Query the audit trail
Requires audit:read. Every filter is optional and all of them combine.
Records come back newest first, in a paginated envelope whose total
counts every matching record rather than the ones on this page.
Authorizations
A machine credential, qk_ followed by its secret. Only a hash of the
secret is stored, so a key is displayed exactly once, when it is created
or rotated. A key reaches only the configurations it is linked to.
It may also be sent as Authorization: Bearer qk_..., which is
recognised by the prefix.
Query Parameters
Only records at or after this instant.
Only records at or before this instant.
An exact action, or a kms.* style prefix that matches a whole
namespace.
"encryption.encrypt"
"kms.*"
Only records attributed to this configuration.
Only records attributed to this principal: a user id or an API key id.
Only records attributed to this kind of principal.
user, api_key, anonymous, system Only records with this outcome. denied is an authorisation decision
and error is a fault.
success, denied, error Only records carrying this correlation id, which is the X-Request-Id
of the request that produced them.
Only records written by this cluster node. Hash chains are maintained per node, so this is the natural unit for chain verification.
"node-01"
1-based page number. A missing, zero or unparseable value is the first page.
x >= 1Rows per page. A larger figure is reduced to the maximum rather than
refused. Note the default differs from the one on
GET /api/v3/classifications.
1 <= x <= 200Response
A page of records.
The pagination envelope. path and every *_page_url are absolute, so
a client can follow next_page_url directly.
At least 1
Every matching record, not the number on this page.
1-based index of the first row on this page; null when empty.
Built for rendering a pager. Labels carry HTML entities.
1-based index of the last row on this page; null when empty.