> ## Documentation Index > Fetch the complete documentation index at: https://docs.scanoss.com/llms.txt > Use this file to discover all available pages before exploring further. # List the durable audit-event trail for a subject (e.g. a finding) > Returns the ordered (oldest-first) audit-event history for one subject. Authorization dispatches on subject_kind — the caller must be allowed to read the underlying entity (for findings, findings:read plus same-org; for selfcheck, scans:read, authorized entirely from the matching audit rows' own org_id — the underlying Self-check row is never queried, because it is purged after 30 days while its trail is not). ## OpenAPI ````yaml /api-reference/earnie/triage-openapi.json get /v1/audit/events openapi: 3.0.3 info: title: Earnie Findings API description: List and read findings, triage them, and review resolutions. version: 1.0.0 servers: - url: https://{tenant}.earnie.dev description: Your Earnie deployment variables: tenant: default: your-company description: >- Your organization's Earnie address, as shown in your browser when you sign in. security: - bearerAuth: [] paths: /v1/audit/events: get: tags: - audit summary: List the durable audit-event trail for a subject (e.g. a finding) description: >- Returns the ordered (oldest-first) audit-event history for one subject. Authorization dispatches on subject_kind — the caller must be allowed to read the underlying entity (for findings, findings:read plus same-org; for selfcheck, scans:read, authorized entirely from the matching audit rows' own org_id — the underlying Self-check row is never queried, because it is purged after 30 days while its trail is not). operationId: GetV1AuditEvents parameters: - name: subject_kind in: query required: true schema: type: string enum: - finding - selfcheck - name: subject_id in: query required: true schema: type: string format: uuid responses: '200': description: Ordered audit-event trail for the subject content: application/json: schema: $ref: '#/components/schemas/AuditEventList' '400': description: Missing or unsupported subject_kind / subject_id content: application/json: schema: $ref: '#/components/schemas/Error' '401': description: Not authenticated content: application/json: schema: $ref: '#/components/schemas/Error' '403': description: Insufficient permissions to read the subject content: application/json: schema: $ref: '#/components/schemas/Error' '404': description: Subject not found in the caller's org content: application/json: schema: $ref: '#/components/schemas/Error' '500': description: Internal server error content: application/json: schema: $ref: '#/components/schemas/Error' components: schemas: AuditEventList: type: object required: - events properties: events: type: array items: $ref: '#/components/schemas/AuditEvent' Error: type: object required: - code - message properties: code: type: string message: type: string AuditEvent: type: object description: >- One durable audit event in an entity's trail. The actor is who performed the event; previous_state/state describe the transition (state is derived from the event type and is null for non-transition events). required: - event_type - actor - occurred_at properties: event_type: type: string description: Dot-separated event identifier, e.g. finding.detected. actor: $ref: '#/components/schemas/ActorRef' occurred_at: type: string format: date-time previous_state: type: string nullable: true description: State before this event, when the event is a transition. state: type: string nullable: true description: >- State after this event, derived from the event type. Null for non-transition events such as suppression. note: type: string nullable: true description: Optional justification/note recorded with a decision. resolution_id: type: string format: uuid nullable: true description: Linked resolution, when the event resolved the finding. actor_display_name: type: string nullable: true description: >- Human-readable actor identity captured at emit time (user email, scanner tool + version). Immutable. Absent when unresolved — clients fall back to actor.kind + actor.id. reason_slug: type: string nullable: true description: >- Resolution reason slug from the event payload (e.g. confirm_match, replace_component). Present on resolved-family events when recorded. replacement_purl: type: string nullable: true description: >- Replacement component purl from the resolve payload when the reason is replace_component. Null otherwise. caused_by_finding_id: type: string format: uuid nullable: true description: >- The finding whose decision this event records the consequence of. On a finding resolved with another_candidate_identified it is the candidate a reviewer confirmed for the same file. Null otherwise. gate: type: string nullable: true description: >- Self-check gate (pass, warn, block, require, error, none) from a selfcheck.completed event. Null on every other event, and on a Finding event. coverage: type: string nullable: true description: >- Self-check coverage from a selfcheck.completed event. Null on every other event, and on a Finding event. policies_evaluated: type: integer nullable: true description: >- Count of policies evaluated on a selfcheck.completed event (length of its policies array, so the two can never disagree). Null on every other event. detail_counts: type: object nullable: true description: >- Violation and detection counts from a selfcheck.completed event. Null on every other event. properties: violations: type: integer detections: type: integer files_total: type: integer nullable: true description: >- Total files submitted, from a selfcheck.submitted event. Null on every other event. expires_at: type: string format: date-time nullable: true description: >- The run's retention expiry, from a selfcheck.submitted event. Null on every other event. error_code: type: string nullable: true description: >- Failure code from a selfcheck.failed event. Null on every other event. The failure message reuses the existing note field. ActorRef: type: object required: - kind - id properties: kind: type: string enum: - user - apikey - worker - agent id: type: string format: uuid securitySchemes: bearerAuth: type: http scheme: bearer description: >- An Earnie API key, sent as `Authorization: Bearer sk_earnie_...`. Create one under Settings > API keys. The key's scopes decide which operations it may call. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.