API reference/Ops: audit

Count audit events

GET /ops/audit/stats

Counts events in a window of at most 90 days (default the last 7), grouped by action, outcome, actor kind, resource type or UTC day. Filters are the audit list's.

Authorization

bearer

Authorizationheader · stringrequired

Session token from POST /v1/auth/login with "transport": "bearer". Browsers use the session cookie that login sets instead.

Query

group_bystringrequired

one of: action, outcome, actor_kind, resource_type, day

actor_kindstring

user, service, system or anonymous

maxLength: 32

actor_idstring

maxLength: 200

actionstring

maxLength: 200

action_prefixstring

maxLength: 200

resource_typestring

maxLength: 100

org_idstring

maxLength: 200

outcomestring

success, failure or denied

maxLength: 16

fromstring

Start, inclusive (RFC 3339); default 7 days before to

format: date-time

tostring

End, exclusive (RFC 3339); default now. At most 90 days after from

format: date-time

Responses

errors: application/problem+json

200

401

Unauthorized

403

Forbidden

422

Unprocessable Entity

500

Internal Server Error

Match errors on the problem's code, which stays the same, not on its message.

req, err := http.NewRequestWithContext(ctx, http.MethodGet, apiURL + "/ops/audit/stats", nil) if err != nil { return err } req.Header.Set("Authorization", "Bearer "+token) res, err := http.DefaultClient.Do(req) if err != nil { return err } defer res.Body.Close()

{ "from": "2026-09-15T12:00:00Z", "group_by": "action", "groups": [ { "count": 0, "key": "auth.login.failed" } ], "other": 0, "to": "2026-09-15T12:00:00Z", "total": 0 }

{ "code": "string", "status": 422, "title": "Unprocessable Entity", "detail": "string", "errors": [ { "message": "expected length >= 1", "location": "body.name" } ], "request_id": "req_9f86d081884c7d65", "type": "string" }