Audit API

Query the audit log for compliance and provenance.

List Audit Entries

GET /api/audit?limit=100&action=recall

Query Parameters

Parameter	Type	Default	Description
`limit`	number	100	Number of entries (max 500)
`action`	string	-	Filter by action type
`actor_type`	string	-	Filter by `user` or `agent`
`result`	string	-	Filter by `allowed` or `denied`

Response

{
  "entries": [
    {
      "id": "uuid",
      "actor_type": "agent",
      "actor_id": "uuid",
      "on_behalf_of": "uuid",
      "action": "recall",
      "target_id": "uuid",
      "scope_key": "engineering",
      "result": "allowed",
      "tokens_in": 45,
      "tokens_out": 320,
      "created_at": "2025-01-15T10:30:00Z"
    }
  ]
}

Action Types

Action	Description
`recall`	Memory search query
`remember`	Memory write
`deny`	Access denied (policy violation)
`redact`	Memory redaction
`policy_change`	Policy matrix update

Audit Properties

Property	Description
`actor_type`	`user` or `agent`
`actor_id`	ID of the acting user or agent
`on_behalf_of`	User the agent is acting for
`action`	What was attempted
`target_id`	Memory ID involved
`scope_key`	Scope accessed
`result`	`allowed` or `denied`
`tokens_in`	Input tokens (for AI queries)
`tokens_out`	Output tokens (for AI queries)

Audit entries are append-only and cannot be modified or deleted. This ensures compliance and provenance tracking.