audit

Summary

Counts over the SAME compiled row filter and from/to window semantics as GET /audit-events (including the RFC3339-or-YYYY-MM-DD parsing and malformed-bound-is-400 rule), so a summary tile never claims a count the event list itself would refuse to show. group_by is one of action, resource_type, actor or group (group buckets by the actor's CURRENT group memberships and is multi-valued; with interval=day it is a per-group day series) (actor buckets NULL actor_account_id — system-initiated events like verification grants — under the explicit key "system" rather than leaving it blank); interval adds a time-bucketed data.series over the same window.

get/audit-events/summary

Request

  • Base URL: https://api.instruxi.dev/api/v1/enforcer
  • URL: https://api.instruxi.dev/api/v1/enforcer/audit-events/summary
  • Auth: one of:
    • API key in header Authorization
    • API key in header X-API-Key

Query parameters

group_by'action' | 'resource_type' | 'actor' | 'group'

bucket dimension; group = the actor's groups (multi-valued, current membership)

group_idstring uuid

only events whose actor is a member of this group; 404 group_not_found if not visible

exclude_group_idstring uuid

drop events whose actor is a member of this group (system events kept); 404 group_not_found if not visible

actionstring

filter by action

resource_typestring

filter by resource type

actor_account_idstring

filter by actor account id

sincestring

RFC3339 lower bound (inclusive)

untilstring

RFC3339 upper bound (exclusive)

intervalstring

hour | day | week | month — returns data.series

session_idstring

one login's events — matches session_id OR external_session_id

tzstring

IANA time zone for bucketing (default UTC)

tenant_idstring uuid

list this tenant instead of your own (default: the caller's own tenant, platform admins included). Another tenant requires the cross_tenant grant — 403 otherwise

all_tenantsboolean

list EVERY tenant (platform-wide admin view). Requires the cross_tenant grant — 403 otherwise. Mutually exclusive with tenant_id (400 conflicting_tenant_scope)

Response

OK

successboolean

Example response

{
  "success": true
}

Changes

No recorded changes to this operation across all 1 revision of this API.