# List audit URL: https://docs.hanzo.ai/docs/openapi/audit/get-audit > Reads the caller's OWN org audit trail, newest first, with the total the filter matched so a console can page it. `GET /v1/audit` > [Audit →](https://docs.hanzo.ai/docs/openapi/audit) · [All API references →](https://docs.hanzo.ai/docs/openapi) · [Get started →](https://docs.hanzo.ai/docs/guides) | | | | ------------- | -------------------------------------- | | **Address** | `https://api.hanzo.ai/v1/audit` | | **Method** | `GET` | | **Operation** | `get_audit` | | **Auth** | `Authorization: Bearer $HANZO_API_KEY` | Reads the caller's OWN org audit trail, newest first, with the total the filter matched so a console can page it. Every filter is optional and applies WITHIN the caller's org — the org itself is the validated principal's and can never be widened by a request. Fails closed: an absent principal is a true "not signed in" (401), and a deployment with no local tamper-evident store answers an honest 501 rather than silently serving somebody else's trail. ## Request 9 fields. | Field | In | Type | Required | Description | | ------------ | ----- | ------ | -------- | --------------------------------------------------------------------------------- | | `sub` | query | string | — | Sub narrows the trail to one actor — the validated subject that made the request. | | `action` | query | string | — | Action narrows it to one action name, e.g. "machine.create". | | `resource` | query | string | — | Resource narrows it to one resource TYPE, e.g. "apikey". | | `resourceId` | query | string | — | ResourceID narrows it to one resource instance. | | `result` | query | string | — | Result narrows it to one outcome: "success", "deny" or "error". | | `since` | query | string | — | Since is the inclusive lower time bound, RFC3339. | | `until` | query | string | — | Until is the upper time bound, RFC3339, with the same tolerance. | | `pageSize` | query | string | — | PageSize is rows per page, default 100. | | `p` | query | string | — | Page is the 1-based page number, driving the offset. | ## Response | Status | Body | Meaning | | --------- | --------------- | ------- | | `200` | audit.trailPage | ok | | `default` | problem-details | refused | `200` body — 27 fields. | Field | In | Type | Always | Description | | ------------------- | ---- | ---------------- | ------ | ------------------------------------------------------------------------------------------------------------------------------------------------------ | | `data` | body | audit.Wire\[] | — | Data is one page of the org's events, newest first. | | `data[].action` | body | string | — | Action is the verb that was performed. | | `data[].after` | body | any | — | After is the changed thing as the action left it, redacted the same way. | | `data[].authMethod` | body | string | — | Auth is the credential the actor presented: "jwt", "api-key", or "none". | | `data[].before` | body | any | — | Before is the changed thing as it stood before the action, as JSON, with every secret-shaped field already redacted. | | `data[].email` | body | string | — | Email is the actor's validated address, absent when the credential carried none. | | `data[].hash` | body | string | — | Hash is this record's SHA-256 over its own canonical JSON with both hash fields cleared, folded with prevHash. | | `data[].home` | body | string | — | Home is present ONLY on a cross-org action: the org the actor came FROM, while Org is the org they acted IN. | | `data[].isAdmin` | body | boolean | — | IsAdmin is the VALIDATED platform-SuperAdmin bit at decision time (owner == "admin", principal.Super), never the client's own claim to be one. | | `data[].method` | body | string | — | Method is the HTTP verb, on a record a request produced. | | `data[].org` | body | string | — | Org is the tenant the action was taken IN — the effective org, which for everyone but an impersonating SuperAdmin is also the actor's own. | | `data[].path` | body | string | — | Path is the request's route. | | `data[].prevHash` | body | string | — | PrevHash is the hash of record seq-1, which is what links the rows into a chain: a deleted or reordered record breaks the recomputation at that point. | | `data[].reason` | body | string | — | Reason is a short explanation for a deny or an error ("SuperAdmin required", "insufficient\_balance"). | | `data[].requestId` | body | string | — | RequestID ties this row to the request-line log and any downstream trace — the X-Request-Id the pipeline minted for that request. | | `data[].resource` | body | string | — | Resource is the KIND of thing acted upon ("org", "role", "secret", "provider-config", "credit"). | | `data[].resourceId` | body | string | — | ResourceID is the specific instance, absent when the kind alone identifies it. | | `data[].result` | body | string | — | Result is how the action ended: "success", "deny" or "error". | | `data[].seq` | body | integer (uint64) | — | Seq is the record's position in the chain, 0-based and gapless. | | `data[].sourceIp` | body | string | — | SourceIP is the client address the edge resolved for the request, after the proxy chain — the address a responder would act on, not the socket peer. | | `data[].status` | body | integer (int64) | — | Status is the HTTP status the caller received. | | `data[].sub` | body | string | — | Sub is the acting user (the IAM subject). | | `data[].time` | body | string | — | Time is when the action happened, RFC3339Nano in UTC. | | `data[].userAgent` | body | string | — | UserAgent is the client the request announced itself as. | | `msg` | body | string | — | Msg is the envelope's message slot, empty on success. | | `status` | body | string | — | Status is the envelope's status slot, "ok" on success. | | `total` | body | integer (int64) | — | Total is how many events match the filter, across all pages — what a pager needs to size itself. | Failure carries the platform error shape — see [Errors](https://docs.hanzo.ai/docs/errors). ## Examples **CLI** ```bash hanzo audit get ``` **SDK** **.ts** ```ts import { Configuration, AuditApi } from 'hanzoai'; const api = new AuditApi(new Configuration({ accessToken: process.env.HANZO_API_KEY })); const { data } = await api.getAudit(); ``` **.py** ```python from hanzoai.cloud import ApiClient, Configuration from hanzoai.cloud.api import AuditApi client = ApiClient(Configuration(access_token=os.environ["HANZO_API_KEY"])) result = AuditApi(client).get_audit() ``` **.go** ```go cfg := hanzoai.NewConfiguration() cfg.AddDefaultHeader("Authorization", "Bearer "+os.Getenv("HANZO_API_KEY")) client := hanzoai.NewAPIClient(cfg) resp, _, err := client.AuditAPI.GetAudit(context.Background()).Execute() if err != nil { return err } ``` **.rs** ```rust use hanzo_client::apis::{configuration::Configuration, audit_api}; let mut cfg = Configuration::new(); cfg.bearer_access_token = std::env::var("HANZO_API_KEY").ok(); let result = audit_api::get_audit(&cfg, Default::default()).await?; ``` **.java** ```java import ai.hanzo.cloud.ApiClient; import ai.hanzo.cloud.api.AuditApi; ApiClient client = new ApiClient(); client.setBearerToken(System.getenv("HANZO_API_KEY")); var result = new AuditApi(client).getAudit(); ``` **HTTP** ```bash curl https://api.hanzo.ai/v1/audit \ -H "Authorization: Bearer $HANZO_API_KEY" ``` **MCP** MCP reaches **audit** through the `audit` tool, which names its 1 operations with its own verbs — this one among them, under a name only MCP declares. `describe` explains any of them: ```bash curl -X POST https://api.hanzo.ai/v1/mcp \ -H "Content-Type: application/json" \ -d '{ "jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": { "name": "describe", "arguments": { "op": "list_audits" } } }' ``` --- [Audit API](https://docs.hanzo.ai/docs/openapi/audit) · [All Hanzo APIs](https://docs.hanzo.ai/docs/openapi) · [Interactive reference](https://docs.hanzo.ai/docs/openapi/reference)