API reference
Read-only audit queries for chains, changes, operations, objects and executions.
The Audit module exposes read-only HTTP queries over its JDBC audit store, including when the UI is disabled. The deployed {http_context}{context_path}/api/openapi.yaml describes that deployment's exact contract. See authentication and roles before exposing these routes.
Endpoints
Section titled “Endpoints”Paths below are relative to the API base, /audit/api with default configuration.
| Method | Path | Description |
|---|---|---|
| GET | /chains |
List chain headers filtered by source, initiator, status, server and time. |
| GET | /chains/{chainId} |
Read a chain with its packages and changes. |
| GET | /changes |
Search field-level writes with their chain and package context. |
| GET | /operations |
Search connector calls grouped by operation and target object. |
| GET | /objects |
Search affected objects, with identity counts and a bounded identity sample. |
| GET | /executions |
Search chain executions that have matching changes. |
| GET | /openapi.yaml |
Read the deployed OpenAPI specification. |
Filters
Section titled “Filters”Change-based queries support object, identity, initiator, source, server, destination, chain, operation, package, field, result, pipe, valve and time filters. Use the deployed specification for the parameters supported by each endpoint. Criteria combine with AND on a matching change. An object's identity can differ from its target object; see Data model.
Single-field text parameters include objectName, objectId, objectType, identityName, identityId, initiatorName, initiatorId, sourceName, destinationType and destination. A companion such as identityIdMatch selects exact or pattern. Exact mode treats * literally; pattern mode matches the whole field and uses * as its only wildcard. Display-name filters default to pattern; existing ID/type/source/destination filters default to exact. Case and accent behavior follows database collation.
q is a contains search over the fields of the selected projection; changing projection can change which rows match. Legacy objectQ, identityQ and initiatorQ retain their name-or-ID contains behavior. For an exact drill-down, use the returned operations_filter or identity_filter rather than carrying the previous free-text search.
Pagination and sorting
Section titled “Pagination and sorting”/operations, /objects and /executions are paged, with default limit 100 and maximum 500. Follow the opaque next_cursor with the same sort. Objects default to sort=name and support name, -name, time, -time; executions and time-ordered change queries support time and -time, defaulting to newest first.
/changes retains an unpaged legacy mode for simple legacy filters. Additional query controls, such as limit, cursor or sort, select paged behavior; specify limit explicitly for bounded consumption. /chains retains its unpaged list. The specification defines response fields and exact paging triggers; do not infer identical list behavior across endpoints.
Query service
Section titled “Query service”The event-bus address fortifiedid.audit.query supports operations.search, objects.search, executions.search with snake_case filter keys. This internal interface does not apply HTTP authentication or role checks. Use the HTTP endpoints for access controlled external queries.