-line invocation that matched a policy. - `command_source` 'COMMAND_SOURCE_UNSPECIFIED' | 'COMMAND_SOURCE_CMD_HOOK' | 'COMMAND_SOURCE_MCP_TOOL_INPUT': CommandSource names the hook payload the evaluated command text was read from. A shell exposed as an MCP tool (e.g. Claude Desktop's "workspace" server, tool "bash") carries its command in mcp_tool.tool_input rather than in cmd_line, so CmdLine policies read from either payload and record which one they read. - COMMAND_SOURCE_UNSPECIFIED: Records written before the command source was tracked. - COMMAND_SOURCE_CMD_HOOK: spec.cmd_line: the agent's own shell tool. - COMMAND_SOURCE_MCP_TOOL_INPUT: spec.mcp_tool.tool_input: a shell exposed as an MCP tool. - `matched_cmd_pattern` string - `matched_text` string: Text the pattern matched, cut from the heredoc-stripped command, capped at 256 characters. - `mcp_server_name` string: MCP server that carried the command (e.g. "workspace"). Set only when command_source is COMMAND_SOURCE_MCP_TOOL_INPUT. - `tool_name` string: MCP tool that carried the command (e.g. "bash"). Set only when command_source is COMMAND_SOURCE_MCP_TOOL_INPUT. - `dependency_risk` V1DependencyRiskMatch: DependencyRiskMatch describes a known-vulnerable dependency found by the dependency-risk check. - `direct` boolean: Whether the package is a direct dependency of the introduced package. - `ecosystem` string: Ecosystem the package belongs to (e.g. "npm", "pypi"). - `fixed_version` string: Version the advisory names as fixed, when one is published. - `introduced_by` string: Package the agent named, set on transitive matches (e.g. "express@4.18.2"). - `message` string: Human-readable explanation of what fired. - `package_name` string: Package name (e.g. "path-to-regexp"). - `severity` string: Worst matched CVSS severity, as the Severity enum name (e.g. "SEVERITY_HIGH"). - `version` string: Version judged. For an unpinned install or a range spec, the highest satisfying version known to Endor; the message says so. - `vulnerability_id` string: CVE or GHSA id. - `file_access` V1FileAccessMatch: FileAccessMatch describes a file access that matched a policy. - `matched_file_name_pattern` string: File name pattern that matched. - `matched_file_operation` 'FILE_OPERATION_UNSPECIFIED' | 'FILE_OPERATION_READ' | 'FILE_OPERATION_WRITE' | 'FILE_OPERATION_DELETE' | 'FILE_OPERATION_EDIT': FileOperation identifies the type of file access. - `matched_text` string: Text the pattern matched, cut from the separator-normalized name, capped at 256 characters. - `malware` V1MalwareMatch: MalwareMatch describes a package flagged by the malware check. The verdict comes from a MALWARE-status, non-contested record in Endor's malware feed. - `ecosystem` string: Ecosystem the package belongs to (e.g. "npm", "pypi"). - `message` string: Human-readable explanation of what fired. - `package_name` string: Package name (e.g. "reftest-helper-for-ae1x"). - `reasons` string[]: Why the package is flagged — indicators reported by the malware feed. - `source` string: Feed that flagged it, as the MalwareSource enum name (e.g. "MALWARE_SOURCE_AMF"). - `summary` string: Short title from the malware feed (e.g. "Malicious code in (npm)"). - `version` string: Version from the install command, when it was pinned; empty for an unpinned install. - `match_type` 'AGENT_HOOK_POLICY_MATCH_TYPE_UNSPECIFIED' | 'AGENT_HOOK_POLICY_MATCH_TYPE_MCP_TOOL_CALL' | 'AGENT_HOOK_POLICY_MATCH_TYPE_CMD_LINE' | 'AGENT_HOOK_POLICY_MATCH_TYPE_FILE_ACCESS' | 'AGENT_HOOK_POLICY_MATCH_TYPE_SKILL' | 'AGENT_HOOK_POLICY_MATCH_TYPE_MCP_SERVER' | 'AGENT_HOOK_POLICY_MATCH_TYPE_SESSION' | 'AGENT_HOOK_POLICY_MATCH_TYPE_MALWARE' | 'AGENT_HOOK_POLICY_MATCH_TYPE_SECRETS' | 'AGENT_HOOK_POLICY_MATCH_TYPE_DEPENDENCY_RISK' | 'AGENT_HOOK_POLICY_MATCH_TYPE_TOOL_SANDBOX': The type of policy match. - AGENT_HOOK_POLICY_MATCH_TYPE_MALWARE: A package flagged as malware by the malware check. - AGENT_HOOK_POLICY_MATCH_TYPE_SECRETS: A secret detected in file content by the secrets check. - AGENT_HOOK_POLICY_MATCH_TYPE_DEPENDENCY_RISK: A known-vulnerable dependency detected by the dependency-risk check. - AGENT_HOOK_POLICY_MATCH_TYPE_TOOL_SANDBOX: Runtime sandbox state of a tool call. - `mcp_server` V1McpServerMatch: McpServerMatch describes an MCP server that matched a policy. Carries only the matched server's name; consumers can fetch the full McpMeta from AgenticInventory if more detail is needed. Server-level match; for individual tool calls, see McpToolMatch. - `mcp_server_name` string: Name of the MCP server that matched. - `message` string: Describes what exactly matched (e.g. "score at or below threshold 5", "supply_chain_provenance at or below 4"). - `mcp_tool_call` V1McpToolMatch: McpToolMatch describes a tool call that matched a policy. - `matched_server_name_pattern` string: Matched server name pattern. - `matched_tool_input_pattern` string: Tool input pattern that matched. - `matched_tool_name_pattern` string: Matched tool name pattern. - `mcp_server_name` string: MCP server name (e.g. "jira"). - `message` string: Describes what exactly matched. - `tool_name` string: Tool name (e.g. "open bug"). - `policy_matched` V1AgentHookPolicy: AgentHookPolicy describes a policy to apply when agent hook events match a given activity. When the activity matches, the action (e.g. feedback, block, alert) is applied. - `action` V1AgentHookAction: Action describes how to match the activity with the policy and what to do when it matches. - … - `activity` V1AgentHookActivity: Activity describes what kind of hook activity the policy applies to. - … - `enabled` boolean: Whether this policy is active. - `intent` 'POLICY_INTENT_UNSPECIFIED' | 'POLICY_INTENT_RISK' | 'POLICY_INTENT_GOVERNANCE': PolicyIntent says what kind of rule a policy encodes, and so whether the LLM command judge may rule on its matches. Only cmd_line policies are judged, so today the intent changes behavior only on a cmd_line policy. - POLICY_INTENT_UNSPECIFIED: Read as POLICY_INTENT_RISK, so a policy that never sets the field keeps the behavior it had before the field existed. - POLICY_INTENT_RISK: The policy is a risk assessment. A judge scope may hand its matches to the judge, and the label can release, ask about, or block the command. - POLICY_INTENT_GOVERNANCE: The policy is an organisational rule, for example "installs go through the package firewall". A verdict on how risky the command is answers a question the rule does not ask, so no judge scope hands its matches to the judge. Its own action is final: no label releases it, and no label escalates it. Not valid with the AUTO action, which hands the decision to the judge. - `inventory_classification` 'INVENTORY_CLASSIFICATION_UNSPECIFIED' | 'INVENTORY_CLASSIFICATION_ALLOW' | 'INVENTORY_CLASSIFICATION_BLOCK' | 'INVENTORY_CLASSIFICATION_SUSPICIOUS' | 'INVENTORY_CLASSIFICATION_MALICIOUS': InventoryClassification declares the classification a policy assigns to a matched MCP server or skill when it fires. UNSPECIFIED means the policy plays no role in inventory classification (e.g. a session, file-access, or cmd-line policy, or an MCP/skill policy whose author only wants the per-event action). - `name` string: Name of the policy. - `scope` V1AgentHookPolicyScope: AgentHookPolicyScope restricts a policy to a subset of events by matching against per-event identity carried on AgentHookEvent.Spec (repository, user). Scope is evaluated once, before activity-kind matching, so it applies uniformly to all activity kinds. Match logic: an unset scope (or a scope with no matchers set) applies to every event. When set, configured matcher branches are AND'd — every set branch must produce a hit; within a branch the regexes are OR'd (any one matching satisfies the branch); an empty branch is ignored. A scope miss makes the policy a no-op for the event for both blocklist and allowlist match types (the policy simply does not apply). - … - `system` boolean: Whether this is a system-defined policy (vs user-defined). - `secrets` V1SecretsMatch: SecretsMatch describes a secret detected by the secrets check. It carries only the rule and location, never the secret value, so a finding can be surfaced without leaking the credential. - `column` integer: Column in the scanned content where the secret starts. - `fingerprint` string: Unique finding fingerprint, for dedup and cross-round false-positive suppression. - `line` integer: Line number in the scanned content where the secret was found. - `message` string: Human-readable explanation of what fired. - `rule_description` string: Friendly rule name (e.g. "AWS Access Key"). - `rule_id` string: Detection rule that fired (e.g. "aws-access-token", "github-pat"). - `session` V1SessionMatch: SessionMatch describes a session that matched a policy. Unlike SkillMatch or McpServerMatch, the source data (SessionHook + AgentConfigSnapshot) is already carried by the surrounding AgentHookEvent, so this match only describes what fired. - `matched_criteria` string: The criteria category that fired (mirrors a SessionActivity sub-message name, e.g. "top_level", "sandbox", "permissions", "hook", "model"). - `matched_value` string: The specific predicate value or pattern that matched (e.g. "default_mode=bypassPermissions", "any-level sandbox.enabled=false"). - `message` string: Free-form human-readable explanation of what fired. - `skill` V1SkillMatch: SkillMatch describes a skill that matched a policy. Carries only the matched skill's name; consumers can fetch the full SkillMeta from AgenticInventory if more detail is needed. - `message` string: Describes what exactly matched (e.g. "score at or below threshold 5", "instruction_integrity at or below 4"). - `skill_name` string: Name of the skill that matched. - `tool_sandbox` V1ToolSandboxMatch: ToolSandboxMatch describes the sandbox state that matched a policy. - `matched_criteria` string: Policy branch that produced the match. - `matched_value` string: Value that satisfied, or failed to satisfy, the policy branch. - `override_requested` boolean: Whether the call requested a sandbox override. - `posture` 'CALL_SANDBOX_POSTURE_UNSPECIFIED' | 'CALL_SANDBOX_POSTURE_UNKNOWN' | 'CALL_SANDBOX_POSTURE_IN_SANDBOX' | 'CALL_SANDBOX_POSTURE_NO_SANDBOX' | 'CALL_SANDBOX_POSTURE_BLOCKED' | 'CALL_SANDBOX_POSTURE_NOT_APPLICABLE' | 'CALL_SANDBOX_POSTURE_IN_HARNESS': CallSandboxPosture mirrors ToolSandbox by ordinal because this file cannot import agent_hook_event.proto. Keep the values and suffixes aligned. - CALL_SANDBOX_POSTURE_UNSPECIFIED: No runtime sandbox state was evaluated. - CALL_SANDBOX_POSTURE_UNKNOWN: The execution is sandbox-governed, but its runtime state is indeterminate. - CALL_SANDBOX_POSTURE_IN_SANDBOX: The execution ran inside the agent's sandbox. - CALL_SANDBOX_POSTURE_NO_SANDBOX: The execution was sandbox-governed but ran without a sandbox. - CALL_SANDBOX_POSTURE_BLOCKED: A sandbox denied the execution. - CALL_SANDBOX_POSTURE_NOT_APPLICABLE: The tool does not execute through a sandbox. - CALL_SANDBOX_POSTURE_IN_HARNESS: A sandbox around the agent harness supplied the isolation. - `reason` 'CALL_SANDBOX_REASON_UNSPECIFIED' | 'CALL_SANDBOX_REASON_DISABLED' | 'CALL_SANDBOX_REASON_UNAVAILABLE' | 'CALL_SANDBOX_REASON_MANUAL_APPROVAL' | 'CALL_SANDBOX_REASON_EXCLUDED_COMMAND' | 'CALL_SANDBOX_REASON_ESCALATED' | 'CALL_SANDBOX_REASON_DANGEROUS_OVERRIDE' | 'CALL_SANDBOX_REASON_ESCALATION_PENDING': CallSandboxReason mirrors NoSandboxReason by ordinal because this file cannot import agent_hook_event.proto. Keep the values and suffixes aligned. - CALL_SANDBOX_REASON_UNSPECIFIED: No reason was reported. - CALL_SANDBOX_REASON_DISABLED: Sandboxing was disabled by configuration. - CALL_SANDBOX_REASON_UNAVAILABLE: The sandbox was unavailable on this host. - CALL_SANDBOX_REASON_MANUAL_APPROVAL: Manual approval allowed the execution outside the sandbox. - CALL_SANDBOX_REASON_EXCLUDED_COMMAND: The command matched an agent exclusion rule. - CALL_SANDBOX_REASON_ESCALATED: The execution was escalated out of the sandbox. - CALL_SANDBOX_REASON_DANGEROUS_OVERRIDE: A dangerous override disabled sandbox enforcement. - CALL_SANDBOX_REASON_ESCALATION_PENDING: An escalation request was made, but its outcome is not yet known. - `raw_hook_event_name` string: Raw hook event name from the agent. - `reported_sandbox_config` V1AgentSandboxConfig: AgentSandboxConfig normalizes sandbox network and filesystem rules across agents. - `allow_unsandboxed_commands` boolean: AllowUnsandboxedCommands allows the agent to escape the sandbox on demand. Wrapped to distinguish "unset" from "false". - `allowed_network_hosts` string[]: AllowedNetworkHosts lists hostnames/domains the agent may reach. - `blocked_network_hosts` string[]: BlockedNetworkHosts lists hostnames/domains the agent may not reach. Populated from Cursor configs only; Claude Code uses allowlist-only. - `enabled` boolean: Enabled indicates whether sandboxing is turned on. Wrapped to distinguish "unset" from "false". - `excluded_commands` string[]: ExcludedCommands lists commands that always run outside the sandbox. - `fail_if_unavailable` boolean: FailIfUnavailable causes the agent to exit when sandboxing is unavailable. Wrapped to distinguish "unset" from "false". - `readable_paths` string[]: ReadablePaths lists filesystem paths the agent may read from. - `writable_paths` string[]: WritablePaths lists filesystem paths the agent may write to. - `repository` string: Repository where the action happened. - `sandbox_confidence` 'SANDBOX_DETECTION_CONFIDENCE_UNSPECIFIED' | 'SANDBOX_DETECTION_CONFIDENCE_REPORTED' | 'SANDBOX_DETECTION_CONFIDENCE_DERIVED' | 'SANDBOX_DETECTION_CONFIDENCE_INFERRED': SandboxDetectionConfidence describes how directly a sandbox state was observed. - SANDBOX_DETECTION_CONFIDENCE_UNSPECIFIED: No confidence was reported. - SANDBOX_DETECTION_CONFIDENCE_REPORTED: The agent explicitly reported the sandbox state. - SANDBOX_DETECTION_CONFIDENCE_DERIVED: The state was derived from configuration or structured events. - SANDBOX_DETECTION_CONFIDENCE_INFERRED: The state was inferred from indirect evidence. - `sandbox_config_posture` 'SANDBOX_CONFIG_POSTURE_UNSPECIFIED' | 'SANDBOX_CONFIG_POSTURE_UNKNOWN' | 'SANDBOX_CONFIG_POSTURE_ENABLED' | 'SANDBOX_CONFIG_POSTURE_DISABLED': SandboxConfigPosture is the session-level sandbox posture derived from agent configuration. - SANDBOX_CONFIG_POSTURE_UNSPECIFIED: No posture was evaluated by this client. - SANDBOX_CONFIG_POSTURE_UNKNOWN: The client evaluated configuration but could not determine posture. - SANDBOX_CONFIG_POSTURE_ENABLED: Configuration indicates sandboxing is enabled for the session. - SANDBOX_CONFIG_POSTURE_DISABLED: Configuration indicates sandboxing is disabled for the session. - `sandbox_override_requested` boolean: Whether this call requested a sandbox override. - `session` V1SessionHook - `ai_tool_inventory` V1AiToolInventory: AiToolInventory contains all AI development tools detected on the host machine. - `detections` V1AiToolDetection[]: Detected AI tools. - … - `composer_mode` string: Composer mode of the session. "agent", "ask", "edit" - `config` V1AgentConfigSnapshot: AgentConfigSnapshot captures the three-level configuration hierarchy (repository, user, enterprise) at session start time. - `enterprise` V1AgentConfigLevel: AgentConfigLevel captures the agent configuration at one scope level (repository, user, or enterprise). - … - `repository` V1AgentConfigLevel: AgentConfigLevel captures the agent configuration at one scope level (repository, user, or enterprise). - … - `resolved_sandbox_posture` 'SANDBOX_CONFIG_POSTURE_UNSPECIFIED' | 'SANDBOX_CONFIG_POSTURE_UNKNOWN' | 'SANDBOX_CONFIG_POSTURE_ENABLED' | 'SANDBOX_CONFIG_POSTURE_DISABLED': SandboxConfigPosture is the session-level sandbox posture derived from agent configuration. - SANDBOX_CONFIG_POSTURE_UNSPECIFIED: No posture was evaluated by this client. - SANDBOX_CONFIG_POSTURE_UNKNOWN: The client evaluated configuration but could not determine posture. - SANDBOX_CONFIG_POSTURE_ENABLED: Configuration indicates sandboxing is enabled for the session. - SANDBOX_CONFIG_POSTURE_DISABLED: Configuration indicates sandboxing is disabled for the session. - `user` V1AgentConfigLevel: AgentConfigLevel captures the agent configuration at one scope level (repository, user, or enterprise). - … - `harness_sandbox` 'HARNESS_SANDBOX_UNSPECIFIED' | 'HARNESS_SANDBOX_NONE_DETECTED' | 'HARNESS_SANDBOX_CONTAINER_DIY' | 'HARNESS_SANDBOX_DEDICATED_TOOL' | 'HARNESS_SANDBOX_SANDBOX_RUNTIME' | 'HARNESS_SANDBOX_UNKNOWN': HarnessSandbox identifies sandboxing around the agent harness itself. - HARNESS_SANDBOX_UNSPECIFIED: Harness sandboxing was not evaluated. - HARNESS_SANDBOX_NONE_DETECTED: No harness sandbox was detected. - HARNESS_SANDBOX_CONTAINER_DIY: The harness appears to run inside a generic container. - HARNESS_SANDBOX_DEDICATED_TOOL: The harness is managed by a dedicated sandbox tool. - HARNESS_SANDBOX_SANDBOX_RUNTIME: The harness is managed by a sandbox runtime. - HARNESS_SANDBOX_UNKNOWN: Checked but could not be classified. - `harness_sandbox_detail` string: Additional harness sandbox classification detail. - `is_background_agent` boolean: Whether the session is a background agent. - `reason` string: Reason for the session. For SESSION_END: "completed", "aborted", "error" - `sandbox_config_posture` 'SANDBOX_CONFIG_POSTURE_UNSPECIFIED' | 'SANDBOX_CONFIG_POSTURE_UNKNOWN' | 'SANDBOX_CONFIG_POSTURE_ENABLED' | 'SANDBOX_CONFIG_POSTURE_DISABLED': SandboxConfigPosture is the session-level sandbox posture derived from agent configuration. - SANDBOX_CONFIG_POSTURE_UNSPECIFIED: No posture was evaluated by this client. - SANDBOX_CONFIG_POSTURE_UNKNOWN: The client evaluated configuration but could not determine posture. - SANDBOX_CONFIG_POSTURE_ENABLED: Configuration indicates sandboxing is enabled for the session. - SANDBOX_CONFIG_POSTURE_DISABLED: Configuration indicates sandboxing is disabled for the session. - `skills` V1DiscoveredSkill[]: Skills discovered in the workspace during session start. - `allowed_tools` string[]: Tools declared in SKILL.md frontmatter (allowed-tools). - `compatibility` string: Environment requirements from SKILL.md frontmatter (agentskills.io standard field). - `content` string: Base64-encoded SKILL.md content for backend scoring. Capped at 128 KB. - `content_hash` string: SHA-256 hash of the SKILL.md content. - `description` string: Human-readable description from SKILL.md frontmatter. - `file_count` integer: Number of files in the skill directory (including SKILL.md). - `license` string: License from SKILL.md frontmatter (agentskills.io standard field). - `name` string: Skill name from SKILL.md frontmatter or directory name fallback. - `path` string: Path to the SKILL.md file within the workspace or user home directory. - `source` string: Source of the session. "startup", "resume", "clear" - `session_id` string: Session identifier for the agent run. - `sub_session_id` string: Sub-session identifier for the agent run. - `tool_sandbox` 'TOOL_SANDBOX_UNSPECIFIED' | 'TOOL_SANDBOX_UNKNOWN' | 'TOOL_SANDBOX_IN_SANDBOX' | 'TOOL_SANDBOX_NO_SANDBOX' | 'TOOL_SANDBOX_BLOCKED' | 'TOOL_SANDBOX_NOT_APPLICABLE' | 'TOOL_SANDBOX_IN_HARNESS': ToolSandbox is the runtime sandbox state of a single tool-call execution. - TOOL_SANDBOX_UNSPECIFIED: No runtime sandbox state was evaluated. - TOOL_SANDBOX_UNKNOWN: The execution is sandbox-governed, but its runtime state is indeterminate. - TOOL_SANDBOX_IN_SANDBOX: The execution ran inside the agent's sandbox. - TOOL_SANDBOX_NO_SANDBOX: The execution was sandbox-governed but ran without a sandbox. - TOOL_SANDBOX_BLOCKED: A sandbox denied the execution. - TOOL_SANDBOX_NOT_APPLICABLE: The tool does not execute through a sandbox. - TOOL_SANDBOX_IN_HARNESS: A sandbox around the agent harness supplied the isolation. - `tool_sandbox_basis` 'TOOL_SANDBOX_BASIS_UNSPECIFIED' | 'TOOL_SANDBOX_BASIS_REPORTED_BEFORE_RUN' | 'TOOL_SANDBOX_BASIS_OBSERVED_AFTER_RUN' | 'TOOL_SANDBOX_BASIS_DENIED_BEFORE_RUN': ToolSandboxBasis identifies the sole record, if any, used to aggregate one shell call's sandbox result. Producers must set a nonzero basis on at most one record per call. DENIED_BEFORE_RUN takes precedence when multiple bases apply. - TOOL_SANDBOX_BASIS_UNSPECIFIED: This record is not selected as the call's sandbox result for aggregation. - TOOL_SANDBOX_BASIS_REPORTED_BEFORE_RUN: The agent reported intended sandbox state before execution, not an observed outcome. Use only if no later OBSERVED_AFTER_RUN or DENIED_BEFORE_RUN record will be emitted for the call. - TOOL_SANDBOX_BASIS_OBSERVED_AFTER_RUN: The client observed the sandbox outcome after execution. - TOOL_SANDBOX_BASIS_DENIED_BEFORE_RUN: An enforced policy denied the call before execution. - `user` string: User name if available. - `user_kind` 'USER_KIND_UNSPECIFIED' | 'USER_KIND_EMAIL' | 'USER_KIND_GITHUB_LOGIN' | 'USER_KIND_OS_LOGIN' | 'USER_KIND_ASSERTED': UserKind says which kind of identifier the user field carries. Agents name their users differently, so the value alone cannot be classified: a bare login is indistinguishable from an OS login of the same spelling. A consumer that joins identities must read this before treating a user as an account. - USER_KIND_UNSPECIFIED: No kind was reported, which is what events from builds older than this field look like. Treat the user field as unclassified rather than as any particular kind. - USER_KIND_EMAIL: Account email the agent itself reports. - USER_KIND_GITHUB_LOGIN: GitHub account handle, which is all GitHub Copilot records locally. - USER_KIND_OS_LOGIN: No agent account was resolved, so the user field repeats os_user. Never join on this as an account: one shared machine would merge every developer who used it into a single identity. - USER_KIND_ASSERTED: Identifier supplied by the operator through the environment rather than read from the agent, so its shape is whatever the fleet configured. - `tenant_meta` V1TenantMeta: Tenant related data for the tenant containing the resource. - `namespace` string, required: Namespaces are a way to organize organizational units into virtual groupings of resources. Namespaces must be a fully qualified name, for example, the child namespace of namespace "endor.prod" called "app" is called "endor.prod.app". - `uuid` string: The UUID of an AgentHookEvent. - `response` V1ListResponse: Response to a list request. - `next_page_id` string: The UUID of last message retrieved. - `next_page_token` integer: Pagination token that can be used to retrieve the next page of results. ## Other responses - `default`: An unexpected error response. ## Changes - **2026-11-03** `4acd9fe15140`: 1 info - endpoint added [Operation history](https://skmtc.dev/endorlabs/apis/endor-labs-rest-api-reference/changes/v1/namespaces/:tenant_meta.namespace/agent-hook-events/get.md) --- [API](https://skmtc.dev/endorlabs/apis/endor-labs-rest-api-reference.md) - [All operations](https://skmtc.dev/endorlabs/apis/endor-labs-rest-api-reference/llms.txt) - [OpenAPI document](https://skmtc.dev/endorlabs/apis/endor-labs-rest-api-reference/revisions/4acd9fe15140?raw)