Audit Logs
Immutable records of every policy evaluation and execution.
KorClaw records an audit event for every policy evaluation, runtime execution, and MCP operation. Audit logs capture agent, action, resource, policy, result, severity, and timestamp.
Querying
- GET /audit-logs — full audit rows with cursor pagination
- GET /events — subset fields with agent and result filters
Client-side audit ingestion
POST /audit (alias /audit-events) accepts blocked or approval_required events only. Sending result: allowed returns policy_evaluation_required (400) — use /policy/evaluate for allowed outcomes.