---
title: "List Graph Mutations"
method: GET
path: "/v1/graphs/{graph_id}/audit/mutations"
tags: ["Graph Audit"]
---

# List Graph Mutations

`GET /v1/graphs/{graph_id}/audit/mutations`

## Request

- Base URL: `https://api.robosystems.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://api.robosystems.ai/v1/graphs/{graph_id}/audit/mutations`
- Auth: one of:
  - API key in header `X-API-Key`
  - HTTP bearer

Every call that changed this graph, newest first: REST operations, external MCP clients, and in-app AI operator runs. Each entry names the operation, the outcome, who made it and with which credential, and the objects it touched. Arguments are not stored, only their SHA-256 fingerprint. Requires graph admin.

## Path parameters

- `graph_id` string, required: Graph identifier

## Query parameters

- `surface` 'api' | 'mcp' | 'operator', nullable: Only calls from this surface
- `operation_name` string, nullable: Only this operation or MCP tool
- `user_id` string, nullable: Only calls made as this user
- `operation_id` string, nullable: Only calls from this REST operation or operator run
- `since` string, date-time, nullable: Only calls at or after this time
- `until` string, date-time, nullable: Only calls before this time
- `cursor` string, nullable: The `next_cursor` of the previous page
- `limit` integer: Entries per page

## Response `200`

Successful Response

- MutationAuditListResponse: A page of the graph's mutation audit, newest first.
  - `graph_id` string, required
  - `entries` MutationAuditEntry[], required
    - `id` string, required: Audit entry identifier
    - `occurred_at` string, date-time, required: When the call finished
    - `surface` 'api' | 'mcp' | 'operator', required: Where the call came from: 'api' for a REST operation, 'mcp' for an external MCP client, 'operator' for an in-app AI operator run such as the console's /do
    - `operation_name` string, required: The operation or MCP tool that ran
    - `status` 'completed' | 'failed' | 'pending', required: Whether the call succeeded; a failed call changed nothing it reports. 'pending' means the call started background work; follow its operation_id for the outcome
    - `error_code` string, nullable: Why a failed call failed
    - `duration_ms` number, required: How long the call took
    - `user_id` string, nullable: The user the call ran as
    - `auth_method` string, nullable: How the caller authenticated, for example 'api_key' or 'oauth'
    - `api_key_prefix` string, nullable: The first characters of the API key used, when one was
    - `request_id` string, nullable: The HTTP request that made the call
    - `operation_id` string, nullable: The REST operation's envelope id, or the operator run's operation id: every write an operator run makes shares it
    - `operator_type` string, nullable: The operator that made the call, for surface 'operator'
    - `arguments_fingerprint` string, nullable: SHA-256 of the call's arguments. The arguments themselves are not stored
    - `object_ids` string[]: Identifiers of the objects the call touched
  - `next_cursor` string, nullable: Pass as `cursor` for the next, older page; null on the last page

## Other responses

- `400`: Invalid request
- `401`: Authentication required
- `403`: Access denied
- `404`: Resource not found
- `422`: Validation Error
- `429`: Rate limit exceeded
- `500`: Internal server error

---

[API](https://skmtc.dev/robosystems/apis/robosystems-api.md) · [All operations](https://skmtc.dev/robosystems/apis/robosystems-api/llms.txt) · [OpenAPI document](https://skmtc.dev/robosystems/apis/robosystems-api/revisions/e661e2d5ca6a?raw)