Get Access Control Rule Audit

GET /access-control-rules/audit

Read the audit of access-control rule changes, newest first. Every rule upsert and delete records who made it, through which client, why, and under which request, plus the rule as it was written. Entries hold identifiers and the rule's shape only, never token text. Entries older than the configured retention (auth.audit.retentionDays, default 365) are pruned at server start.

Only operator callers (operational tokens) and system zero may read the audit; any other caller receives 403. The default page size is 50 and the maximum is 200.

Required scope

Any authenticated access token

Query parameters

ruleIdstring

Only entries about this access-control rule.

actorPrincipalstring

Only entries made by this principal.

resourcestring

Exact resource of the audited rule.

operationstring

Exact operation of the audited rule.

sincestring

Only entries recorded at or after this time (RFC 3339).

format: "date-time"

untilstring

Only entries recorded before this time (RFC 3339).

format: "date-time"

nextTokenstring

Opaque token for the next page of results. Pass the continuation token returned by the previous response, unchanged. Omit it to start from the first page.

maxResultsinteger

Maximum number of entries to return in one page. Defaults to 50. Values from 1 through 200 are accepted.

minimum: 1

maximum: 200

Default: 50

Returns

200

Audit entries retrieved successfully

Fields

resultsarray<AccessControlRuleAuditEntry>Required: Audit entries, newest first.
paginationContextPaginationContext

Errors

400 BAD_REQUEST

Invalid filter, page size, time or pagination token

Check the request fields and any validation details, then correct the payload.

401 UNAUTHORIZED

Authentication is required

Obtain a valid access token, then retry.

403 FORBIDDEN

The caller is not an operator

Check the linked account and its permissions for the device or resource.

500 INTERNAL

Internal server error

Retry with backoff only when the operation is safe to repeat. Include the error code when reporting persistent failures.