List audit

List reads the caller's OWN org audit trail, newest first, with the total the filter matched so a console can page it.

GET /v1/audit

Audit → · All API references → · Get started →


Address	`https://api.hanzo.ai/v1/audit`
Method	`GET`
Operation	`get_audit`
Auth	`Authorization: Bearer $HANZO_API_KEY`

List reads the caller's OWN org audit trail, newest first, with the total the filter matched so a console can page it.

Every filter is optional and applies WITHIN the caller's org — the org itself is the validated principal's and can never be widened by a request. Fails closed: an absent principal is a true "not signed in" (401), and a deployment with no local tamper-evident store answers an honest 501 rather than silently serving somebody else's trail.

Request

9 fields.

Field	In	Type	Required	Description
`sub`	query	string	—	Sub narrows the trail to one actor — the validated subject that made the request.
`action`	query	string	—	Action narrows it to one action name, e.g.
`resource`	query	string	—	Resource narrows it to one resource TYPE, e.g.
`resourceId`	query	string	—	ResourceID narrows it to one resource instance.
`result`	query	string	—	Result narrows it to one outcome: "success", "deny" or "error".
`since`	query	string	—	Since is the inclusive lower time bound, RFC3339.
`until`	query	string	—	Until is the upper time bound, RFC3339, with the same tolerance.
`pageSize`	query	string	—	PageSize is rows per page, default 100.
`p`	query	string	—	Page is the 1-based page number, driving the offset.

Response

Status	Body	Meaning
`200`	trailPage	ok

200 body — 25 fields.

Field	In	Type	Always	Description
`data`	body	Wire[]	—	Data is one page of the org's events, newest first.
`data[].action`	body	string	—	Action is the verb that was performed. It is the event's name, not the HTTP method — a request-sourced record carries both, and the pair is what makes a row…
`data[].authMethod`	body	string	—	Auth is the credential the actor presented: "jwt", "api-key", or "none".
`data[].email`	body	string	—	Email is the actor's validated address, absent when the credential carried none.
`data[].hash`	body	string	—	Hash is this record's SHA-256 over its own canonical JSON with both hash fields cleared, folded with prevHash.
`data[].home`	body	string	—	Home is present ONLY on a cross-org action: the org the actor came FROM, while Org is the org they acted IN.
`data[].isAdmin`	body	boolean	—	IsAdmin is the VALIDATED platform-SuperAdmin bit at decision time (membership of the reserved admin org), never the client's own claim to be one.
`data[].method`	body	string	—	Method is the HTTP verb, on a record a request produced.
`data[].org`	body	string	—	Org is the tenant the action was taken IN — the effective org, which for everyone but an impersonating SuperAdmin is also the actor's own.
`data[].path`	body	string	—	Path is the request's route. Any segment shaped like a credential is replaced before the record is written, so a key that rides in a path is not preserved here…
`data[].prevHash`	body	string	—	PrevHash is the hash of record seq-1, which is what links the rows into a chain: a deleted or reordered record breaks the recomputation at that point.
`data[].reason`	body	string	—	Reason is a short explanation for a deny or an error ("SuperAdmin required", "insufficient_balance").
`data[].requestId`	body	string	—	RequestID ties this row to the request-line log and any downstream trace — the X-Request-Id the pipeline minted for that request.
`data[].resource`	body	string	—	Resource is the KIND of thing acted upon ("org", "role", "secret", "provider-config", "credit").
`data[].resourceId`	body	string	—	ResourceID is the specific instance, absent when the kind alone identifies it.
`data[].result`	body	string	—	Result is how the action ended: "success", "deny" or "error".
`data[].seq`	body	integer	—	Seq is the record's position in the chain, 0-based and gapless.
`data[].sourceIp`	body	string	—	SourceIP is the client address the edge resolved for the request, after the proxy chain — the address a responder would act on, not the socket peer.
`data[].status`	body	integer	—	Status is the HTTP status the caller received.
`data[].sub`	body	string	—	Sub is the acting user (the IAM subject).
`data[].time`	body	string	—	Time is when the action happened, RFC3339Nano in UTC.
`data[].userAgent`	body	string	—	UserAgent is the client the request announced itself as.
`msg`	body	string	—	Msg is the envelope's message slot, empty on success.
`status`	body	string	—	Status is the envelope's status slot, "ok" on success.
`total`	body	integer	—	Total is how many events match the filter, across all pages — what a pager needs to size itself.

Failure carries the platform error shape — see Errors.

Examples

hanzo audit get

import { Configuration, AuditApi } from 'hanzoai';

const api = new AuditApi(new Configuration({ accessToken: process.env.HANZO_API_KEY }));
const { data } = await api.getAudit();

from hanzoai.cloud import ApiClient, Configuration
from hanzoai.cloud.api import AuditApi

client = ApiClient(Configuration(access_token=os.environ["HANZO_API_KEY"]))
result = AuditApi(client).get_audit()

cfg := cloud.NewConfiguration()
cfg.AddDefaultHeader("Authorization", "Bearer "+os.Getenv("HANZO_API_KEY"))
client := cloud.NewAPIClient(cfg)

resp, _, err := client.AuditAPI.GetAudit(context.Background()).Execute()
if err != nil {
	return err
}

use hanzo_cloud::apis::{configuration::Configuration, audit_api};

let mut cfg = Configuration::new();
cfg.bearer_access_token = std::env::var("HANZO_API_KEY").ok();

let result = audit_api::get_audit(&cfg, Default::default()).await?;

import ai.hanzo.cloud.ApiClient;
import ai.hanzo.cloud.api.AuditApi;

ApiClient client = new ApiClient();
client.setRequestInterceptor(b -> b.header("Authorization", "Bearer " + System.getenv("HANZO_API_KEY")));

var result = new AuditApi(client).getAudit();

curl https://api.hanzo.ai/v1/audit \
  -H "Authorization: Bearer $HANZO_API_KEY"

Tool audit, op get_audit — POST the JSON-RPC envelope to https://api.hanzo.ai/v1/mcp.

curl -X POST https://api.hanzo.ai/v1/mcp \
  -H "Authorization: Bearer $HANZO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
       "jsonrpc": "2.0",
       "id": 1,
       "method": "tools/call",
       "params": {
         "name": "audit",
         "arguments": {
           "op": "get_audit",
           "input": {}
         }
       }
     }'

Audit API · All Hanzo APIs · Interactive reference

Request

Response

Examples

On this page