AuditTrailEvent

iduuidrequired

Stable event id. Safe to use for de-duplication.

event_typestringrequired

Example: remediation_attempt

created_atdate-timerequired

ISO 8601 UTC timestamp the event was chained at.

Example: 2026-08-20T10:30:00+00:00

actor objectrequired

Who caused the event. null fields mean a system actor.

namestring | nullnullable

Example: Ada Lovelace

emailemailnullable

Example: ada@example.com

summary objectrequired

Flattened, stable view of the event. Counts and changes_summary are always present; the remaining keys appear only when the event carries them. Raw evaluation payloads, blueprint snapshots, and evidence values are deliberately not exposed here — use GET /scenarios/{scenario_id}/results for current violation detail.

policies_evaluatedinteger

Example: 3

policies_passedinteger

Example: 2

policies_failedinteger

Example: 1

overall_resultstring | nullnullable

Example: improved

notesstring

Example: Auto-remediation applied

changes_summarystring

Example: 1 policy improved (SEC-5: fail → pass)

compliance_transition object

fromstring

Example: non_compliant

tostring

Example: compliant

became_compliantboolean

Example: true

policy_codestring

Example: SEC-5

target_typestring

Example: blueprint

scenario_idstring

Example: 4729318

results_summary object

Per-status counts for an evaluation event.

property name*integer

compliance_beforestring

Example: non_compliant

compliance_afterstring

Example: compliant

chain object

Hash-chain evidence. Only present when include_chain=true.

seqinteger | nullnullable

Example: 41

hash_versioninteger | nullnullable

Example: 3

prev_hashstring | nullnullable

Example: abababab...deadbeef

row_hashstring | nullnullable

Example: cdcdcdcd...cafebabe

AuditTrailEvent

{
  "id": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
  "event_type": "remediation_attempt",
  "created_at": "2026-08-20T10:30:00+00:00",
  "actor": {
    "name": "Ada Lovelace",
    "email": "ada@example.com"
  },
  "summary": {
    "policies_evaluated": 3,
    "policies_passed": 2,
    "policies_failed": 1,
    "overall_result": "improved",
    "notes": "Auto-remediation applied",
    "changes_summary": "1 policy improved (SEC-5: fail → pass)",
    "compliance_transition": {
      "from": "non_compliant",
      "to": "compliant",
      "became_compliant": true
    },
    "policy_code": "SEC-5",
    "target_type": "blueprint",
    "scenario_id": "4729318",
    "results_summary": {
      "pass": 2,
      "fail": 1,
      "warn": 0,
      "n_a": 0
    },
    "compliance_before": "non_compliant",
    "compliance_after": "compliant"
  },
  "chain": {
    "seq": 41,
    "hash_version": 3,
    "prev_hash": "abababab...deadbeef",
    "row_hash": "cdcdcdcd...cafebabe"
  }
}