--- title: "List trigger event history" method: POST path: "/api/v2/agent/listTriggerHistory" tags: ["Agent"] --- # List trigger event history `POST /api/v2/agent/listTriggerHistory` ## Request - Base URL: `https://zeropath.com` - URL: `https://zeropath.com/api/v2/agent/listTriggerHistory` - Auth: API key in header `X-ZeroPath-API-Token-Id` and API key in header `X-ZeroPath-API-Token-Secret` List past agent jobs triggered by events (webhooks, scan completions, new findings, etc.). Only returns EVENT-triggered jobs (not manual, Slack, or cron jobs). Filter by triggerId to see runs of a specific trigger, or by eventType (e.g. "INBOUND_WEBHOOK" for webhooks only). Each result includes the trigger context (credential-redacted metadata for webhooks), status, prompt, and result summary. Use agent.getTriggerEvent with a job ID for full details including messages. ## Request body - AgentListTriggerHistoryRequest - `organizationId` string: Organization ID (injected by MCP server) - `triggerId` string, uuid: Filter to runs of a specific event trigger (get trigger IDs from agent.listEventTriggers) - `eventType` 'SCAN_STARTED' | 'SCAN_COMPLETE' | 'PR_SCAN_STARTED' | 'PR_SCAN_COMPLETE' | 'NEW_VULNERABILITIES_PR' | 'NEW_VULNERABILITIES_FULL_SCAN' | 'VULNERABILITY_PATCHED' | 'VULNERABILITY_REOPENED' | 'AUDIT_LOG_EVENT' | 'SCAN_FAILED' | 'SCAN_SCHEDULED' | 'LONG_RUNNING_SCAN' | 'PR_BLOCKED' | 'PR_MERGED_WITH_ISSUES' | 'REPORT_COMPLETE' | 'SCA_NEW_CVE' | 'SCA_NEW_ISSUE' | 'INBOUND_WEBHOOK' | 'PATCH_PR_DENIED' | 'VULNERABILITY_STATUS_CHANGED' | 'SCA_SCAN_COMPLETE' | 'SCA_SCAN_STARTED' | 'SCA_SCAN_FAILED' | 'REPO_ADDED' | 'RUNTIME_VALIDATION_FINISHED' | 'RUNTIME_VALIDATION_EXPLOITABLE' | 'RUNTIME_VALIDATION_NOT_EXPLOITABLE' | 'RUNTIME_VALIDATION_UNABLE' | 'CONTAINER_SCAN_STARTED' | 'CONTAINER_SCAN_COMPLETE' | 'CONTAINER_NEW_ISSUE' | 'ISSUE_AGED_PAST_THRESHOLD' | 'SLA_BURN_RATE_HIGH': Filter by event type. The notification event type. Event triggers are event-driven automation: they run only after ZeroPath emits the selected notification event, and every enabled trigger matching that event and scope runs. They do not poll, run on a timer, or create recurring checks. Use agent.createCronSchedule for recurring monitoring, time-window analysis, timeout-rate checks, or requests phrased as "every N hours/days" or "on a schedule". PR scan timeout monitoring is a cron-schedule use case unless the user explicitly asks to react to an individual scan that has already emitted LONG_RUNNING_SCAN. Event type guide: SCAN_STARTED: A full repository code scan started. Use for reacting to the start of non-PR SAST scans. SCAN_COMPLETE: A full repository code scan completed and findings are available. Use for full-scan triage or summaries. PR_SCAN_STARTED: A pull request scan started. Use for reacting to a specific PR scan beginning. PR_SCAN_COMPLETE: A pull request scan completed and PR findings are available. Use for PR review follow-up. NEW_VULNERABILITIES_PR: New vulnerability findings were detected by a PR scan. Use for PR-scoped finding triage. NEW_VULNERABILITIES_FULL_SCAN: New vulnerability findings were detected by a full repository scan. Use for full-scan finding triage. VULNERABILITY_PATCHED: A vulnerability was marked patched, often after a remediation PR. Use for fix verification follow-up. VULNERABILITY_REOPENED: A vulnerability was reopened after previously being closed or resolved. Use for re-triage. AUDIT_LOG_EVENT: A security-relevant audit log entry was recorded. Use for reviewing administrative or configuration activity. SCAN_FAILED: A code scan failed. Use for investigating one failed scan event, not for recurring failure-rate reporting. SCAN_SCHEDULED: A platform code scan schedule was created or changed. This is about scanner schedules, not assistant cron schedules. LONG_RUNNING_SCAN: A single FullScan, PrScan, or SCAScan has already crossed ZeroPath long-running thresholds. Use only to react to that emitted incident. Do not use this for recurring PR scan timeout or timeout-rate monitoring; create an agent cron schedule instead. PR_BLOCKED: A pull request was blocked by security findings or policy. Use for advising on the blocked PR. PR_MERGED_WITH_ISSUES: A pull request was merged while security issues remained open. Use for post-merge risk follow-up. REPORT_COMPLETE: A generated ZeroPath report finished. Use for reviewing or distributing that report. SCA_NEW_CVE: A newly observed CVE affects dependencies in the organization, potentially across repositories. Use for dependency advisory triage. SCA_NEW_ISSUE: A concrete dependency vulnerability issue was created for a repository/package. Use for repo-specific SCA issue triage. INBOUND_WEBHOOK: An external system posted to this trigger-specific webhook URL. Use for custom external automation inputs. PATCH_PR_DENIED: A ZeroPath-generated patch PR was closed or rejected without merge. Use for inspecting feedback and deciding next remediation steps. VULNERABILITY_STATUS_CHANGED: One or more findings changed status. Use for syncing automation state after triage updates. SCA_SCAN_COMPLETE: A dependency analysis scan completed. Use for SCA scan result review. SCA_SCAN_STARTED: A dependency analysis scan started. Use for reacting to a specific SCA scan beginning. SCA_SCAN_FAILED: A dependency analysis scan failed. Use for investigating one failed SCA scan event. REPO_ADDED: A repository was added to the organization. Use for onboarding or initial security automation. RUNTIME_VALIDATION_FINISHED: A Runtime Validation run finished with aggregate results. Use for summarizing run-level validation outcome. RUNTIME_VALIDATION_EXPLOITABLE: Runtime Validation confirmed an issue is exploitable. Use for prioritizing remediation. RUNTIME_VALIDATION_NOT_EXPLOITABLE: Runtime Validation marked an issue not exploitable. Use for updating triage or accepted-risk decisions. RUNTIME_VALIDATION_UNABLE: Runtime Validation could not validate an issue. Use for identifying missing runtime context or setup gaps. CONTAINER_SCAN_STARTED: A container image scan started. Use for reacting to a specific container scan beginning. CONTAINER_SCAN_COMPLETE: A container image scan completed and image findings are available. Use for container scan result review. CONTAINER_NEW_ISSUE: A concrete container image vulnerability issue was created. Use for image-specific vulnerability triage. ISSUE_AGED_PAST_THRESHOLD: An open vulnerability issue has remained unresolved past its SLA policy age threshold. Use for aging-issue escalation or remediation follow-up. SLA_BURN_RATE_HIGH: An SLA compliance policy is burning down its remediation budget faster than the target rate. Use for proactive SLA risk monitoring before deadlines are missed. - `cursor` string, uuid: Cursor for pagination (pass nextCursor from a previous response) - `limit` integer: Number of results to return (default 25, max 100) ## Response `200` Paginated list of event-triggered jobs - AgentListTriggerHistoryResponse - `jobs` object[], required: Event-triggered agent runs, newest first - `id` string, uuid, required: Job ID — pass to agent.getTriggerEvent for full details - `status` string, required: PENDING, RUNNING, COMPLETED, FAILED, or CANCELLED - `prompt` string, required: The prompt sent to the agent (with webhook payload substituted) - `context` unknown - `startedAt` string, date-time, nullable - `completedAt` string, date-time, nullable - `resultSummary` string, nullable: What the agent accomplished - `error` string, nullable: Error message if the job failed - `createdAt` string, date-time, required - `eventTrigger` object, nullable: The event trigger that fired this job - `id` string, uuid - `name` string, nullable - `eventType` string - `nextCursor` string, uuid, nullable: Pass as cursor to get the next page, null if no more results ## Other responses - `401`: Error Response --- [API](https://skmtc.dev/zeropath/apis/zeropath-api.md) - [All operations](https://skmtc.dev/zeropath/apis/zeropath-api/llms.txt) - [OpenAPI document](https://skmtc.dev/zeropath/apis/zeropath-api/revisions/126e9c80ba0d?raw)