List audit

The compliance read of the SHARED tamper-evident audit plane — the SOC 2 posture surface (privileged actions: who started/decided what, when).

GET /v1/compliance/audit

Compliance → · All API references → · Get started →

Address	`https://api.hanzo.ai/v1/compliance/audit`
Method	`GET`
Operation	`get_compliance_audit`
Auth	`Authorization: Bearer $HANZO_API_KEY`

The compliance read of the SHARED tamper-evident audit plane — the SOC 2 posture surface (privileged actions: who started/decided what, when). The org is PINNED to the caller's validated org and the rows are narrowed to compliance.* actions. Fail-closed: no principal is a 401, no configured audit store a 501.

Request

1 field.

Field	In	Type	Required	Description
`result`	query	string	—	Result filters rows by outcome result: success, deny, or error; empty means all.

Response

Status	Body	Meaning
`200`	compliance.auditList	ok
`default`	problem-details	refused

200 body — 25 fields.

Field	In	Type	Always	Description
`data`	body	compliance.Wire[]	—	Data is the org's compliance.* audit rows, newest first.
`data[].action`	body	string	—	Action is the verb that was performed.
`data[].after`	body	any	—	After is the changed thing as the action left it, redacted the same way.
`data[].authMethod`	body	string	—	Auth is the credential the actor presented: "jwt", "api-key", or "none".
`data[].before`	body	any	—	Before is the changed thing as it stood before the action, as JSON, with every secret-shaped field already redacted.
`data[].email`	body	string	—	Email is the actor's validated address, absent when the credential carried none.
`data[].hash`	body	string	—	Hash is this record's SHA-256 over its own canonical JSON with both hash fields cleared, folded with prevHash.
`data[].home`	body	string	—	Home is present ONLY on a cross-org action: the org the actor came FROM, while Org is the org they acted IN.
`data[].isAdmin`	body	boolean	—	IsAdmin is the VALIDATED platform-SuperAdmin bit at decision time (owner == "admin", principal.Super), never the client's own claim to be one.
`data[].method`	body	string	—	Method is the HTTP verb, on a record a request produced.
`data[].org`	body	string	—	Org is the tenant the action was taken IN — the effective org, which for everyone but an impersonating SuperAdmin is also the actor's own.
`data[].path`	body	string	—	Path is the request's route.
`data[].prevHash`	body	string	—	PrevHash is the hash of record seq-1, which is what links the rows into a chain: a deleted or reordered record breaks the recomputation at that point.
`data[].reason`	body	string	—	Reason is a short explanation for a deny or an error ("SuperAdmin required", "insufficient_balance").
`data[].requestId`	body	string	—	RequestID ties this row to the request-line log and any downstream trace — the X-Request-Id the pipeline minted for that request.
`data[].resource`	body	string	—	Resource is the KIND of thing acted upon ("org", "role", "secret", "provider-config", "credit").
`data[].resourceId`	body	string	—	ResourceID is the specific instance, absent when the kind alone identifies it.
`data[].result`	body	string	—	Result is how the action ended: "success", "deny" or "error".
`data[].seq`	body	integer (uint64)	—	Seq is the record's position in the chain, 0-based and gapless.
`data[].sourceIp`	body	string	—	SourceIP is the client address the edge resolved for the request, after the proxy chain — the address a responder would act on, not the socket peer.
`data[].status`	body	integer (int64)	—	Status is the HTTP status the caller received.
`data[].sub`	body	string	—	Sub is the acting user (the IAM subject).
`data[].time`	body	string	—	Time is when the action happened, RFC3339Nano in UTC.
`data[].userAgent`	body	string	—	UserAgent is the client the request announced itself as.
`disclaimer`	body	string	—	Disclaimer states that statuses are provider-reported or tracked, never a platform assertion of legal or regulatory compliance.

Failure carries the platform error shape — see Errors.

Examples

CLI

SDK

HTTP

MCP

hanzo compliance audit

.ts

.py

.go

.rs

.java

import { Configuration, ComplianceApi } from 'hanzoai';

const api = new ComplianceApi(new Configuration({ accessToken: process.env.HANZO_API_KEY }));
const { data } = await api.getComplianceAudit();

from hanzoai.cloud import ApiClient, Configuration
from hanzoai.cloud.api import ComplianceApi

client = ApiClient(Configuration(access_token=os.environ["HANZO_API_KEY"]))
result = ComplianceApi(client).get_compliance_audit()

cfg := hanzoai.NewConfiguration()
cfg.AddDefaultHeader("Authorization", "Bearer "+os.Getenv("HANZO_API_KEY"))
client := hanzoai.NewAPIClient(cfg)

resp, _, err := client.ComplianceAPI.GetComplianceAudit(context.Background()).Execute()
if err != nil {
	return err
}

use hanzo_client::apis::{configuration::Configuration, compliance_api};

let mut cfg = Configuration::new();
cfg.bearer_access_token = std::env::var("HANZO_API_KEY").ok();

let result = compliance_api::get_compliance_audit(&cfg, Default::default()).await?;

import ai.hanzo.cloud.ApiClient;
import ai.hanzo.cloud.api.ComplianceApi;

ApiClient client = new ApiClient();
client.setBearerToken(System.getenv("HANZO_API_KEY"));

var result = new ComplianceApi(client).getComplianceAudit();

curl https://api.hanzo.ai/v1/compliance/audit \
  -H "Authorization: Bearer $HANZO_API_KEY"

Tool compliance, op get_compliance_audit — POST the JSON-RPC envelope to https://api.hanzo.ai/v1/mcp.

curl -X POST https://api.hanzo.ai/v1/mcp \
  -H "Authorization: Bearer $HANZO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
       "jsonrpc": "2.0",
       "id": 1,
       "method": "tools/call",
       "params": {
         "name": "compliance",
         "arguments": {
           "op": "get_compliance_audit",
           "input": {}
         }
       }
     }'

Compliance API · All Hanzo APIs · Interactive reference

Was this page useful?

PreviousList accreditation NextList health