AuditTrailEnvelope

okbooleanrequired

meta object

watermarkstring

Opaque leak-tracing token. Safe to ignore.

Possible values: Value must match regular expression ^wm_[0-9a-f]{8}$

Example: wm_a1b2c3d4

data object

scenario_idstringrequired

Example: 4729318

blueprint_iduuidrequired

FlowBeacon's internal id for this automation, stable across evaluations.

events object[]required

One page of events, newest first.

Array [

iduuidrequired

Stable event id. Safe to use for de-duplication.

event_typestringrequired

Example: remediation_attempt

created_atdate-timerequired

ISO 8601 UTC timestamp the event was chained at.

Example: 2026-08-20T10:30:00+00:00

actor objectrequired

Who caused the event. null fields mean a system actor.

namestring | nullnullable

Example: Ada Lovelace

emailemailnullable

Example: ada@example.com

summary objectrequired

Flattened, stable view of the event. Counts and changes_summary are always present; the remaining keys appear only when the event carries them. Raw evaluation payloads, blueprint snapshots, and evidence values are deliberately not exposed here — use GET /scenarios/{scenario_id}/results for current violation detail.

policies_evaluatedinteger

Example: 3

policies_passedinteger

Example: 2

policies_failedinteger

Example: 1

overall_resultstring | nullnullable

Example: improved

notesstring

Example: Auto-remediation applied

changes_summarystring

Example: 1 policy improved (SEC-5: fail → pass)

compliance_transition object

fromstring

Example: non_compliant

tostring

Example: compliant

became_compliantboolean

Example: true

policy_codestring

Example: SEC-5

target_typestring

Example: blueprint

scenario_idstring

Example: 4729318

results_summary object

Per-status counts for an evaluation event.

property name*integer

compliance_beforestring

Example: non_compliant

compliance_afterstring

Example: compliant

chain object

Hash-chain evidence. Only present when include_chain=true.

seqinteger | nullnullable

Example: 41

hash_versioninteger | nullnullable

Example: 3

prev_hashstring | nullnullable

Example: abababab...deadbeef

row_hashstring | nullnullable

Example: cdcdcdcd...cafebabe

]

next_cursorstring | nullnullablerequired

Pass back as ?cursor= for the next page. null on the last page.

AuditTrailEnvelope

{
  "ok": true,
  "meta": {
    "watermark": "wm_a1b2c3d4"
  },
  "data": {
    "scenario_id": "4729318",
    "blueprint_id": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
    "events": [
      {
        "id": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
        "event_type": "remediation_attempt",
        "created_at": "2026-08-20T10:30:00+00:00",
        "actor": {
          "name": "Ada Lovelace",
          "email": "ada@example.com"
        },
        "summary": {
          "policies_evaluated": 3,
          "policies_passed": 2,
          "policies_failed": 1,
          "overall_result": "improved",
          "notes": "Auto-remediation applied",
          "changes_summary": "1 policy improved (SEC-5: fail → pass)",
          "compliance_transition": {
            "from": "non_compliant",
            "to": "compliant",
            "became_compliant": true
          },
          "policy_code": "SEC-5",
          "target_type": "blueprint",
          "scenario_id": "4729318",
          "results_summary": {
            "pass": 2,
            "fail": 1,
            "warn": 0,
            "n_a": 0
          },
          "compliance_before": "non_compliant",
          "compliance_after": "compliant"
        },
        "chain": {
          "seq": 41,
          "hash_version": 3,
          "prev_hash": "abababab...deadbeef",
          "row_hash": "cdcdcdcd...cafebabe"
        }
      }
    ],
    "next_cursor": "string"
  }
}