Audit

The tenant's trail of who tried to change what: a write is recorded once its response is known, so a refused attempt is kept as faithfully as a change. Two things have to hold — the request carried a valid token, and the caller's access resolved to exactly one tenant. Access spanning several tenants must be narrowed with X-Tenant-Id, or nothing is written at all.

actor is the CRN the caller's token was issued for; reading the trail takes read on the tenant's audit scope, granted through IAM. Every module's writes land here as AUDIT_EVENT_CREATE — stored, never delivered over the websocket.

GET	List audit events/api/v1/audit

List audit events

Reads the tenant's audit trail newest first, paged with page and pageSize (1000 entries at most); from and to bound timestamp inclusively. Only state-changing requests are recorded, so no GET ever appears.

GET/api/v1/audit?page=1&pageSize=100

Query Parameters

Name	Description
fromintegeroptional	Filter events from this Unix timestamp (inclusive)
tointegeroptional	Filter events up to this Unix timestamp (inclusive)
pageintegeroptional	Page number, starting at 1 Default: 1 min 1
pageSizeintegeroptional	Number of results per page (max 1000) Default: 100 min 1 · max 1000

Response

Name	Description
resourceIdentifierstring	Unique Coldwave resource name (CRN) that identifies a resource
timestampinteger	Unix timestamp in milliseconds since epoch.
tenantIdstringoptional	Tenant in which the event occurred, or null for system-level events
actorstring	Unique Coldwave resource name (CRN) that identifies a resource
methodstring	HTTP method of the request
pathstring	API path that was accessed
statusCodeinteger	HTTP status code returned by the server
outcomeenum	Outcome of the request — success, denied, or error Possible values: success, denied, error

Errors

Status	Description	Body
403	You do not have permission to perform this action
400	The request did not match the schema for this endpoint. The details field carries the specific failures.	error: Validation Error
401	No valid access token was presented, or the DPoP proof accompanying it was missing, expired or bound to a different key.	error: string
500	The request failed for a reason that is not the caller's to fix. Safe to retry.	error: string, message: string, statusCode: 50

---

Events

Published on the tenant's event stream and delivered over the websocket to every subscriber holding read on the resource the message names. resourceIdentifier is the resource the action changed; the payload is the shape below.

Event	Description
AUDIT_EVENT_CREATE	An authenticated POST, PUT, PATCH or DELETE finished and was written to the trail with its actor, path, status code and outcome. Dispatched internally: it is stored, but never delivered to a websocket subscription — read it with GET /audit.

Audit entry recorded

An authenticated POST, PUT, PATCH or DELETE finished and was written to the trail with its actor, path, status code and outcome. Dispatched internally: it is stored, but never delivered to a websocket subscription — read it with GET /audit.

EVENTAUDIT_EVENT_CREATE

Payload

Name	Description
resourceIdentifierstring	Unique Coldwave resource name (CRN) that identifies a resource
timestampinteger	Unix timestamp in milliseconds since epoch.
tenantIdstringoptional	Tenant in which the event occurred, or null for system-level events
actorstring	Unique Coldwave resource name (CRN) that identifies a resource
methodstring	HTTP method of the request
pathstring	API path that was accessed
statusCodeinteger	HTTP status code returned by the server
outcomeenum	Outcome of the request — success, denied, or error Possible values: success, denied, error