Skip to main content
GET
List Audit Events
string
Filter by the namespace of the AuditEvent. Omit it to list every namespace.
string
Filter by eventType (exact match), e.g. issue_created, issue_resolved, issue_escalated, issue_contained, remediation_started, remediation_completed, remediation_failed, approval_requested, approval_approved, approval_rejected, approval_expired, notification_sent, slo_violation, sla_breach
string
Filter by severity: info, warning, critical
string
Filter by the affected resource name (exact match on resourceName)
string
Only events at or after this RFC 3339 timestamp (spec.timestamp, falling back to the creation time)
string
Only events at or before this RFC 3339 timestamp
integer
default:"1"
Page number
integer
default:"20"
Items per page (maximum 100)
Minimum role: viewer. AuditEvents are written by the operator’s controllers (Issue, Remediation, Notification, SLO and SLA reconcilers). The actor is the controller, except for approval_approved and approval_rejected after a human decision: then actorType is user and actorName lists the approvers recorded in the ApprovalRequest status.decisions (also in the approvers detail). An auto-approval or an expiry names ApprovalReconciler. Calls to this REST API (acknowledge, approve, runbook edits and so on) are not recorded as AuditEvents; the operator only logs them as [REST] lines in its own log. detail flattens spec.details into key=value pairs joined by ; (map order, so the pair order is not stable). Items are sorted newest first by timestamp (the creation time when it is missing), so each page is a stable slice of the trail.

Authorizations

X-API-Key
string
header
required

API key sent in the X-API-Key header. Keys are read from the Secret chatcli-operator-secrets, key api-keys (fallback: ConfigMap chatcli-operator-config, key api-keys) in the operator namespace, as a YAML list of {key, role, name, description} (name is the identity recorded on approval decisions); the operator chart creates it only with apiKeys.create: true. Roles: viewer < operator < admin — any other role string is denied everywhere. Changes are picked up within about 30 seconds; deleting both the Secret and the ConfigMap revokes every key. With no keys configured every /api/ call returns 401, unless CHATCLI_OPERATOR_DEV_MODE=true, which grants admin without a key (development only).

Query Parameters

namespace
string

Kubernetes namespace. Empty means all namespaces.

type
string

Exact match on spec.eventType: issue_created, issue_resolved, issue_escalated, issue_contained, remediation_started, remediation_completed, remediation_failed, approval_requested, approval_approved, approval_rejected, approval_expired, notification_sent, slo_violation or sla_breach.

severity
string

Exact match on spec.severity.

resource
string

Exact match on spec.resource.name.

from
string<date-time>

Start of the time range (RFC3339). Unparseable values are ignored.

Example:

"2026-03-01T00:00:00Z"

to
string<date-time>

End of the time range (RFC3339). Unparseable values are ignored.

Example:

"2026-03-19T23:59:59Z"

page
integer
default:1

Page number (1-based). Invalid values fall back to 1.

Required range: x >= 1
pageSize
integer
default:20

Items per page. Values above 100 are capped at 100.

Required range: 1 <= x <= 100

Response

Paginated audit events

apiVersion
string
Example:

"v1"

kind
string
Example:

"AuditEventList"

metadata
object
items
object[]