Query events (filter body). A POST, but a read: a read-only API key may call it

Returns one page (up to 100 rows) of the caller's coalesced events, newest first (or most severe first with sort=severity), with an opaque next_cursor for pagination. Filters arrive as an optional JSON body (an empty POST = first page, no filters). Cookie callers must send a valid CSRF token (X-CSRFToken); API-key callers are exempt. Each event is a positional array of 17 elements: [created_at, where, str_repr, count, machine_name, severity, agent_kind, id, source_label, context, suppressed, sanitize_reason, impact, labels, has_comment, extension, taint_source]. taint_source is an es-python event's taint source by the name a rule's source takes (socket, file, env, ...); it is empty for every other product and when no source was recorded. The array is appended to, never reordered, so index by position and ignore trailing elements you do not know. impact is the event's vulnerability classes as [{label, sev}]: label is a short class name ("xss", "sqli", "command injection") and sev is that CLASS's own severity, which is not the event's severity in element 5 - an rce-class sink stays critical on an event graded low because its source is trusted. A row can carry more than one (a sink class plus a source class), worst first, at most three. labels is your own triage labels on the event as [{id, name, color}]; has_comment is true when you have written a note on it; extension names the browser extension an es-chromium event is attributed to (its name and version, or its id when no name is known) and is empty for every other event. The heavy per-event fields (trace, source, origin, repr_created, detail) and your note's text are NOT in this array; fetch them for one event with GET /api/event/{id}. A SHORT PAGE IS NOT THE LAST PAGE: every request examines a bounded slice of your history so no single call runs for seconds, so a selective filter can return fewer than 100 events, or zero, and still hand back a next_cursor. Follow the cursor until it comes back empty, even after an empty page; the scanned and exhausted fields report how far the current request got, and oldest_examined is the timestamp of the oldest row it looked at. When an enabled Hide rule matches every event (an empty pattern or .*), the response returns at once with no events, exhausted true, and hidden_by {id, label} naming that rule. This applies to every filter, including whitelist_repr, blacklist_repr, machine and sources.

This is a read: a read-only API key may call it.