---
title: "Permanent audit rollup"
method: GET
path: "/v1/audit/tools/rollup"
tags: ["System"]
---

# Permanent audit rollup

`GET /v1/audit/tools/rollup`

## Request

- Base URL: `http://localhost:9998`
- URL: `http://localhost:9998/v1/audit/tools/rollup`
- Auth: HTTP bearer

Per day, per principal, per tool counts with first and last timestamps. Survives both prunes and the entry ceiling, so it answers "did this machine ever run that tool" long after the backing records are gone. Free at every tier.

## Query parameters

- `day` string
- `principal` string
- `tool` string
- `limit` integer
- `offset` integer

## Response `200`

Rollup rows, newest day first

- object
  - `rows` ToolAuditRollupRow[], required
    - `day` string, required: yyyy-MM-dd, UTC.
    - `principal` string, required
    - `tool` string, required
    - `allowed` integer, required
    - `denied` integer, required
    - `awaitingApproval` integer: Calls parked on the REST approval channel, counted in neither `allowed` nor `denied`. Absent from a build that predates it.
    - `firstTs` string, date-time, required
    - `lastTs` string, date-time, required
  - `total` integer, required
  - `limit` integer, required
  - `offset` integer, required

---

[API](https://skmtc.dev/modelpiper/apis/toolpiper-api.md) · [All operations](https://skmtc.dev/modelpiper/apis/toolpiper-api/llms.txt) · [OpenAPI document](https://skmtc.dev/modelpiper/apis/toolpiper-api/revisions/6722bf56385c?raw)