GEgetaxonflow
Audit

Get audit compliance summary

Returns aggregated compliance summary statistics for a given date range. Includes total event counts, breakdowns by severity and action type, top triggered policies, and an overall compliance score.

post/api/v1/audit/summary

Request

Headers

X-Tenant-IDstring required

Tenant identifier for scoping results. Required to prevent cross-tenant data aggregation. There is no fallback header: the X-Org-ID fallback was removed in v6.2.0, and a request without X-Tenant-ID is rejected with 400.

Request body

start_timestring date-time required

Start of date range (RFC3339)

end_timestring date-time required

End of date range (RFC3339, must be after start_time)

Response

Compliance summary. A fail-closed read (X-Axonflow-Read-Scope: none) returns the zero-events summary, whose compliance_score of 100 reads as "all clear" — the header is what tells the two apart.

total_eventsinteger

Total audit events in the date range

by_severityobject

Event counts by severity (info, warning, critical)

by_actionobject

Event counts by action type (llm_call, tool_call, etc.)

total_policiesinteger

How many DISTINCT policies fired in the range BEFORE the 10-entry top_policies limit truncated it. 0 when nothing fired. When it exceeds the array length, disclose "top 10 of N" rather than implying the remainder does not exist.

top_policies_unavailableboolean

Present and true ONLY when the top-policies aggregation did not complete (it failed, or exceeded its 15s deadline). OMITTED entirely otherwise, so treat absence as false.

The rest of the summary is still returned, so without this flag a failed aggregation is INDISTINGUISHABLE from "no policies fired": top_policies empty, total_policies 0, and any truncation disclosure computing "nothing hidden". Clients MUST NOT render that as a clean zero result. The portal replaces the tile with an explicit "could not be computed for this range" notice.

The /api/v1/audit/report twin of this field does not exist: on that endpoint a failed aggregation fails the whole response with a 500 instead of truncating.

compliance_scorenumber float

Compliance score 0-100 (100 = no blocked events)

avg_latency_msnumber double nullable

Mean ENFORCEMENT latency in milliseconds over the rows in the range that carried a measurement, or null when none did (#3424). Same contract as the /api/v1/audit/report field of this name: null is the absence of a measurement, NOT a measured zero, and clients MUST accept it (a strict deserializer binding this to a non-optional float will raise). Values below 1 are legitimate -- response_time_ms is whole milliseconds, so a decision completing in under one contributes a 0.

latency_sample_countinteger

How many rows backed avg_latency_ms. 0 exactly when avg_latency_ms is null, and never greater than total_requests. Routinely far below it: planes that record no enforcement duration (HITL approvals, workflow lifecycle rows, the connector-exec MCP closure) and the LLM plane's provider round trips are excluded from the average while still being governed rows. The portal renders this as the tile's basis so an average over a small subset cannot read like an average over all of them.

Changes

No recorded changes to this operation across all 1 revision of this API.