--- updatedAt: 2026-08-31T03:40:46.000Z agentTools: projectIndex: https://readme.cipherowl.ai/llms.txt --- # List a Case's audit events Returns the Case's immutable audit trail: who did what, when, with event-specific detail in each event's payload (workflow events carry the Case state before and after the change; other event types carry their own fields). Oldest first by default; set descending for newest first. Every page of one viewing shares a stable snapshot boundary (echo page 1's snapshotSequence as beforeSequence), and a keyset cursor supports walks at any depth. # OpenAPI definition ```json { "openapi": "3.0.3", "info": { "title": "API ENDPOINTS", "description": "CipherOwl blockchain compliance and risk assessment APIs.", "version": "1.0" }, "servers": [ { "url": "https://svc.cipherowl.ai" } ], "security": [ { "BearerAuth": [] } ], "tags": [ { "name": "Case Management", "description": "Read the organization's compliance cases. Search and page the case queue, read one case with the screening route currently in force for its address, its append-only screening history, and its audit trail. Read-only: cases are opened by screening (or by hand in the CipherOwl console), worked and closed there, and no write route is published here. A Case identifies its address by `network`; Cases opened today store the chain there (e.g. `evm`)." } ], "paths": { "/api/case-management/v1/cases/{caseId}/audit-events": { "get": { "summary": "List a Case's audit events", "description": "Returns the Case's immutable audit trail: who did what, when, with event-specific detail in each event's payload (workflow events carry the Case state before and after the change; other event types carry their own fields). Oldest first by default; set descending for newest first. Every page of one viewing shares a stable snapshot boundary (echo page 1's snapshotSequence as beforeSequence), and a keyset cursor supports walks at any depth.", "operationId": "CaseManagementService_ListAuditEvents", "responses": { "200": { "description": "A successful response.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/v1ListAuditEventsResponse" } } } } }, "parameters": [ { "name": "caseId", "description": "Identifier of the Case (Case.id).", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "pageSize", "description": "Events per page, 1 to 100. Omitted or 0 means 50.", "in": "query", "required": false, "schema": { "type": "integer", "format": "int32" } }, { "name": "page", "description": "Page to return, starting at 1; omitted or 0 returns page 1. Pages beyond\n10000 are rejected.", "in": "query", "required": false, "schema": { "type": "integer", "format": "int32" } }, { "name": "descending", "description": "Sort direction by the event instant (then eventSequence). Default false =\nascending (oldest first). true = descending (newest first) for the\nnewest-on-top view.", "in": "query", "required": false, "schema": { "type": "boolean" } }, { "name": "beforeSequence", "description": "Snapshot high-water mark for stable pagination: the\nsnapshotSequence returned by the page-1 response. Later pages pass it so\nonly events at or below it are returned and counted; page 1 omits it (0)\nand the server issues the boundary. The sequence is an insertion-order\nidentity, so the anchor is clock-free and immune to clock skew. Since a\nvalid sequence is >= 1, 0 means unset (page 1).", "in": "query", "required": false, "schema": { "type": "string", "format": "int64" } }, { "name": "createdAfter", "description": "Optional inclusive lower bound on the event instant: only events at or\nafter it are returned and counted. When both bounds are set, this one must\nnot be after createdBefore. The window narrows results within the case-wide\nsnapshot boundary (beforeSequence); changing the filter is a new viewing —\nrestart at page 1 without beforeSequence.", "in": "query", "required": false, "schema": { "type": "string", "format": "date-time" } }, { "name": "createdBefore", "description": "Optional inclusive upper bound on the event instant: only events at or\nbefore it are returned and counted.", "in": "query", "required": false, "schema": { "type": "string", "format": "date-time" } }, { "name": "actorIds", "description": "Only events by these actors, matched exactly on subject id — the value\nCaseAuditEvent.actorId (and Case.createdBy, Case.investigatorId) returns;\nthere is no name or email search. Empty = no actor filtering. Duplicates\nare collapsed, and at most 100 ids may be named.", "in": "query", "required": false, "style": "form", "explode": true, "schema": { "type": "array", "items": { "type": "string" } } }, { "name": "actorType", "description": "Optional filter on the acting identity kind: \"user\" for actions a person\ntook, \"system\" for events a service authored. Empty = both. Any other value\nis rejected as invalid, rather than served as an empty page.", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "cursorCreatedAt", "description": "Optional keyset cursor: the createdAt of the last event of the\nprevious page. Set together with cursorEventSequence — the pair is that\nevent's position in the total order — and the page resumes strictly after\nit in the requested sort direction, reading a page's worth of index entries\nat any depth. A cursor request must echo beforeSequence (the page-1\nsnapshot anchor), may not combine with page > 1, and skips the total (see\ntotalCount on the response for when it is computed). Filters must stay\nidentical across one cursor walk; changing them is a new viewing — restart\nat page 1.", "in": "query", "required": false, "schema": { "type": "string", "format": "date-time" } }, { "name": "cursorEventSequence", "description": "The sequence half of the keyset cursor: the last event of the previous page\ncarries it as its eventSequence. Since a valid sequence is >= 1, 0 means\nunset; both cursor fields are set together or not at all.", "in": "query", "required": false, "schema": { "type": "string", "format": "int64" } } ], "tags": [ "Case Management" ] } } }, "components": { "securitySchemes": { "BearerAuth": { "type": "http", "scheme": "bearer", "bearerFormat": "JWT", "description": "OAuth 2.0 access token obtained from /oauth/token using client credentials." } }, "schemas": { "v1CaseAuditEvent": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique event identifier." }, "caseId": { "type": "string", "description": "Case the event belongs to." }, "eventType": { "type": "string", "description": "What happened, as a stable identifier (for example CASE_CREATED,\nSCREENING_ADDED, CASE_CLOSED)." }, "actorType": { "type": "string", "description": "\"user\" for events a person took, \"system\" for events a service authored." }, "actorId": { "type": "string", "description": "Subject id of the acting identity." }, "actorRole": { "type": "string", "description": "Role recorded for the acting user; absent on system-authored events." }, "payload": { "type": "object", "description": "Event-specific details, fixed when the event was written. Workflow events\ncarry the Case state before and after the change, intake events the\nprovenance of the screening event that caused them, and other event\ntypes the fields of what they record — the keys depend on eventType." }, "createdAt": { "type": "string", "format": "date-time", "description": "The event instant; the presentation sorts on it (then eventSequence)." }, "commandId": { "type": "string", "description": "Correlates the event to the accepted request or system command that\ncaused it." }, "assertedRoles": { "type": "array", "items": { "type": "string" }, "description": "Every Case Management role the actor held when acting (\"MANAGER\",\n\"INVESTIGATOR\"); actorRole is the one the action was taken under." }, "eventSequence": { "type": "string", "format": "int64", "description": "Insertion-order identity. With createdAt it is the event's\nposition in the presentation's total order — the material a keyset cursor\nrequest (cursorCreatedAt, cursorEventSequence) echoes to resume after this\nevent." } }, "description": "CaseAuditEvent is one entry of a Case's immutable audit trail: who did\nwhat, when, with the event's details in payload." }, "v1ListAuditEventsResponse": { "type": "object", "properties": { "events": { "type": "array", "items": { "$ref": "#/components/schemas/v1CaseAuditEvent" }, "description": "One page of the Case's audit events, in the requested sort direction." }, "totalCount": { "type": "string", "format": "int64", "description": "Total audit events for the Case across all pages. Computed for every\nrequest that carries no keyset cursor, whatever its page number, and\nabsent when no event matches. A cursor page skips the count, so the field\nis absent there too — keep the total you were given earlier in the walk." }, "page": { "type": "integer", "format": "int32", "description": "Echo of the served 1-based page number." }, "pageSize": { "type": "integer", "format": "int32", "description": "Echo of the served page size." }, "snapshotSequence": { "type": "string", "format": "int64", "description": "Snapshot high-water mark for THIS request: the beforeSequence you sent, or\nthe highest eventSequence for the Case at the moment a cursorless request\nis served — page 2 without beforeSequence therefore recomputes it and gets\na later boundary. Echo the value page 1 returned as beforeSequence on every\nlater page so one viewing shares one clock-free boundary. Absent for a Case\nwith no events." } }, "description": "ListAuditEventsResponse is one page of a Case's audit trail together with\nthe snapshot boundary later pages of the same viewing should echo." } } } } ```