Get approved/blocked audit logs

get

{protocol}://{host}:{port}/xray/api/v1/curation/audit/packages

Export approved/blocked audit events for packages.

When dry_run=false (default), outputs real audit events. Each event
includes the non-dry-run policies that affected it (blocking, bypassed,
waived). This is what the UI shows on the Blocked/Approved tab.

When dry_run=true, outputs dry-run events — one per dry-run policy.
This is what the UI shows on the Dry Run tab.

When format=csv, the response is a ZIP file containing a CSV.
Pagination counts audit events, not CSV rows — each event may produce
multiple rows (one per policy).

Recent Requests

Time	Status	User Agent
Retrieving recent requests…

Loading…

Query Params

order_by

string

enum

Defaults to id

Column to sort by. Only id is allowed. Default: id.

Allowed:

direction

string

enum

Defaults to desc

Sorting direction: asc or desc.

Allowed:

num_of_rows

integer

1 to 2000

Defaults to 100

Maximum number of rows. Valid range: 1–2000 (JSON) or up to 500 000 (CSV).

offset

integer

Defaults to 0

Pagination offset.

created_at_start

date-time

Start of the time range (RFC 3339). Defaults to 7 days ago.

created_at_end

date-time

End of the time range (RFC 3339). Defaults to now.

include_total

boolean

Defaults to false

Include total_count in the response metadata. Not allowed when format=csv.

dry_run

boolean

Defaults to false

When false, returns real (non-dry-run) audit events. When true, returns dry-run events.

format

string

enum

Defaults to json

Response format. json returns JSON; csv returns a ZIP file containing a CSV.

Allowed:

action

string

Filter by audit action. Allowed values are approved, blocked, and passed. Matching is case-insensitive. Separate multiple values with a comma. Any other value is ignored and does not return 400. If every value is invalid, the filter is not applied.

package_type

string

Exact package type, for example npm. Separate multiple values with a comma to match any of them.

package_name

string

Exact package name. Separate multiple values with a comma to match any of them.

package_version

string

Exact package version. Separate multiple values with a comma to match any of them.

curated_repository_name

string

Exact curated repository name. Separate multiple values with a comma to match any of them.

id_start

integer

Return events whose id is greater than or equal to this integer. The value must be an integer greater than 0. Any other value is ignored and does not return 400.

id_end

integer

Return events whose id is less than or equal to this integer. The value must be an integer greater than 0. Any other value is ignored and does not return 400.

id_after

integer

Return events whose id is greater than this integer. The value must be an integer greater than 0. Any other value is ignored and does not return 400.

id_before

integer

Return events whose id is less than this integer. The value must be an integer greater than 0. Any other value is ignored and does not return 400.

Headers

string

enum

Defaults to application/json

Generated from available response content types

Allowed:

Responses

Language

URL

Loading…

Response

Click Try It! to start a request and see the response here! Or choose an example:

application/json

application/zip

200OK. When format=json, returns JSON. When format=csv, returns a ZIP archive (application/zip).

400Invalid pagination or filter parameters.

404Resource not found.