List append-only repository security audit events

GET/v1/security/audit-events

How to call this endpoint

Every ACP API request uses bearer authentication. The examples here show the actual request path, auth header, and body shape that the platform expects.

Path, query, and header parameters

These parameters control which ACP object the endpoint acts on and how the request is processed.

Path parameters

None.

Query parameters

Name	Location	Type	Required	Description
repositoryId	query	string	No	—
runId	query	string	No	—
findingId	query	string	No	—
limit	query	integer	No	—

Header parameters

Name	Location	Type	Required	Description
X-Computer-Agents-Organization	header	string	No	Active organization context. If omitted, the authenticated user's personal organization is used.

Body schema

This endpoint does not require a request body.

None.

What the API returns

Each response code below includes the documented payload shape for the ACP API.

200Security audit eventsapplication/json

Field	Type	Required	Description
object	list	Yes	—
data	object[]	Yes	—
data[].id	string	Yes	Unique identifier.
data[].repositoryId	string	No	—
data[].runId	string	No	—
data[].findingId	string	No	—
data[].remediationId	string	No	—
data[].actorType	user \| system \| github \| agent	Yes	—
data[].actorId	string	Yes	—
data[].action	string	Yes	—
data[].targetType	string	Yes	—
data[].targetId	string	Yes	—
data[].correlationId	string	No	—
data[].payload	object	No	—
data[].previousHash	string	Yes	SHA-256 digest of the preceding organization security audit event; empty for the chain root.
data[].eventHash	string	Yes	SHA-256 digest binding this event to its predecessor.
data[].createdAt	string	Yes	ISO 8601 timestamp.
has_more	boolean	Yes	—
total_count	integer	Yes	—

List append-only repository security audit events

Response 200

See the ACP quickstart and SDK flow