# Audit Log API Query the attestation-ready record of every issuance, action, policy decision, and revocation. ## What lands in the log Every credential issuance, every governed action with its policy decision, every sponsor change, and every revocation writes an immutable entry. Each entry names the identity, the sponsor, the scope, and the outcome. The log is append-only. Entries are never edited or deleted, which is what makes it attestation-ready. ## Querying entries GET /v1/audit with filters for identity, sponsor, action type, decision, and a time range. Results are ordered newest-first and paginated by cursor. Narrow queries during an incident — filter to one identity and a tight time window to reconstruct exactly what an agent did. ## Streaming Subscribe to /v1/audit/stream to receive entries as they are written. Use it to drive real-time monitoring, anomaly detection, and automated revocation triggers on out-of-scope activity. ## Attestation packs POST /v1/audit/export generates a signed evidence pack over a time range, mapped to SOC 2 and ISO 27001 controls. The pack is derived entirely from the same log you query day to day, so evidence never drifts from reality.