List Audit Events

Use this endpoint to list audit events with filters and cursor-based pagination. Designed for SOX/GLBA compliance reporting.

GET /v1/audit-events

List Audit Events

cURL

curl --request GET \
  --url https://tracer.lerian.io/v1/audit-events \
  --header 'Content-Type: <content-type>' \
  --header 'X-API-Key: <api-key>'

200

Example

{ "auditEvents": [ { "eventId": "3c90c3cc-0d44-4b50-8888-8dd25736052a", "resourceId": "<string>", "actor": { "id": "<string>", "name": "<string>", "role": "<string>", "ipAddress": "<string>" }, "context": {}, "metadata": {}, "hash": "<string>", "previousHash": "<string>", "createdAt": "2023-11-07T05:31:56Z" } ], "hasMore": true, "nextCursor": "<string>" }

Authorizations

ApiKeyAuthBearerAuth

X-API-Key · string · header · required

API Key authentication. Used by single-tenant deployments (MULTI_TENANT_ENABLED=false). Sent on every /v1/* request.

Headers

Content-Type · string · required

The type of media of the resource. Must be application/json.

X-API-Key · string · required

The API Key for authentication. This header is required for all endpoints except health checks.

X-Request-Id · string<uuid>

A unique identifier used to trace and track each request.

Query Parameters

limit · integer · default: 100

The maximum number of items to include in the response. Default: 100, Max: 1000

Required range: 1 <= x <= 1000

cursor · string

Pagination cursor from previous response.

start_date · string<date-time>

Start date (RFC3339 format with timezone, inclusive). Defaults to 90 days before current time.

end_date · string<date-time>

End date (RFC3339 format with timezone, exclusive). Defaults to current time.

event_type · enum<string>

Filter by event type.

Available options: TRANSACTION_VALIDATED, RULE_CREATED, RULE_UPDATED, RULE_ACTIVATED, RULE_DEACTIVATED, RULE_DRAFTED, RULE_DELETED, LIMIT_CREATED, LIMIT_UPDATED, LIMIT_ACTIVATED, LIMIT_DEACTIVATED, LIMIT_DRAFTED, LIMIT_DELETED

action · enum<string>

Filter by action.

Available options: VALIDATE, CREATE, UPDATE, DELETE, ACTIVATE, DEACTIVATE, DRAFT

result · enum<string>

Filter by result.

Available options: SUCCESS, FAILED, ALLOW, DENY, REVIEW

resource_type · enum<string>

Filter by resource type.

Available options: transaction, rule, limit

resource_id · string<uuid>

Filter by resource ID (UUID).

actor_type · enum<string>

Filter by actor type.

Available options: user, system

actor_id · string

Filter by actor ID.

account_id · string<uuid>

Filter by account ID (queries context.request.account.id).

segment_id · string<uuid>

Filter by segment ID.

portfolio_id · string<uuid>

Filter by portfolio ID.

transaction_type · string

Filter by transaction type.

matched_rule_id · string<uuid>

Filter by matched rule ID (array contains query).

sort_by · enum<string> · default: created_at

The field used to sort the results.

Available options: created_at, event_type

sort_order · enum<string> · default: DESC

The order used to sort the results.

Available options: ASC, DESC

Response

200

application/json

Indicates that the request was successful and the response contains the expected data.

Paginated list of audit events for SOX/GLBA compliance.

auditEvents · object[]

List of audit event records.

Maximum array length: 1000

Show child attributes

hasMore · boolean

Whether there are more results available.

nextCursor · string | null

Cursor for fetching the next page. Null if no more results.