List Audit Events
curl --request GET \
--url http://{host}:{port}/{basePath}/audit \
--header 'Authorization: <api-key>'import requests
url = "http://{host}:{port}/{basePath}/audit"
headers = {"Authorization": "<api-key>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: '<api-key>'}};
fetch('http://{host}:{port}/{basePath}/audit', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_PORT => "62437",
CURLOPT_URL => "http://{host}:{port}/{basePath}/audit",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "http://{host}:{port}/{basePath}/audit"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "<api-key>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("http://{host}:{port}/{basePath}/audit")
.header("Authorization", "<api-key>")
.asString();require 'uri'
require 'net/http'
url = URI("http://{host}:{port}/{basePath}/audit")
http = Net::HTTP.new(url.host, url.port)
request = Net::HTTP::Get.new(url)
request["Authorization"] = '<api-key>'
response = http.request(request)
puts response.read_body{
"apiVersion": "v1",
"kind": "AuditLogList",
"metadata": {
"totalCount": 156,
"page": 1,
"pageSize": 50
},
"items": [
{
"id": "audit-20260319-001",
"timestamp": "2026-03-19T15:35:00Z",
"action": "approval.approve",
"user": "carlos.silva@empresa.com",
"role": "operator",
"resource": "APR-20260319-001",
"resourceType": "Approval",
"namespace": "production",
"details": {
"incident": "INC-20260319-001",
"comment": "Aprovado — analise de IA confirma necessidade de aumento de memoria"
},
"sourceIP": "10.0.1.50",
"userAgent": "Mozilla/5.0"
},
{
"id": "audit-20260319-002",
"timestamp": "2026-03-19T15:30:00Z",
"action": "incident.acknowledge",
"user": "carlos.silva@empresa.com",
"role": "operator",
"resource": "INC-20260319-001",
"resourceType": "Incident",
"namespace": "production",
"details": {
"message": "Investigando aumento de memoria no payment-service"
},
"sourceIP": "10.0.1.50",
"userAgent": "Mozilla/5.0"
},
{
"id": "audit-20260319-003",
"timestamp": "2026-03-19T15:21:05Z",
"action": "remediation.execute",
"user": "system",
"role": "system",
"resource": "INC-20260319-001",
"resourceType": "Remediation",
"namespace": "production",
"details": {
"runbook": "runbook-oomkill-standard",
"step": "diagnose-memory-usage",
"result": "success"
},
"sourceIP": "internal",
"userAgent": "chatcli-operator/1.0"
}
]
}
Audit
List Audit Events
Returns the audit log with all actions performed on the platform
GET
/
audit
List Audit Events
curl --request GET \
--url http://{host}:{port}/{basePath}/audit \
--header 'Authorization: <api-key>'import requests
url = "http://{host}:{port}/{basePath}/audit"
headers = {"Authorization": "<api-key>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: '<api-key>'}};
fetch('http://{host}:{port}/{basePath}/audit', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_PORT => "62437",
CURLOPT_URL => "http://{host}:{port}/{basePath}/audit",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "http://{host}:{port}/{basePath}/audit"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "<api-key>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("http://{host}:{port}/{basePath}/audit")
.header("Authorization", "<api-key>")
.asString();require 'uri'
require 'net/http'
url = URI("http://{host}:{port}/{basePath}/audit")
http = Net::HTTP.new(url.host, url.port)
request = Net::HTTP::Get.new(url)
request["Authorization"] = '<api-key>'
response = http.request(request)
puts response.read_body{
"apiVersion": "v1",
"kind": "AuditLogList",
"metadata": {
"totalCount": 156,
"page": 1,
"pageSize": 50
},
"items": [
{
"id": "audit-20260319-001",
"timestamp": "2026-03-19T15:35:00Z",
"action": "approval.approve",
"user": "carlos.silva@empresa.com",
"role": "operator",
"resource": "APR-20260319-001",
"resourceType": "Approval",
"namespace": "production",
"details": {
"incident": "INC-20260319-001",
"comment": "Aprovado — analise de IA confirma necessidade de aumento de memoria"
},
"sourceIP": "10.0.1.50",
"userAgent": "Mozilla/5.0"
},
{
"id": "audit-20260319-002",
"timestamp": "2026-03-19T15:30:00Z",
"action": "incident.acknowledge",
"user": "carlos.silva@empresa.com",
"role": "operator",
"resource": "INC-20260319-001",
"resourceType": "Incident",
"namespace": "production",
"details": {
"message": "Investigando aumento de memoria no payment-service"
},
"sourceIP": "10.0.1.50",
"userAgent": "Mozilla/5.0"
},
{
"id": "audit-20260319-003",
"timestamp": "2026-03-19T15:21:05Z",
"action": "remediation.execute",
"user": "system",
"role": "system",
"resource": "INC-20260319-001",
"resourceType": "Remediation",
"namespace": "production",
"details": {
"runbook": "runbook-oomkill-standard",
"step": "diagnose-memory-usage",
"result": "success"
},
"sourceIP": "internal",
"userAgent": "chatcli-operator/1.0"
}
]
}
string
Filter by action type:
incident.acknowledge, incident.snooze, approval.approve, approval.reject, runbook.create, runbook.update, runbook.delete, remediation.execute, config.updatestring
Filter by user who performed the action
string
Filter by affected resource (e.g.,
INC-20260319-001)string
Filter events from a given ISO 8601 date
string
Filter events up to a given ISO 8601 date
integer
default:"1"
Page number
integer
default:"50"
Items per page (maximum 200)
{
"apiVersion": "v1",
"kind": "AuditLogList",
"metadata": {
"totalCount": 156,
"page": 1,
"pageSize": 50
},
"items": [
{
"id": "audit-20260319-001",
"timestamp": "2026-03-19T15:35:00Z",
"action": "approval.approve",
"user": "carlos.silva@empresa.com",
"role": "operator",
"resource": "APR-20260319-001",
"resourceType": "Approval",
"namespace": "production",
"details": {
"incident": "INC-20260319-001",
"comment": "Aprovado — analise de IA confirma necessidade de aumento de memoria"
},
"sourceIP": "10.0.1.50",
"userAgent": "Mozilla/5.0"
},
{
"id": "audit-20260319-002",
"timestamp": "2026-03-19T15:30:00Z",
"action": "incident.acknowledge",
"user": "carlos.silva@empresa.com",
"role": "operator",
"resource": "INC-20260319-001",
"resourceType": "Incident",
"namespace": "production",
"details": {
"message": "Investigando aumento de memoria no payment-service"
},
"sourceIP": "10.0.1.50",
"userAgent": "Mozilla/5.0"
},
{
"id": "audit-20260319-003",
"timestamp": "2026-03-19T15:21:05Z",
"action": "remediation.execute",
"user": "system",
"role": "system",
"resource": "INC-20260319-001",
"resourceType": "Remediation",
"namespace": "production",
"details": {
"runbook": "runbook-oomkill-standard",
"step": "diagnose-memory-usage",
"result": "success"
},
"sourceIP": "internal",
"userAgent": "chatcli-operator/1.0"
}
]
}
Authorizations
Bearer token issued by the operator. Format: Authorization: Bearer <token>.
Query Parameters
Filter by action type.
Example:
"approval.approve"
Filter by user.
Filter by affected resource.
ISO 8601 timestamp lower bound.
ISO 8601 timestamp upper bound.
Page number.
Items per page (max 200).
Required range:
x <= 200⌘I