Audit API

GET/api/audit/compliance-contract

request access

Compliance contract.

Permissions

HTTP request

GET https://<your-host>/api/audit/compliance-contract

Path parameters

This operation has no path parameters.

Query parameters

This operation has no query parameters.

Request headers

Request body

This operation does not accept a request body.

Response

200 response body

Structure: Value.

Errors

JSON failures use one of the platform error envelopes and include the request correlation metadata when routing reaches the API middleware. See Errors for the exact shapes, authentication failures, retry guidance, and transport-level exceptions.

Examples

Request

curl --silent --show-error --globoff \
  --request GET \
  --header 'Authorization: Bearer <token>' \
  'https://<your-host>/api/audit/compliance-contract'

Schematic response body

Illustrative shape generated from the extracted field types, not a recorded live response. Values are placeholders; null marks a field whose type could not be resolved.

Success status: 200

{
  "source": "<string>",
  "providerCallsEnabled": false,
  "liveExecutionEnabled": false,
  "endpoints": []
}

GET/api/audit/compliance/controls

audit access

List compliance controls.

Permissions

HTTP request

GET https://<your-host>/api/audit/compliance/controls

Path parameters

This operation has no path parameters.

Query parameters

Request headers

Request body

This operation does not accept a request body.

Response

200 response body

Structure: Value.

Returns a paginated JSON object with total/limit/offset keys.

Errors

JSON failures use one of the platform error envelopes and include the request correlation metadata when routing reaches the API middleware. See Errors for the exact shapes, authentication failures, retry guidance, and transport-level exceptions.

Examples

Request

curl --silent --show-error --globoff \
  --request GET \
  --header 'Authorization: Bearer <token>' \
  'https://<your-host>/api/audit/compliance/controls'

Schematic response body

Illustrative shape generated from the extracted field types, not a recorded live response. Values are placeholders; null marks a field whose type could not be resolved.

Success status: 200

{
  "source": null,
  "framework_id": null,
  "site": null,
  "count": null,
  "total": null,
  "limit": null,
  "offset": null,
  "controls": null
}

GET/api/audit/compliance/controls/{id}

audit access

Get compliance control.

Permissions

HTTP request

GET https://<your-host>/api/audit/compliance/controls/{id}

Path parameters

Query parameters

This operation has no query parameters.

Request headers

Request body

This operation does not accept a request body.

Response

200 response body

Structure: Value.

Errors

JSON failures use one of the platform error envelopes and include the request correlation metadata when routing reaches the API middleware. See Errors for the exact shapes, authentication failures, retry guidance, and transport-level exceptions.

Examples

Request

curl --silent --show-error --globoff \
  --request GET \
  --header 'Authorization: Bearer <token>' \
  'https://<your-host>/api/audit/compliance/controls/<id>'

Schematic response body

Illustrative shape generated from the extracted field types, not a recorded live response. Values are placeholders; null marks a field whose type could not be resolved.

Success status: 200

{
  "source": "<string>",
  "control": null
}

POST/api/audit/compliance/controls/{id}/assess

admin access

Compliance control assess.

Permissions

HTTP request

POST https://<your-host>/api/audit/compliance/controls/{id}/assess

Path parameters

Query parameters

This operation has no query parameters.

Request headers

Request body

JSON structure: ComplianceAssessRequest.

Response

200 response body

Structure: Value.

Errors

JSON failures use one of the platform error envelopes and include the request correlation metadata when routing reaches the API middleware. See Errors for the exact shapes, authentication failures, retry guidance, and transport-level exceptions.

Examples

Request

curl --silent --show-error --globoff \
  --request POST \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --header 'Idempotency-Key: <idempotency-key>' \
  --data '{"status":"<string>","evidenceRef":"<string>"}' \
  'https://<your-host>/api/audit/compliance/controls/<id>/assess'

Schematic response body

Illustrative shape generated from the extracted field types, not a recorded live response. Values are placeholders; null marks a field whose type could not be resolved.

Success status: 200

{
  "source": "<string>",
  "control": null
}

GET/api/audit/compliance/findings

audit access

List compliance findings.

Permissions

HTTP request

GET https://<your-host>/api/audit/compliance/findings

Path parameters

This operation has no path parameters.

Query parameters

Request headers

Request body

This operation does not accept a request body.

Response

200 response body

Structure: Value.

Returns a paginated JSON object with total/limit/offset keys.

Errors

JSON failures use one of the platform error envelopes and include the request correlation metadata when routing reaches the API middleware. See Errors for the exact shapes, authentication failures, retry guidance, and transport-level exceptions.

Examples

Request

curl --silent --show-error --globoff \
  --request GET \
  --header 'Authorization: Bearer <token>' \
  'https://<your-host>/api/audit/compliance/findings'

Schematic response body

Illustrative shape generated from the extracted field types, not a recorded live response. Values are placeholders; null marks a field whose type could not be resolved.

Success status: 200

{
  "source": null,
  "site": null,
  "severity": null,
  "count": null,
  "total": null,
  "limit": null,
  "offset": null,
  "findings": null
}

GET/api/audit/compliance/findings/{id}

audit access

Read ONE compliance finding (the read-by-id companion to the list + resolve/waive mutations, so an operator can inspect a finding before resolving/waiving it).

Audit-tier (via the /api/audit route prefix). Findings have no own site column, so an out-of-scope finding is scoped on its parent report's site and reported identically to a missing one (the 404 body) — no existence oracle, mirroring compliance_finding_resolve.

Permissions

HTTP request

GET https://<your-host>/api/audit/compliance/findings/{id}

Path parameters

Query parameters

This operation has no query parameters.

Request headers

Request body

This operation does not accept a request body.

Response

200 response body

Structure: Value.

Errors

JSON failures use one of the platform error envelopes and include the request correlation metadata when routing reaches the API middleware. See Errors for the exact shapes, authentication failures, retry guidance, and transport-level exceptions.

Examples

Request

curl --silent --show-error --globoff \
  --request GET \
  --header 'Authorization: Bearer <token>' \
  'https://<your-host>/api/audit/compliance/findings/<id>'

Schematic response body

Illustrative shape generated from the extracted field types, not a recorded live response. Values are placeholders; null marks a field whose type could not be resolved.

Success status: 200

{
  "source": "<string>",
  "finding": null
}

POST/api/audit/compliance/findings/{id}/resolve

admin access

Compliance finding resolve.

Permissions

HTTP request

POST https://<your-host>/api/audit/compliance/findings/{id}/resolve

Path parameters

Query parameters

This operation has no query parameters.

Request headers

Request body

JSON structure: ComplianceResolveRequest.

Response

200 response body

Structure: Value.

Errors

JSON failures use one of the platform error envelopes and include the request correlation metadata when routing reaches the API middleware. See Errors for the exact shapes, authentication failures, retry guidance, and transport-level exceptions.

Examples

Request

curl --silent --show-error --globoff \
  --request POST \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --header 'Idempotency-Key: <idempotency-key>' \
  --data '{"resolution":"<string>"}' \
  'https://<your-host>/api/audit/compliance/findings/<id>/resolve'

Schematic response body

Illustrative shape generated from the extracted field types, not a recorded live response. Values are placeholders; null marks a field whose type could not be resolved.

Success status: 200

{
  "source": "<string>",
  "finding": null
}

POST/api/audit/compliance/findings/{id}/waive

admin access

Compliance finding waive.

Permissions

HTTP request

POST https://<your-host>/api/audit/compliance/findings/{id}/waive

Path parameters

Query parameters

This operation has no query parameters.

Request headers

Request body

JSON structure: ComplianceWaiveRequest.

Response

200 response body

Structure: Value.

Errors

JSON failures use one of the platform error envelopes and include the request correlation metadata when routing reaches the API middleware. See Errors for the exact shapes, authentication failures, retry guidance, and transport-level exceptions.

Examples

Request

curl --silent --show-error --globoff \
  --request POST \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --header 'Idempotency-Key: <idempotency-key>' \
  --data '{"reason":"<string>","expiry":"<string>"}' \
  'https://<your-host>/api/audit/compliance/findings/<id>/waive'

Schematic response body

Illustrative shape generated from the extracted field types, not a recorded live response. Values are placeholders; null marks a field whose type could not be resolved.

Success status: 200

{
  "source": "<string>",
  "waiver": null,
  "finding": null
}

GET/api/audit/compliance/frameworks

audit access

Compliance frameworks.

Permissions

HTTP request

GET https://<your-host>/api/audit/compliance/frameworks

Path parameters

This operation has no path parameters.

Query parameters

This operation has no query parameters.

Request headers

Request body

This operation does not accept a request body.

Response

200 response body

Structure: Value.

Errors

JSON failures use one of the platform error envelopes and include the request correlation metadata when routing reaches the API middleware. See Errors for the exact shapes, authentication failures, retry guidance, and transport-level exceptions.

Examples

Request

curl --silent --show-error --globoff \
  --request GET \
  --header 'Authorization: Bearer <token>' \
  'https://<your-host>/api/audit/compliance/frameworks'

Schematic response body

Illustrative shape generated from the extracted field types, not a recorded live response. Values are placeholders; null marks a field whose type could not be resolved.

Success status: 200

{
  "source": null,
  "frameworks": null
}

GET/api/audit/compliance/frameworks/{id}

audit access

Get compliance framework.

Permissions

HTTP request

GET https://<your-host>/api/audit/compliance/frameworks/{id}

Path parameters

Query parameters

This operation has no query parameters.

Request headers

Request body

This operation does not accept a request body.

Response

200 response body

Structure: Value.

Errors

JSON failures use one of the platform error envelopes and include the request correlation metadata when routing reaches the API middleware. See Errors for the exact shapes, authentication failures, retry guidance, and transport-level exceptions.

Examples

Request

curl --silent --show-error --globoff \
  --request GET \
  --header 'Authorization: Bearer <token>' \
  'https://<your-host>/api/audit/compliance/frameworks/<id>'

Schematic response body

Illustrative shape generated from the extracted field types, not a recorded live response. Values are placeholders; null marks a field whose type could not be resolved.

Success status: 200

{
  "source": "<string>",
  "framework": null
}

POST/api/audit/compliance/reports/generate

admin access

Compliance report generate.

Permissions

HTTP request

POST https://<your-host>/api/audit/compliance/reports/generate

Path parameters

This operation has no path parameters.

Query parameters

This operation has no query parameters.

Request headers

Request body

JSON structure: ComplianceReportGenerateRequest.

Response

200 response body

Structure: Value.

Errors

JSON failures use one of the platform error envelopes and include the request correlation metadata when routing reaches the API middleware. See Errors for the exact shapes, authentication failures, retry guidance, and transport-level exceptions.

Examples

Request

curl --silent --show-error --globoff \
  --request POST \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --header 'Idempotency-Key: <idempotency-key>' \
  --data '{"frameworkId":"<string>","site":"<string>"}' \
  'https://<your-host>/api/audit/compliance/reports/generate'

Schematic response body

Illustrative shape generated from the extracted field types, not a recorded live response. Values are placeholders; null marks a field whose type could not be resolved.

Success status: 200

{
  "source": "<string>",
  "report": null
}

GET/api/audit/compliance/reports/{id}

audit access

Get compliance report.

Permissions

HTTP request

GET https://<your-host>/api/audit/compliance/reports/{id}

Path parameters

Query parameters

This operation has no query parameters.

Request headers

Request body

This operation does not accept a request body.

Response

200 response body

Structure: Value.

Errors

JSON failures use one of the platform error envelopes and include the request correlation metadata when routing reaches the API middleware. See Errors for the exact shapes, authentication failures, retry guidance, and transport-level exceptions.

Examples

Request

curl --silent --show-error --globoff \
  --request GET \
  --header 'Authorization: Bearer <token>' \
  'https://<your-host>/api/audit/compliance/reports/<id>'

Schematic response body

Illustrative shape generated from the extracted field types, not a recorded live response. Values are placeholders; null marks a field whose type could not be resolved.

Success status: 200

{
  "source": "<string>",
  "report": null
}

GET/api/audit/compliance/summary

audit access

Compliance summary.

Permissions

HTTP request

GET https://<your-host>/api/audit/compliance/summary

Path parameters

This operation has no path parameters.

Query parameters

Request headers

Request body

This operation does not accept a request body.

Response

200 response body

Structure: Value.

Errors

JSON failures use one of the platform error envelopes and include the request correlation metadata when routing reaches the API middleware. See Errors for the exact shapes, authentication failures, retry guidance, and transport-level exceptions.

Examples

Request

curl --silent --show-error --globoff \
  --request GET \
  --header 'Authorization: Bearer <token>' \
  'https://<your-host>/api/audit/compliance/summary'

Schematic response body

Illustrative shape generated from the extracted field types, not a recorded live response. Values are placeholders; null marks a field whose type could not be resolved.

Success status: 200

{
  "source": null,
  "site": null,
  "frameworks": null
}

GET/api/audit/export

audit access

Export the audit trail for SIEM ingestion.

Audit-tier. Cursor-paginated by the monotonic row id (after_id → next_after_id), with an optional [since, until] time window. Detail is redacted; each entry carries its hash-chain entry_hash so the SIEM can correlate with the verify endpoint. In dry-run / no-DB mode there is no durable chain, so this returns an empty export. The cursor yields no duplicates; for guaranteed completeness (no gaps under concurrency) periodically re-export a CLOSED time window — see audit::export_audit. Use the cursor with a stable window, or id-only.

Permissions

HTTP request

GET https://<your-host>/api/audit/export

Path parameters

This operation has no path parameters.

Query parameters

Request headers

Request body

This operation does not accept a request body.

Response

200 response body

Structure: Value.

Errors

JSON failures use one of the platform error envelopes and include the request correlation metadata when routing reaches the API middleware. See Errors for the exact shapes, authentication failures, retry guidance, and transport-level exceptions.

Examples

Request

curl --silent --show-error --globoff \
  --request GET \
  --header 'Authorization: Bearer <token>' \
  'https://<your-host>/api/audit/export'

Schematic response body

Illustrative shape generated from the extracted field types, not a recorded live response. Values are placeholders; null marks a field whose type could not be resolved.

Success status: 200

{
  "durable": false,
  "entries": null,
  "count": null,
  "next_after_id": null,
  "note": "<string>"
}

POST/api/audit/log/verify

audit access

Enqueue or join the durable singleton verifier.

The request never reads audit rows; a background worker advances fixed-size checkpoints. Active jobs return 202 and can be polled at the status route. In no-DB mode the historical verified/no-op response remains unchanged.

Permissions

HTTP request

POST https://<your-host>/api/audit/log/verify

Path parameters

This operation has no path parameters.

Query parameters

This operation has no query parameters.

Request headers

Request body

This operation does not accept a request body.

Response

For 200, the known response body type is Value. Its field schema is unavailable, so no JSON shape is inferred.

For 202, the known response body type is Value. Its field schema is unavailable, so no JSON shape is inferred.

Errors

JSON failures use one of the platform error envelopes and include the request correlation metadata when routing reaches the API middleware. See Errors for the exact shapes, authentication failures, retry guidance, and transport-level exceptions.

Examples

Request

curl --silent --show-error --globoff \
  --request POST \
  --header 'Authorization: Bearer <token>' \
  --header 'Idempotency-Key: <idempotency-key>' \
  'https://<your-host>/api/audit/log/verify'

GET/api/audit/log/verify/{job_id}

audit access

Safe progress/terminal state only.

Chain hashes, checkpoint predecessors, and requester identity are never returned.

Permissions

HTTP request

GET https://<your-host>/api/audit/log/verify/{job_id}

Path parameters

Query parameters

This operation has no query parameters.

Request headers

Request body

This operation does not accept a request body.

Response

For 200, the known response body type is Value. Its field schema is unavailable, so no JSON shape is inferred.

Errors

JSON failures use one of the platform error envelopes and include the request correlation metadata when routing reaches the API middleware. See Errors for the exact shapes, authentication failures, retry guidance, and transport-level exceptions.

Examples

Request

curl --silent --show-error --globoff \
  --request GET \
  --header 'Authorization: Bearer <token>' \
  'https://<your-host>/api/audit/log/verify/<job_id>'

GET/api/audit/retention

audit access

?retention_days=N — audit-log retention/growth report (#62).

The append-only, hash-chained trail only grows; this surfaces how many entries have aged past a retention window (default 365d, bounded) and whether archival/partitioning is due — the read input to that SEPARATE, hash-chain- preserving step. Audit-tier; empty + durable:false with no DB.

Permissions

HTTP request

GET https://<your-host>/api/audit/retention

Path parameters

This operation has no path parameters.

Query parameters

Request headers

Request body

This operation does not accept a request body.

Response

For 200, the known response body type is Value. Its field schema is unavailable, so no JSON shape is inferred.

Errors

JSON failures use one of the platform error envelopes and include the request correlation metadata when routing reaches the API middleware. See Errors for the exact shapes, authentication failures, retry guidance, and transport-level exceptions.

Examples

Request

curl --silent --show-error --globoff \
  --request GET \
  --header 'Authorization: Bearer <token>' \
  'https://<your-host>/api/audit/retention'