# List audit URL: https://docs.hanzo.ai/docs/openapi/compliance/get-compliance-audit > The compliance read of the SHARED tamper-evident audit plane — the SOC 2 posture surface (privileged actions: who started/decided what, when). `GET /v1/compliance/audit` > [Compliance →](https://docs.hanzo.ai/docs/openapi/compliance) · [All API references →](https://docs.hanzo.ai/docs/openapi) · [Get started →](https://docs.hanzo.ai/docs/guides) | | | | ------------- | ------------------------------------------ | | **Address** | `https://api.hanzo.ai/v1/compliance/audit` | | **Method** | `GET` | | **Operation** | `get_compliance_audit` | | **Auth** | `Authorization: Bearer $HANZO_API_KEY` | The compliance read of the SHARED tamper-evident audit plane — the SOC 2 posture surface (privileged actions: who started/decided what, when). The org is PINNED to the caller's validated org and the rows are narrowed to compliance.\* actions. Fail-closed: no principal is a 401, no configured audit store a 501. ## Request 1 field. | Field | In | Type | Required | Description | | -------- | ----- | ------ | -------- | -------------------------------------------------------------------------------- | | `result` | query | string | — | Result filters rows by outcome result: success, deny, or error; empty means all. | ## Response | Status | Body | Meaning | | --------- | -------------------- | ------- | | `200` | compliance.auditList | ok | | `default` | problem-details | refused | `200` body — 25 fields. | Field | In | Type | Always | Description | | ------------------- | ---- | ------------------ | ------ | ------------------------------------------------------------------------------------------------------------------------------------------------------ | | `data` | body | compliance.Wire\[] | — | Data is the org's compliance.\* audit rows, newest first. | | `data[].action` | body | string | — | Action is the verb that was performed. | | `data[].after` | body | any | — | After is the changed thing as the action left it, redacted the same way. | | `data[].authMethod` | body | string | — | Auth is the credential the actor presented: "jwt", "api-key", or "none". | | `data[].before` | body | any | — | Before is the changed thing as it stood before the action, as JSON, with every secret-shaped field already redacted. | | `data[].email` | body | string | — | Email is the actor's validated address, absent when the credential carried none. | | `data[].hash` | body | string | — | Hash is this record's SHA-256 over its own canonical JSON with both hash fields cleared, folded with prevHash. | | `data[].home` | body | string | — | Home is present ONLY on a cross-org action: the org the actor came FROM, while Org is the org they acted IN. | | `data[].isAdmin` | body | boolean | — | IsAdmin is the VALIDATED platform-SuperAdmin bit at decision time (owner == "admin", principal.Super), never the client's own claim to be one. | | `data[].method` | body | string | — | Method is the HTTP verb, on a record a request produced. | | `data[].org` | body | string | — | Org is the tenant the action was taken IN — the effective org, which for everyone but an impersonating SuperAdmin is also the actor's own. | | `data[].path` | body | string | — | Path is the request's route. | | `data[].prevHash` | body | string | — | PrevHash is the hash of record seq-1, which is what links the rows into a chain: a deleted or reordered record breaks the recomputation at that point. | | `data[].reason` | body | string | — | Reason is a short explanation for a deny or an error ("SuperAdmin required", "insufficient\_balance"). | | `data[].requestId` | body | string | — | RequestID ties this row to the request-line log and any downstream trace — the X-Request-Id the pipeline minted for that request. | | `data[].resource` | body | string | — | Resource is the KIND of thing acted upon ("org", "role", "secret", "provider-config", "credit"). | | `data[].resourceId` | body | string | — | ResourceID is the specific instance, absent when the kind alone identifies it. | | `data[].result` | body | string | — | Result is how the action ended: "success", "deny" or "error". | | `data[].seq` | body | integer (uint64) | — | Seq is the record's position in the chain, 0-based and gapless. | | `data[].sourceIp` | body | string | — | SourceIP is the client address the edge resolved for the request, after the proxy chain — the address a responder would act on, not the socket peer. | | `data[].status` | body | integer (int64) | — | Status is the HTTP status the caller received. | | `data[].sub` | body | string | — | Sub is the acting user (the IAM subject). | | `data[].time` | body | string | — | Time is when the action happened, RFC3339Nano in UTC. | | `data[].userAgent` | body | string | — | UserAgent is the client the request announced itself as. | | `disclaimer` | body | string | — | Disclaimer states that statuses are provider-reported or tracked, never a platform assertion of legal or regulatory compliance. | Failure carries the platform error shape — see [Errors](https://docs.hanzo.ai/docs/errors). ## Examples **CLI** ```bash hanzo compliance audit ``` **SDK** **.ts** ```ts import { Configuration, ComplianceApi } from 'hanzoai'; const api = new ComplianceApi(new Configuration({ accessToken: process.env.HANZO_API_KEY })); const { data } = await api.getComplianceAudit(); ``` **.py** ```python from hanzoai.cloud import ApiClient, Configuration from hanzoai.cloud.api import ComplianceApi client = ApiClient(Configuration(access_token=os.environ["HANZO_API_KEY"])) result = ComplianceApi(client).get_compliance_audit() ``` **.go** ```go cfg := hanzoai.NewConfiguration() cfg.AddDefaultHeader("Authorization", "Bearer "+os.Getenv("HANZO_API_KEY")) client := hanzoai.NewAPIClient(cfg) resp, _, err := client.ComplianceAPI.GetComplianceAudit(context.Background()).Execute() if err != nil { return err } ``` **.rs** ```rust use hanzo_client::apis::{configuration::Configuration, compliance_api}; let mut cfg = Configuration::new(); cfg.bearer_access_token = std::env::var("HANZO_API_KEY").ok(); let result = compliance_api::get_compliance_audit(&cfg, Default::default()).await?; ``` **.java** ```java import ai.hanzo.cloud.ApiClient; import ai.hanzo.cloud.api.ComplianceApi; ApiClient client = new ApiClient(); client.setBearerToken(System.getenv("HANZO_API_KEY")); var result = new ComplianceApi(client).getComplianceAudit(); ``` **HTTP** ```bash curl https://api.hanzo.ai/v1/compliance/audit \ -H "Authorization: Bearer $HANZO_API_KEY" ``` **MCP** Tool `compliance`, op `get_compliance_audit` — POST the JSON-RPC envelope to `https://api.hanzo.ai/v1/mcp`. ```bash curl -X POST https://api.hanzo.ai/v1/mcp \ -H "Authorization: Bearer $HANZO_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": { "name": "compliance", "arguments": { "op": "get_compliance_audit", "input": {} } } }' ``` --- [Compliance API](https://docs.hanzo.ai/docs/openapi/compliance) · [All Hanzo APIs](https://docs.hanzo.ai/docs/openapi) · [Interactive reference](https://docs.hanzo.ai/docs/openapi/reference)