---
title: "What agents did"
method: GET
path: "/audit"
---

# What agents did

`GET /audit`

## Request

- Base URL: `https://secureai.one/v1`
- URL: `https://secureai.one/v1/audit`
- Auth: HTTP bearer

Newest first. Records hold the kind and location of what was found and never the values. Kept for 90 days.

## Query parameters

- `limit` integer
- `cursor` string

## Response `200`

A page of events.

- object
  - `events` AuditEvent[]
    - `id` string, required
    - `ts` integer, required: Milliseconds since epoch.
    - `keyId` string, required: Which API key made the call, so a leak traces to an integration.
    - `agent` string, nullable
    - `tool` string, required
    - `direction` 'outbound' | 'inbound', required
    - `decision` 'allow' | 'redact' | 'approve' | 'block', required
    - `toolDenied` boolean, required
    - `findings` Finding[], required
      - `kind` 'secret' | 'card' | 'iban' | 'ssn' | 'govid' | 'email' | 'phone' | 'address' | 'postcode' | 'name' | 'host', required
      - `path` string, required: Dotted path into the action, e.g. "body.customer.email". Empty when the input was a bare string.
      - `decision` 'allow' | 'redact' | 'approve' | 'block', required
    - `inspected` boolean: False when the gateway could not read the body — an image, a zip. Absent means it was inspected.
  - `cursor` string, nullable

## Other responses

- `401`: Missing or invalid API key.

---

[API](https://skmtc.dev/secureai/apis/secure-ai.md) · [All operations](https://skmtc.dev/secureai/apis/secure-ai/llms.txt) · [OpenAPI document](https://skmtc.dev/secureai/apis/secure-ai/revisions/6eefd7f53f8b?raw)