---
title: "Rules the trail implies"
method: GET
path: "/audit/suggestions"
---

# Rules the trail implies

`GET /audit/suggestions`

## Request

- Base URL: `https://secureai.one/v1`
- URL: `https://secureai.one/v1/audit/suggestions`
- Auth: HTTP bearer

Derived from recent activity. Nothing is changed by reading this.

Some useful corrections cannot be suggested: 'stop flagging this specific value' would need the trail to hold values, and it does not. That one is set by hand through /policy/allow.

## Response `200`

Up to ten suggestions, strongest evidence first, tightenings ahead of loosenings.

- object
  - `window` integer: How many recent actions they were derived from.
  - `suggestions` Suggestion[]
    - `id` string, required: Stable across calls, so one can be dismissed or applied.
    - `title` string, required
    - `because` string, required: The evidence, with the numbers that produced it.
    - `rule` Rule: One line of policy. When two rules match the same finding, the later one wins.
      - `kind` 'secret' | 'card' | 'iban' | 'ssn' | 'govid' | 'email' | 'phone' | 'address' | 'postcode' | 'name' | 'host', required
      - `decision` 'allow' | 'redact' | 'approve' | 'block', required
      - `tools` string[]: Only these tools. Exact, or a single trailing "*". Absent means all.
      - `direction` 'outbound' | 'inbound': Absent means both.
    - `denyTool` string: Set instead of `rule` when the suggestion is about a tool rather than a kind.
    - `direction` 'tighter' | 'looser' | 'advisory', required: Whether acting on this narrows or widens the policy. A UI should never present the two in one undifferentiated list.
    - `count` integer, required

## Other responses

- `401`: Missing or invalid credentials.

---

[API](https://skmtc.dev/secureai/apis/secure-ai.md) · [All operations](https://skmtc.dev/secureai/apis/secure-ai/llms.txt) · [OpenAPI document](https://skmtc.dev/secureai/apis/secure-ai/revisions/6eefd7f53f8b?raw)