Query all AI audit events

POST

/ai-audits

Query and filter AI audit events — per-action telemetry reported by
coding-AI agents (Claude Code, Gemini CLI, Cursor, etc.) running on
managed devices: sensitive file reads, credential-related commands,
MCP tool calls, agent-config tampering, and deny-rule bypass attempts.

Relations:

employee (Person): The employee operating the coding-AI agent

Request

Authorization

Body Params application/jsonRequired

Examples

Responses

🟢200OK

application/json

Successful operation

Bodyapplication/json

🟠400Bad Request

🟠401Unauthorized

🟠403Forbidden

Request Example

Shell

JavaScript

Java

Swift

curl --location '/ai-audits' \
--header 'Content-Type: application/json' \
--data '{
    "distinct_count": "string",
    "distinct_on": "host_name",
    "include_total_count": true,
    "limit": 10,
    "offset": 0,
    "query": "name='\''WINPC-4291'\'' AND status IN ('\''active'\'', '\''pending'\'')",
    "sort": "name desc, id"
}'

Response Example

{
    "distinct_values": [
        {
            "count": 0,
            "value": null
        }
    ],
    "pagination": {
        "count": 0,
        "total_count": 1000
    },
    "items": [
        {
            "agent_version": "1.2.3",
            "ai_type": "claude_code",
            "audit_type": "sensitive_file_read",
            "bytes_returned": 1024,
            "bytes_sent": 4096,
            "chained_subcommand_count": 73,
            "command": "security find-generic-password",
            "denial_reason": "Editing the agent's own settings.json is self-modification of agent configuration.",
            "description": "List files in the backup directory",
            "device_serial_number": "C02XK1ZGJGH5",
            "duration_ms": 350,
            "employee_email": "jane.doe@example.com",
            "employee_name": "Jane Doe",
            "error_message": "permission denied",
            "file_path": "/Users/jdoe/.ssh/id_ed25519",
            "hook_version": "v1.4.0",
            "hostname": "janes-macbook-pro",
            "id": "8CA67511-744C-4D74-B26E-7281CF88712F",
            "matched_rule": "~/.ssh",
            "mcp_auth_authorize_host": "mcp.linear.app",
            "mcp_auth_connector_id": "string",
            "mcp_auth_granted_scopes": [
                "string"
            ],
            "mcp_auth_last_auth_at": "2019-08-24T14:15:22.123Z",
            "mcp_auth_oauth_client_id": "string",
            "mcp_auth_state": "authorized",
            "mcp_auth_subject_email": "string",
            "mcp_destination": "unspecified",
            "mcp_destination_path": "/backups/id_ed25519.txt",
            "mcp_server": "dropbox",
            "mcp_server_resolved": true,
            "mcp_server_transport": "stdio",
            "mcp_server_url": "https://mcp.dropbox.com/sse",
            "mcp_tool": "create_file",
            "mdm_device_id": "412",
            "mdm_type": "unspecified",
            "outcome": "success",
            "permission_mode": "default",
            "prompt": "Back up my SSH key to Dropbox",
            "session_id": "0c75df52-2c41-4a8f-bf16-5c1f4e2c9a31",
            "timestamp": "2026-05-19T15:32:00Z",
            "tool": "Bash:cat",
            "tool_use_id": "toolu_01abc123xyz",
            "username": "jdoe"
        }
    ]
}

Modified at 2026-07-24 15:31:52

Receive a webhook event

Get an AI audit event by id