# API reference

Documentation owner: module `audit`; documentation version: `next`.
Source: `content/modules/audit/next/api-reference.md` at commit `205d3802b68fb9e948e43600f3f9080789c5ae0d`.

The Audit module exposes read-only HTTP queries over its JDBC audit store, including when the UI is disabled. The deployed `{http_context}{context_path}/api/openapi.yaml` describes that deployment's exact contract. See [authentication and roles](/modules/audit/next/#authentication) before exposing these routes.

## Endpoints

Paths below are relative to the API base, `/audit/api` with default configuration.

| Method | Path | Description |
| --- | --- | --- |
| GET | `/chains` | List chain headers filtered by source, initiator, status, server and time. |
| GET | `/chains/{chainId}` | Read a chain with its packages and changes. |
| GET | `/changes` | Search field-level writes with their chain and package context. |
| GET | `/operations` | Search connector calls grouped by operation and target object. |
| GET | `/objects` | Search affected objects, with identity counts and a bounded identity sample. |
| GET | `/executions` | Search chain executions that have matching changes. |
| GET | `/openapi.yaml` | Read the deployed OpenAPI specification. |

## Filters

Change-based queries support object, identity, initiator, source, server, destination, chain, operation, package, field, result, pipe, valve and time filters. Use the deployed specification for the parameters supported by each endpoint. Criteria combine with AND on a matching change. An object's identity can differ from its target object; see [Data model](/modules/audit/next/data-model/).

Single-field text parameters include `objectName`, `objectId`, `objectType`, `identityName`, `identityId`, `initiatorName`, `initiatorId`, `sourceName`, `destinationType` and `destination`. A companion such as `identityIdMatch` selects `exact` or `pattern`. Exact mode treats `*` literally; pattern mode matches the whole field and uses `*` as its only wildcard. Display-name filters default to pattern; existing ID/type/source/destination filters default to exact. Case and accent behavior follows database collation.

`q` is a contains search over the fields of the selected projection; changing projection can change which rows match. Legacy `objectQ`, `identityQ` and `initiatorQ` retain their name-or-ID contains behavior. For an exact drill-down, use the returned `operations_filter` or `identity_filter` rather than carrying the previous free-text search.

## Pagination and sorting

`/operations`, `/objects` and `/executions` are paged, with default `limit` 100 and maximum 500. Follow the opaque `next_cursor` with the same sort. Objects default to `sort=name` and support `name`, `-name`, `time`, `-time`; executions and time-ordered change queries support `time` and `-time`, defaulting to newest first.

`/changes` retains an unpaged legacy mode for simple legacy filters. Additional query controls, such as `limit`, `cursor` or `sort`, select paged behavior; specify `limit` explicitly for bounded consumption. `/chains` retains its unpaged list. The specification defines response fields and exact paging triggers; do not infer identical list behavior across endpoints.

## Query service

The event-bus address `fortifiedid.audit.query` supports `operations.search`, `objects.search`, `executions.search` with snake_case filter keys. This internal interface does not apply HTTP authentication or role checks. Use the HTTP endpoints for access controlled external queries.