---
title: "List retained human review decisions"
method: GET
path: "/audit"
tags: ["Review evidence"]
---

# List retained human review decisions

`GET /audit`

## Request

- Base URL: `https://www.sanctionskit.com/api/v1`
- URL: `https://www.sanctionskit.com/api/v1/audit`
- Auth: HTTP bearer
- TypeScript: <https://skmtc.dev/sanctionskit/apis/sanctionskit-api/docs/audit/get.ts> (a function with typed inputs; its response is checked against the schema)

Required API key scope: results:read.

Read append-only human decision history, newest first. Filter by q or review and follow nextCursor. Notes are replaced with [removed under retention policy] after expiry; evidenceAvailable describes the linked evidence and does not reverse an earlier human decision.

## Query parameters

- `limit` integer
- `cursor` string, uuid
- `q` string
- `review` 'open' | 'confirmed' | 'dismissed' | 'unreviewed'

## Response `200`

Successful response. JSON object with the required data key. All properties marked required are present, including keys whose value may be null. Unmarked properties can be omitted; clients should tolerate additional response properties.

- object
  - `data` AuditPage, required
    - `items` object[], required
      - `id` string, uuid, required
      - `caseId` string, uuid, required
      - `actorId` string, required
      - `actorEmail` string, nullable, required
      - `decision` 'open' | 'confirmed' | 'dismissed', required
      - `businessDisposition` 'pending' | 'allow' | 'restrict' | 'escalate', required
      - `appliedControls` AppliedDecisionControls, required: Immutable decision-time approval configuration. A null appliedControls value on a decision means no historic snapshot is available; current settings are never substituted. Notification recipients and document hosts are excluded.
        - `governanceRevision` integer, required
        - `organizationApproval` object, required
          - `requireSecondReview` boolean, required
          - `secondReviewFor` string[], required
          - `approverRoles` string[], required
        - `restrictedRoles` object, required
          - `approval` string[], required
          - `production` string[], required
        - `screeningPolicy` object, nullable, required
          - `id` string, uuid, required
          - `version` integer, required
          - `review` object, required
            - `requireSecondReview` boolean, required
            - `secondReviewFor` string[], required
            - `approverRoles` string[], required
      - `notes` string, nullable, required
      - `createdAt` string, date-time, required
      - `screeningId` string, uuid, nullable, required
      - `subjectName` string, nullable, required
      - `evidenceAvailable` boolean, required
    - `nextCursor` string, nullable, required

## Other responses

- `400`: **invalid_request** — Correct the request fields, resource identifiers, JSON body or query parameters before retrying.
- `401`: **authentication_required** — Send Authorization: Bearer with a valid API key. An omitted header can produce authentication_required; invalid supplied credentials produce invalid_api_key. **invalid_api_key** — Use an active key for the intended environment.
- `403`: **permission_denied** — Ask an organization owner to grant the required role or API-key scope. **insufficient_scope** — Use a key with the scope stated in this operation.
- `405`: **method_not_allowed** — Use a method in the Allow response header. OPTIONS lists supported methods; HEAD follows GET authorization and returns no body.
- `413`: **response_too_large** — Reduce the requested page size or use the documented segmented case archive. No evidence is silently truncated.
- `429`: **rate_limited** — Wait for the request window to reset and retry with backoff.
- `500`: **internal_error** — Retry with backoff. For writes reuse the same idempotency key and identical input; include requestId when contacting support.
- `503`: **temporarily_unavailable** — Honor Retry-After when present and retry with bounded backoff. Follow this endpoint’s retry contract; preserve the same key and input for idempotent writes. Contact support with requestId if the failure persists.

---

[API](https://skmtc.dev/sanctionskit/apis/sanctionskit-api.md) - [All operations](https://skmtc.dev/sanctionskit/apis/sanctionskit-api/llms.txt) - [OpenAPI document](https://skmtc.dev/sanctionskit/apis/sanctionskit-api/revisions/ee35d211051a?raw)