Audit API
The audit trail records every session event — prompts, policy checks, tool calls with their data class, results. Admins browse and filter it in-app; external tools (a SIEM, a script, an auditor) query it over HTTP.
Mint a token
Section titled “Mint a token”Audit → External access (API) → Create token. Choose a lifetime (1 hour / 24 hours / 7 days) and a note. The token is displayed once; only its hash is stored. Tokens can be revoked at any time and expire on their own.
curl -H "Authorization: Bearer akt_..." \ "https://<your-api>/audit/export?limit=200&type=tool_use"GET /audit/export accepts the same filters as the in-app view:
| Param | Meaning |
|---|---|
userId |
only events from this person’s sessions |
type |
event type (user_prompt, policy_check, tool_use, …) |
dataClass |
external / internal / commercial / personal |
limit |
1–2000, default 300 |
The token may also be passed as ?token=. Responses are JSON:
{ events: [...], generatedAt, tokenNote }.
Reading the log is logged
Section titled “Reading the log is logged”Every external call is itself an audited action: the token’s use counter increments and a row lands in the Access log (time, token, source IP, query, rows returned) — shown on the same page.
Errors: 401 unknown/revoked/expired token, 400 bad filters.