Ciresk Docs
API reference

Audit

The audit trail of the organization's sessions, and how many months it is kept.

GET/v1/dev/audit/events

List audit events

Dev's audit trail, newest first - every recorded action of the organisation's sessions, filtered by actor, session, action and time.

Reads dev's store of the installation's audit log through core/audit's search. A row is the record as a reader sees it: identifiers clear, personal fields resolved to the subject (the pseudonym once erased), payloads clear as dev wrote them or only redacted. actor matches the subject that acted; session_id matches the session or the root session the action ran under. Every read is itself a dev.audit.searched record naming the reader, the filters as commitments and the number of rows returned; a read whose record cannot be written answers 503.

Permission: dev:audit.read

Parameters

NameTypeRequiredDescription
cursorquerystringOptional
limitqueryintegerOptional
actorquerystringOptionalthe subject that acted, user:<id>, agent:<id>, key:<id> or service:<name>
session_idquerystringOptional
actionquerystringOptionalone action, such as dev.session.create
sincequerystring (date-time)Optionalrecords at or after this moment
untilquerystring (date-time)Optionalrecords before this moment

Response200 OK

dataarray of objectsRequired
data[].accessedarray of objects
data[].accountablestring or null
the person answerable
data[].actionstringRequired
data[].action_idstringRequired
act_<uuidv7>, shared by the phases of one action
data[].agentstring or null
the agent identity and the harness it runs in
data[].approval_idstring or null
data[].approvalsarray of objects
data[].atstring (date-time)Required
data[].attemptedarray of strings
the supplied fields that did not resolve, by name; never their values
data[].cellstringRequired
data[].connectionobject or null
data[].correlation_idstring or null
data[].credentialobject or null
data[].decisionobject or null
data[].delegationarray of strings
data[].depthintegerRequired
data[].egressarray of strings
data[].inputobjectRequired
data[].input.kindstringRequired
One of none, clear, redacted, attached
data[].input.sizeinteger
the attachment's size in bytes, for kind attached
data[].input.valuestring
the clear text
data[].ownerstringRequired
data[].phasestringRequired
One of intent, start, end
data[].policy_versionstring or null
data[].principalstringRequired
the subject that acted
data[].productstringRequired
dev, or core for the port's own records
data[].protectedbooleanRequired
data[].requestobject or null
data[].resultobjectRequired
data[].result.kindstringRequired
One of none, clear, redacted, attached
data[].result.sizeinteger
the attachment's size in bytes, for kind attached
data[].result.valuestring
the clear text
data[].root_sessionstring or null
data[].sandboxstring or null
data[].seqintegerRequired
the record's place in the organisation's chain of dev's store
data[].sessionstring or null
data[].statusstring or null
data[].surfacestring or null
data[].targetsarray of objects
data[].targets[].idstringRequired
data[].targets[].kindstringRequired
data[].witness_deferredbooleanRequired
data[].workerstring or null
has_morebooleanRequired
next_cursorstring or null

Errors

curl "$CIRESK_API/v1/dev/audit/events" \
  -H "Authorization: Bearer $CIRESK_KEY"
GET/v1/dev/audit/retention

Get the audit retention

How many months dev's audit trail is kept, 12 for an organisation that set none.

Permission: dev:audit.read

Response200 OK

monthsintegerRequired
12 (the default), 84 or 120: the 1-, 7- and 10-year tiers; any other value is 422

Errors

curl "$CIRESK_API/v1/dev/audit/retention" \
  -H "Authorization: Bearer $CIRESK_KEY"
PUT/v1/dev/audit/retention

Set the audit retention

Set how many months dev's audit trail is kept - 12 (the default), 84 or 120.

A person with dev:policy.write. The change is the port's own core.audit.retention record in dev's store. Lowering applies to the daily purge and to archive objects written from then on; an object already in the object lock archive keeps its date. Purge never deletes a record the archive does not hold.

Permission: dev:policy.write

Request body

monthsintegerRequired
12 (the default), 84 or 120: the 1-, 7- and 10-year tiers; any other value is 422

Response200 OK

monthsintegerRequired
12 (the default), 84 or 120: the 1-, 7- and 10-year tiers; any other value is 422

Errors

curl -X PUT "$CIRESK_API/v1/dev/audit/retention" \
  -H "Authorization: Bearer $CIRESK_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "months": 12
  }'