---
title: "Summary"
method: GET
path: "/audit-events/summary"
tags: ["audit"]
---

# Summary

`GET /audit-events/summary`

## Request

- Base URL: `https://api.instruxi.dev/api/v1/enforcer`
- URL: `https://api.instruxi.dev/api/v1/enforcer/audit-events/summary`
- Auth: one of:
  - API key in header `Authorization`
  - API key in header `X-API-Key`

Counts over the SAME compiled row filter and from/to window semantics as GET /audit-events (including the RFC3339-or-YYYY-MM-DD parsing and malformed-bound-is-400 rule), so a summary tile never claims a count the event list itself would refuse to show. group_by is one of action, resource_type, actor or group (group buckets by the actor's CURRENT group memberships and is multi-valued; with interval=day it is a per-group day series) (actor buckets NULL actor_account_id — system-initiated events like verification grants — under the explicit key "system" rather than leaving it blank); interval adds a time-bucketed data.series over the same window.

## Query parameters

- `group_by` 'action' | 'resource_type' | 'actor' | 'group'
- `group_id` string, uuid
- `exclude_group_id` string, uuid
- `action` string
- `resource_type` string
- `actor_account_id` string
- `since` string
- `until` string
- `interval` string
- `session_id` string
- `tz` string
- `tenant_id` string, uuid
- `all_tenants` boolean

## Response `200`

OK

- EnforcerV3InternalDomainSummaryResponse
  - `data` EnforcerV3InternalDomainSummaryData
    - `buckets` EnforcerV3InternalDomainSummaryBucket[]
      - `count` integer
      - `key` string
      - `label` string
      - `pct` number
    - `dimension` string
    - `multi_valued` boolean
    - `series` EnforcerV3InternalDomainSummaryPoint[]
      - `by` object
      - `count` integer
      - `ts` string
    - `total` integer
    - `truncated` boolean
  - `success` boolean
  - `window` EnforcerV3InternalDomainSummaryWindow
    - `interval` string
    - `since` string
    - `tz` string
    - `until` string

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `403`: forbidden: tenant_id/all_tenants beyond your own tenant without the cross_tenant grant
- `404`: group_not_found

---

[API](https://skmtc.dev/instruxi/apis/enforcer-api.md) · [All operations](https://skmtc.dev/instruxi/apis/enforcer-api/llms.txt) · [OpenAPI document](https://skmtc.dev/instruxi/apis/enforcer-api/revisions/fa82bc1becc0?raw)