Querying Audit Logs

Filter and paginate audit records.

GET /audit-logs

Returns full audit log rows with cursor pagination on event_timestamp. Parameters: limit (default 20, max 100), cursor.

GET /events

Returns a subset of fields: id, agent_name, user_name, action, resource, policy_name, result, severity, event_timestamp, metadata. Parameters: limit, cursor, agent, result.

bash

curl "https://app.korclaw.com/api/v1/events?limit=50&agent=ops-bot&result=blocked" \
  -H "Authorization: Bearer kc_live_your_api_key_here"

Client-side ingestion

POST /audit accepts blocked or approval_required events with policy_verified: false in metadata. Sending result: allowed is rejected with policy_evaluation_required (400).