Skip to content
Yagra

list_audit

GET
/api/v1/audit
curl --request GET \
  --url https://example.com/api/v1/audit \
  --header 'Authorization: Bearer <token>'

Authorizations

Section titled “Authorizations”

Parameters

Section titled “Parameters”

Query Parameters

Section titled “Query Parameters”
limit
integer format: int64

Max rows (1–500, default 100).

before
string

Keyset cursor: return rows strictly older than this RFC 3339 timestamp.

since
string

Only entries at or after this RFC 3339 timestamp.

until
string

Only entries at or before this RFC 3339 timestamp.

q
string

Free text matched against the username and the action (case-insensitive substring).

action
string

Comma-separated action kinds (post, put, patch, delete, login, mcp); empty or absent means every kind. An unknown token is rejected rather than ignored.

status
string

Comma-separated status classes (ok, client, server); empty or absent means every class.

Responses

Section titled “Responses”

200

Section titled “200”

One page of audit rows, newest first

Media typeapplication/json
Array<object>

One audit row (API shape; at is RFC 3339 text at the edge).

object
action
required
string
at
required
string
id
required
string format: uuid
status
required
integer format: int32
username
required
string
Examplegenerated
[
  {
    "action": "example",
    "at": "example",
    "id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
    "status": 1,
    "username": "example"
  }
]

400

Section titled “400”

A cursor or range bound is not RFC 3339, or action/status is not one of the listed values

Media typeapplication/json

The ADR-019 envelope every failure renders as. pub(crate) and schema-bearing so the OpenAPI document can name one error shape for every endpoint (ADR-035) instead of leaving 4xx/5xx bodies undescribed — a client that has to guess the failure shape ends up parsing the success shape and reading undefined.

object
error
required
object
code
required

Stable machine-readable code. Clients branch on this, never on the message.

string
message
required

Operator-facing sentence. Safe to display; never carries an internal error’s own text.

string
Examplegenerated
{
  "error": {
    "code": "example",
    "message": "example"
  }
}

401

Section titled “401”

No valid bearer token

Media typeapplication/json

The ADR-019 envelope every failure renders as. pub(crate) and schema-bearing so the OpenAPI document can name one error shape for every endpoint (ADR-035) instead of leaving 4xx/5xx bodies undescribed — a client that has to guess the failure shape ends up parsing the success shape and reading undefined.

object
error
required
object
code
required

Stable machine-readable code. Clients branch on this, never on the message.

string
message
required

Operator-facing sentence. Safe to display; never carries an internal error’s own text.

string
Examplegenerated
{
  "error": {
    "code": "example",
    "message": "example"
  }
}

403

Section titled “403”

Role lacks the view-audit permission

Media typeapplication/json

The ADR-019 envelope every failure renders as. pub(crate) and schema-bearing so the OpenAPI document can name one error shape for every endpoint (ADR-035) instead of leaving 4xx/5xx bodies undescribed — a client that has to guess the failure shape ends up parsing the success shape and reading undefined.

object
error
required
object
code
required

Stable machine-readable code. Clients branch on this, never on the message.

string
message
required

Operator-facing sentence. Safe to display; never carries an internal error’s own text.

string
Examplegenerated
{
  "error": {
    "code": "example",
    "message": "example"
  }
}

503

Section titled “503”

Skeleton mode keeps no audit log

Media typeapplication/json

The ADR-019 envelope every failure renders as. pub(crate) and schema-bearing so the OpenAPI document can name one error shape for every endpoint (ADR-035) instead of leaving 4xx/5xx bodies undescribed — a client that has to guess the failure shape ends up parsing the success shape and reading undefined.

object
error
required
object
code
required

Stable machine-readable code. Clients branch on this, never on the message.

string
message
required

Operator-facing sentence. Safe to display; never carries an internal error’s own text.

string
Examplegenerated
{
  "error": {
    "code": "example",
    "message": "example"
  }
}