Audit & exports

Platform operation facts

GET /v1/audit/events provides 90-day Platform operation facts. They contain only caller/user/API-key identity, Project/Environment/Run IDs, operation ID, route action, phase, outcome, HTTP status and time. Prompts, file bodies, raw errors, tokens and arbitrary request attributes are excluded. Both API and console operations are recorded. X-Operation-Id correlates an API call's attempt/result; a missing result means the outcome is unconfirmed. 202 results mean accepted. Admission is persisted before handler execution; failure to persist a normal response's result returns an audit-unavailable error and may follow an executed operation. Retry with the original idempotency key and reconcile by operation ID.

Filters and pagination

Filter by environmentId, runId, action, startTime and endTime. Use after and response nextCursor for chronological pagination, with limit up to 200. GET /v1/audit/events/export returns one NDJSON page; use X-Next-Cursor as after and a fixed endTime to export a stable window. Export access is recorded. Platform facts are separate from harness transcripts and are not presented as cryptographically tamper-proof.

Platform and runtime boundaries

GET /v1/environments/{environmentId}/audit/events proxies authorized Sandbox0 canonical signed facts, preserving original field names and integrity information. It requires the Sandbox0 enterprise audit feature, sandboxaudit:read, and a working audit backend. Disabled or unavailable auditing is an error, never an empty success. Queries default to the last 15 minutes. Specify startTime/endTime for historical windows and paginate with cursor. Sandbox0 retention follows the deployment configuration, independently of Platform's 90-day ledger. Platform and Sandbox0 operation IDs are separate: time overlap alone is not a causal link. Neither ledger guarantees every guest command/syscall is captured.

Console equivalents use /api/v1/platform/ and browser-cookie authentication. Team admins manage Project retention and deletion; Project API keys have authority within their Project. The console's Data & audit view lists deletion receipts, exports Platform facts and queries signed runtime facts. Environment pages set retention; Run pages request manual content erasure.

curl \
    "https://api.sandpi.ai/v1/audit/events" \
    -H "Authorization: Bearer $SANDPI_API_TOKEN"

{
  "data": {
    "items": [
      {
        "id": "",
        "actorUserId": "",
        "actorKind": "user",
        "operationId": "",
        "action": "",
        "phase": "attempt",
        "outcome": "accepted",
        "occurredAt": "2026-10-12T01:00:00Z"
      }
    ]
  }
}

{
  "error": {
    "code": "platform_balance_insufficient",
    "message": "Top up Platform credits before submitting a Run.",
    "requestId": "req_example"
  }
}

Export a stable window

Choose a fixed endTime before the first request. Download one NDJSON page at a time, then set after to the returned X-Next-Cursor and keep that same time window until pagination ends. Do not treat one page as a complete export.

curl \
    "https://api.sandpi.ai/v1/audit/events/export" \
    -H "Authorization: Bearer $SANDPI_API_TOKEN"

""

{
  "error": {
    "code": "platform_balance_insufficient",
    "message": "Top up Platform credits before submitting a Run.",
    "requestId": "req_example"
  }
}

Query signed runtime facts

Use the Environment runtime audit operation for Sandbox0’s original signed facts. Specify a historical time window explicitly; its default is the last 15 minutes. Follow its cursor, separately from the Platform audit after cursor.

curl \
    "https://api.sandpi.ai/v1/environments/$ENVIRONMENT_ID/audit/events" \
    -H "Authorization: Bearer $SANDPI_API_TOKEN"

{
  "data": {}
}

{
  "error": {
    "code": "platform_balance_insufficient",
    "message": "Top up Platform credits before submitting a Run.",
    "requestId": "req_example"
  }
}

Investigate an unconfirmed outcome

Keep the X-Operation-Id and query the affected resource before retrying a mutation. An attempt without a result is not proof that nothing happened. Reuse an existing idempotency key where supported. See errors and retries.