Audit Events

Policy audit events capture access decisions and policy changes across tools and MCP servers. These events are retained by default and are designed for governance and compliance.

Endpoint

GET /v1/audit/policy

Query Parameters

• limit (default 50)
• cursor (pagination cursor)

Response

{
  "events": [
    {
      "id": "evt_...",
      "actorType": "user",
      "actorId": "usr_...",
      "actorName": "alice@company.com",
      "action": "tool.access",
      "targetType": "tool",
      "targetId": "tool_...",
      "targetName": "Send Email",
      "outcome": "allowed",
      "reason": "authorized",
      "metadata": "{\"path\":\"/t/send-email\"}",
      "createdAt": "2026-02-04T06:00:00Z"
    }
  ],
  "nextCursor": "..."
}

Common Actions

• tool.policy.created
• tool.public.updated
• tool.token.updated
• tool.access
• mcp.policy.created
• mcp.public.updated
• mcp.token.updated
• mcp_tool.access
• mcp_server.access

Actor Types

• user, token, public, anonymous, system

Related Docs

• Data Retention