Committed audit feed for this owner’s org — the customer SIEM pull. Keyset-paginated: poll with ?after=<next_after> until a short page lands. Events queued in the outbox join the feed on relay. Owner-only. Not MCP.

GET/v1/audit/events

Authorization

AuthorizationBearer token (JWT) · headerrequired

Hydra JWT. Identity is the bound agent or a Keto member human. The host is not identity.

Query parameters

afterinteger<int64>

Resume cursor — return committed events with id > after.

default: 0

limitinteger

Page size.

min 1 · max 1000 · default: 200

Responses

200One page of committed org audit events

eventsAuditFeedEvent[]required

Show properties

Array of AuditFeedEvent

idinteger<int64>required

Committed row id — monotonically increasing per append; the feed cursor.

timestring<date-time>required

org_idstringrequired

agent_idstringrequired

item_idstringrequired

actionstringrequired

decisionstringrequired

Allowed:allowdenyneed_approval

reasonstring

approval_idstring

next_afterinteger<int64>required

Cursor for the next page — pass as ?after=. Equals the last event id, or the requested cursor when the page is empty.

400bad after/limit

401missing or invalid Bearer

403not the org owner

Request

curl -X GET "https://veil.nyc/v1/audit/events" \
  -H "Authorization: Bearer YOUR_TOKEN"

const response = await fetch("https://veil.nyc/v1/audit/events", {
  method: "GET",
  headers: {
    "Authorization": "Bearer YOUR_TOKEN"
  }
});

import requests

response = requests.get(
    "https://veil.nyc/v1/audit/events",
    headers={
        "Authorization": "Bearer YOUR_TOKEN"
    },
)

Response

{
  "events": [
    {
      "id": 0,
      "time": "2024-01-01T00:00:00Z",
      "org_id": "string",
      "agent_id": "string",
      "item_id": "string",
      "action": "string",
      "decision": "allow",
      "reason": "string",
      "approval_id": "string"
    }
  ],
  "next_after": 0
}