Read the rule/category change audit log (agent plane, read-only)

GET

/v1/rules/audit

• Production
• Local

The append-only change/undo audit log spanning rules AND categories (D11), optionally narrowed to one entity. Read-only and agent-visible (the audit log is the shared safety net). Each row carries the before/after snapshot enabling an undo via POST /v1/rules/audit/{udo_id}/undo.

Authorizations

• AgentKey
  mailbox:read

Parameters

Query Parameters

entity_kind

string

Allowed values: rule category

Narrow to one entity kind.

entity_id

string

Narrow to one entity (rule_… or cat_…).

Responses

200

Ok

object

items

required

Array<object>

One append-only rule/category change & undo audit row (udo_…). before_json / after_json carry the snapshot enabling an undo. undo = a later ‘restore’ entry; this row’s undone flips true when it has been undone.

object

id

required

Opaque audit id (udo_…).

string

entity_kind

required

string

Allowed values: rule category

entity_id

required

Rule_… (lineage head) or cat_….

string

action

required

string

Allowed values: create supersede retire rename redescribe merge restore

actor_kind

required

string

Allowed values: agent human system

actor_id

string

before_json

JSON snapshot of the prior version.

string

after_json

JSON snapshot of the new version.

string

undone

required

boolean

created_at

required

string format: date-time

total

required

integer

next_cursor

string

401

Missing or invalid credential.

The canonical error envelope. error is a stable machine code.

object

error

required

Stable error code (e.g. unauthorized, forbidden, not_found, invalid, quota_exceeded, rate_limited).

string

Example

forbidden

message

Human-readable detail (never leaks internals).

string

Example

missing required scope

403

Authenticated but lacking the required scope, or out of quota.

The canonical error envelope. error is a stable machine code.

object

error

required

Stable error code (e.g. unauthorized, forbidden, not_found, invalid, quota_exceeded, rate_limited).

string

Example

forbidden

message

Human-readable detail (never leaks internals).

string

Example

missing required scope