API Reference
Audit
Keyset-paginated export of read events (tool, actor, params summary, result count, latency) for the workspace.
Authorization
bearerAuth AuthorizationBearer <token>
HTTP bearer credential in the Authorization header. Two planes share the
scheme, distinguished by prefix:
grp_sk_…— a management key: full control of the account (workspaces, files, token minting, audit export) plus the read tools.grp_at_…— a scoped read-only token: minted per workspace, it may call only the read tools (ls/find/cat/grep) and is rejected by every management route.
In: header
Path Parameters
ws*string
Workspace name. Workspace name must be 1-64 lowercase letters, digits, hyphens, or underscores, starting and ending with a letter or digit.
Match
^[a-z0-9](?:[a-z0-9_-]{0,62}[a-z0-9])?$Query Parameters
after?string
ISO 8601 timestamp; return only events strictly after it.
Format
date-timecursor?integer
Pagination cursor; pass the previous response’s nextCursor.
limit?integer
Max events to return.
Range
1 <= value <= 1000Default
100Response Body
application/json
application/json
application/json
application/json
application/json
curl -X GET "https://example.com/v1/workspaces/string/audit"{ "events": [ { "id": 0, "actorType": "string", "actorId": "string", "tool": "string", "params": null, "resultCount": 0, "latencyMs": 0, "ts": "string" } ], "nextCursor": "string"}