---
title: "List wallet custody drift findings"
method: GET
path: "/admin/wallet-audit"
tags: ["wallet-audit"]
---

# List wallet custody drift findings

`GET /admin/wallet-audit`

## Request

- Base URL: `https://api.instruxi.dev/api/v1/enforcer`
- URL: `https://api.instruxi.dev/api/v1/enforcer/admin/wallet-audit`
- Auth: one of:
  - API key in header `Authorization`
  - API key in header `X-API-Key`

The custody drift worklist: accounts whose LIVE signing posture does not match what our rows claim. Open findings only unless include_resolved=true. Ordered worst-and-oldest first (critical before warning, then by how long the condition has persisted).

## Query parameters

- `account_id` string
- `group_id` string, uuid
- `exclude_group_id` string, uuid
- `rule` 'wallet.app_only_custody' | 'wallet.cosign_not_enforced' | 'wallet.quorum_unreadable' | 'wallet.owner_drift' | 'wallet.unmigrated_primary' | 'tenant.illegal_web3_gates'
- `severity` 'critical' | 'warning' | 'info'
- `include_resolved` boolean
- `limit` integer
- `offset` integer
- `tenant_id` string, uuid
- `all_tenants` boolean

## Response `200`

OK

- InternalDeliveryHttpHandlerWalletAuditListResponse
  - `data` EnforcerV3InternalDomainWalletauditFinding[]
    - `account_id` string
    - `alerted_at` string: AlertedAt stamps when this finding paged, so it pages once rather than every pass. History is kept: a re-detected condition opens a NEW row, which is what makes flapping visible instead of hidden behind one perpetually-open row.
    - `details` EnforcerV3InternalDomainWalletauditJSONBMap
    - `first_detected_at` string: FirstDetectedAt is the dwell clock the worklist sorts by. Preserved across passes — an upsert must never reset it, or a long-standing problem would look new forever and nothing would ever appear old.
    - `id` string
    - `last_seen_at` string
    - `remedy` string
    - `resolved_at` string
    - `rule` string
    - `severity` string
    - `subject` string
    - `summary` string
    - `tenant_id` string
  - `limit` integer
  - `offset` integer
  - `success` boolean
  - `total` integer

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `403`: Forbidden
- `404`: group_not_found
- `500`: Internal Server Error

---

[API](https://skmtc.dev/instruxi/apis/enforcer-api.md) · [All operations](https://skmtc.dev/instruxi/apis/enforcer-api/llms.txt) · [OpenAPI document](https://skmtc.dev/instruxi/apis/enforcer-api/revisions/fa82bc1becc0?raw)