# List audit events

`GET /apis/cra.diagrid.io/v1beta1/auditevents`

List an organization's audit events (the Activity feed). Recent events are read from Loki and older events (beyond Loki retention) from the signed S3 archives, merged into a single ordered stream. Every event carries an integrity status so tampering of archived logs is surfaced.

## Request

### Query parameters

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `startTime` | string (date-time) | No | Inclusive lower bound of the query window (RFC3339). |
| `endTime` | string (date-time) | No | Exclusive upper bound of the query window (RFC3339). |
| `serviceName` | string[] | No | Filter to events emitted by any of these services. |
| `entryType` | string[] | No | Filter to events of any of these types. |
| `sourceType` | string[] | No | Filter to events whose source type matches any of these. |
| `method` | string[] | No | Filter to events whose payload method matches any of these (the HTTP method of a request event). Matched case-insensitively; events without a method are excluded. |
| `success` | boolean | No | Filter on the payload's success flag: true keeps only successful events, false only failed ones. Omit for both; events without the flag are excluded when it is set. |
| `correlationId` | string | No | — |
| `search` | string | No | Free-text substring match over the event payload. |
| `sortField` | string | No | Field to order by (default timestamp). |
| `sortOrder` | string | No | One of: `SORT_ORDER_ASC`, `SORT_ORDER_DESC`. |
| `page` | string | No | Opaque cursor from a prior response's nextPage. |
| `limit` | integer (int64) | No | — |

## Responses

### 200 — The page of audit events.

`application/json`

A page of audit events plus per-archive integrity summaries.

- `events` (object[])
  - `id` (string) — A stable identifier for the event.
  - `correlationId` (string)
  - `serviceName` (string)
  - `timestamp` (string (date-time))
  - `organizationId` (string)
  - `source` (object)
    - `type` (string)
    - `id` (string)
  - `entryType` (string)
  - `entry` (object) — The structured event payload.
  - `integrity` (object) — The tamper-check status for a single audit event.
    - `status` (string) — The integrity verdict. VERIFIED means the checksum (and, for archived events, the HMAC signature) matched. CHECKSUM_MISMATCH / SIGNATURE_MISMATCH indicate tampering. UNVERIFIABLE means integrity could not be established. One of: `INTEGRITY_STATUS_UNSPECIFIED`, `INTEGRITY_STATUS_VERIFIED`, `INTEGRITY_STATUS_CHECKSUM_MISMATCH`, `INTEGRITY_STATUS_SIGNATURE_MISMATCH`, `INTEGRITY_STATUS_UNVERIFIABLE`.
    - `source` (string) — The backing store the event was read from. One of: `DATA_SOURCE_UNSPECIFIED`, `DATA_SOURCE_LOKI`, `DATA_SOURCE_ARCHIVE`.
    - `checksum` (string) — The SHA256 checksum (hex) associated with the event or its archive.
    - `keyId` (string) — The HMAC key id used to sign the archive, when signed.
    - `archiveKey` (string) — The S3 object key backing this event when read from an archive.
- `nextPage` (string) — Opaque cursor for the next page; empty when exhausted.
- `archives` (object[])
  - `archiveKey` (string)
  - `status` (string) — One of: `INTEGRITY_STATUS_UNSPECIFIED`, `INTEGRITY_STATUS_VERIFIED`, `INTEGRITY_STATUS_CHECKSUM_MISMATCH`, `INTEGRITY_STATUS_SIGNATURE_MISMATCH`, `INTEGRITY_STATUS_UNVERIFIABLE`.
  - `windowStart` (string (date-time))
  - `windowEnd` (string (date-time))
  - `keyId` (string)

### default — Unexpected error.

`application/json`

In the case of an error, a standard format error response body will be returned and the HTTP status code will be set to an error status. The response contains an object with a single error object.

- `code` (string) — Required. This is the same as the HTTP status of the response.
- `message` (string) — Required. A short description of the error.
- `status` (object) — Required. A status code that indicates the error type.
- `details` (object) — Additional details about the errors.
  - `@type` (string) — The type of error.
  - `reason` (string) — A reason for the error.
  - `domain` (string) — The domain in which the error occurred.
  - `metadata` (object) — Additional metadata about the error.