---
title: "Replay current firewall rules against the recorded tool trail"
method: GET
path: "/v1/audit/tools/replay"
tags: ["System"]
---

# Replay current firewall rules against the recorded tool trail

`GET /v1/audit/tools/replay`

## Request

- Base URL: `http://localhost:9998`
- URL: `http://localhost:9998/v1/audit/tools/replay`
- Auth: HTTP bearer

Read-only, free at every tier. Requires system:control. Evaluates the effective ruleset, including the security posture floor, against the selected audit page. Unknown inputs remain unknown; argument values and session state are not reconstructed. The candidate digest identifies the exact rules revision evaluated.

## Query parameters

- `limit` integer
- `offset` integer
- `tool` string
- `owner` string
- `principal` string
- `outcome` 'allowed' | 'denied' | 'awaiting_approval'
- `recordClass` 'routine' | 'security'
- `since` string, date-time
- `until` string, date-time
- `include` 'actionDetail'

## Response `200`

Per-rule evidence and coverage over the selected records

- ToolAuditReplayReport
  - `candidateDigest` string, required
  - `recordsEvaluated` number, required
  - `windowStart` string, nullable, required
  - `windowEnd` string, nullable, required
  - `rules` ToolAuditReplayRule[], required
    - `ruleId` string, required
    - `ruleName` string, required
    - `ruleDigest` string, required
    - `action` string, required
    - `state` string, required
    - `coverage` 'fullyReplayable' | 'partiallyReplayable', required
    - `gaps` ToolAuditReplayGapDetail[], required
      - `gap` 'argumentValues' | 'sessionState' | 'historicalClassification' | 'peerNotResolved' | 'transportCollapsed' | 'ruleNotAdmissible', required
      - `cause` 'privacy' | 'notPersisted' | 'notObserved' | 'collapsed' | 'ruleRefused', required
      - `reason` string, required
    - `knownMatches` number, required
    - `knownNonMatches` number, required
    - `unknown` number, required
    - `deniedSeqs` number[], required
    - `deniedSeqsTruncated` boolean, required

## Other responses

- `400`: Invalid request
- `401`: Authentication required
- `403`: Missing system:control scope or forbidden principal
- `503`: Firewall or audit writer unavailable

---

[API](https://skmtc.dev/modelpiper/apis/toolpiper-api.md) · [All operations](https://skmtc.dev/modelpiper/apis/toolpiper-api/llms.txt) · [OpenAPI document](https://skmtc.dev/modelpiper/apis/toolpiper-api/revisions/6722bf56385c?raw)