List reads the caller's OWN org audit trail, newest first, with the total the…

List reads the caller's OWN org audit trail, newest first, with the total the filter matched so a console can page it.

GET /v1/audit

Audit → · All API references → · Six flows, four surfaces →


Address	`https://api.hanzo.ai/v1/audit`
Method	`GET`
Operation	`get_audit`
Auth	`Authorization: Bearer $HANZO_API_KEY`

List reads the caller's OWN org audit trail, newest first, with the total the filter matched so a console can page it.

Every filter is optional and applies WITHIN the caller's org — the org itself is the validated principal's and can never be widened by a request. Fails closed: an absent principal is a true "not signed in" (401), and a deployment with no local tamper-evident store answers an honest 501 rather than silently serving somebody else's trail.

Request

9 fields.

Field	In	Type	Required	Description
`sub`	query	string	—	Sub narrows the trail to one actor — the validated subject that made the request.
`action`	query	string	—	Action narrows it to one action name, e.g.
`resource`	query	string	—	Resource narrows it to one resource TYPE, e.g.
`resourceId`	query	string	—	ResourceID narrows it to one resource instance.
`result`	query	string	—	Result narrows it to one outcome: "success", "deny" or "error".
`since`	query	string	—	Since is the inclusive lower time bound, RFC3339.
`until`	query	string	—	Until is the upper time bound, RFC3339, with the same tolerance.
`pageSize`	query	string	—	PageSize is rows per page, default 100.
`p`	query	string	—	Page is the 1-based page number, driving the offset.

Response

Status	Body	Meaning
`200`	trailPage	ok

200 body — 25 fields.

Field	In	Type	Always	Description
`data`	body	Wire[]	—	Data is one page of the org's events, newest first.
`data[].action`	body	string	—	Action is the verb that was performed. It is the event's name, not the HTTP method — a request-sourced record carries both, and the pair is what makes a row…
`data[].authMethod`	body	string	—	Auth is the credential the actor presented: "jwt", "api-key", or "none".
`data[].email`	body	string	—	Email is the actor's validated address, absent when the credential carried none.
`data[].hash`	body	string	—	Hash is this record's SHA-256 over its own canonical JSON with both hash fields cleared, folded with prevHash.
`data[].home`	body	string	—	Home is present ONLY on a cross-org action: the org the actor came FROM, while Org is the org they acted IN.
`data[].isAdmin`	body	boolean	—	IsAdmin is the VALIDATED platform-SuperAdmin bit at decision time (membership of the reserved admin org), never the client's own claim to be one.
`data[].method`	body	string	—	Method is the HTTP verb, on a record a request produced.
`data[].org`	body	string	—	Org is the tenant the action was taken IN — the effective org, which for everyone but an impersonating SuperAdmin is also the actor's own.
`data[].path`	body	string	—	Path is the request's route. Any segment shaped like a credential is replaced before the record is written, so a key that rides in a path is not preserved here…
`data[].prevHash`	body	string	—	PrevHash is the hash of record seq-1, which is what links the rows into a chain: a deleted or reordered record breaks the recomputation at that point.
`data[].reason`	body	string	—	Reason is a short explanation for a deny or an error ("SuperAdmin required", "insufficient_balance").
`data[].requestId`	body	string	—	RequestID ties this row to the request-line log and any downstream trace — the X-Request-Id the pipeline minted for that request.
`data[].resource`	body	string	—	Resource is the KIND of thing acted upon ("org", "role", "secret", "provider-config", "credit").
`data[].resourceId`	body	string	—	ResourceID is the specific instance, absent when the kind alone identifies it.
`data[].result`	body	string	—	Result is how the action ended: "success", "deny" or "error".
`data[].seq`	body	integer	—	Seq is the record's position in the chain, 0-based and gapless.
`data[].sourceIp`	body	string	—	SourceIP is the client address the edge resolved for the request, after the proxy chain — the address a responder would act on, not the socket peer.
`data[].status`	body	integer	—	Status is the HTTP status the caller received.
`data[].sub`	body	string	—	Sub is the acting user (the IAM subject).
`data[].time`	body	string	—	Time is when the action happened, RFC3339Nano in UTC.
`data[].userAgent`	body	string	—	UserAgent is the client the request announced itself as.
`msg`	body	string	—	Msg is the envelope's message slot, empty on success.
`status`	body	string	—	Status is the envelope's status slot, "ok" on success.
`total`	body	integer	—	Total is how many events match the filter, across all pages — what a pager needs to size itself.

Failure carries the platform error shape — see Errors.

Examples

hanzo audit get

import { Configuration, AuditApi } from 'hanzoai';

const api = new AuditApi(new Configuration({ accessToken: process.env.HANZO_API_KEY }));
const { data } = await api.getAudit();

from hanzoai.cloud import ApiClient, Configuration
from hanzoai.cloud.api import AuditApi

client = ApiClient(Configuration(access_token=os.environ["HANZO_API_KEY"]))
result = AuditApi(client).get_audit()

cfg := cloud.NewConfiguration()
cfg.AddDefaultHeader("Authorization", "Bearer "+os.Getenv("HANZO_API_KEY"))
client := cloud.NewAPIClient(cfg)

resp, _, err := client.AuditAPI.GetAudit(context.Background()).Execute()
if err != nil {
	return err
}

use hanzo_cloud::apis::{configuration::Configuration, audit_api};

let mut cfg = Configuration::new();
cfg.bearer_access_token = std::env::var("HANZO_API_KEY").ok();

let result = audit_api::get_audit(&cfg, Default::default()).await?;

import ai.hanzo.cloud.ApiClient;
import ai.hanzo.cloud.api.AuditApi;

ApiClient client = new ApiClient();
client.setRequestInterceptor(b -> b.header("Authorization", "Bearer " + System.getenv("HANZO_API_KEY")));

var result = new AuditApi(client).getAudit();

curl https://api.hanzo.ai/v1/audit \
  -H "Authorization: Bearer $HANZO_API_KEY"

Tool audit, op get_audit — POST the JSON-RPC envelope to https://api.hanzo.ai/v1/mcp.

curl -X POST https://api.hanzo.ai/v1/mcp \
  -H "Authorization: Bearer $HANZO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
       "jsonrpc": "2.0",
       "id": 1,
       "method": "tools/call",
       "params": {
         "name": "audit",
         "arguments": {
           "op": "get_audit",
           "input": {}
         }
       }
     }'

Audit API · All Hanzo APIs · Interactive reference

List reads the caller's OWN org audit trail, newest first, with the total the…

Request

Response

Examples

On this page