> ## Documentation Index > Fetch the complete documentation index at: https://docs-pos.solya.app/llms.txt > Use this file to discover all available pages before exploring further. # Query the central audit log > Lists the network's recorded sensitive actions (the piste d'audit / journal d'audit), most recent first, optionally narrowed by `?actorId=`, `?entityType=`, `?entityId=` and/or `?action=`, bounded by ISO-8601 `?from=` / `?to=` instants, and capped by `?limit=` (a positive integer; a malformed limit 400s). Every use-case run is appended to this trail by the ExecutionContext sink, so an audited action is immediately visible here. Cross-cutting compliance, not a fiscal read (hence the `Audit` tag). Reading the log requires the finance read grant. ## OpenAPI ````yaml /openapi.json get /v1/audit openapi: 3.0.3 info: title: Solya POS API version: 1.0.0 description: >- The Solya POS backend HTTP surface. Every documented operation is agent-ready: it carries an `operationId`, an agent-facing `description`, the `pos.*` scopes it enforces (`x-required-permissions`) and an `x-agent-tier`. Success responses return the payload as raw JSON; failures return the `ErrorResponse` envelope (`{ error: { code, message, statusCode } }`). servers: - url: / description: The backend, relative to its deployed origin. security: [] paths: /v1/audit: get: tags: - Audit summary: Query the central audit log description: >- Lists the network's recorded sensitive actions (the piste d'audit / journal d'audit), most recent first, optionally narrowed by `?actorId=`, `?entityType=`, `?entityId=` and/or `?action=`, bounded by ISO-8601 `?from=` / `?to=` instants, and capped by `?limit=` (a positive integer; a malformed limit 400s). Every use-case run is appended to this trail by the ExecutionContext sink, so an audited action is immediately visible here. Cross-cutting compliance, not a fiscal read (hence the `Audit` tag). Reading the log requires the finance read grant. operationId: queryAuditLog parameters: - schema: type: string in: query name: actorId required: false description: Narrow to actions performed by this actor id. - schema: type: string in: query name: entityType required: false description: Narrow to a target entity kind (e.g. `purchaseOrder`, `product`). - schema: type: string in: query name: entityId required: false description: Narrow to actions against one target entity id. - schema: type: string in: query name: action required: false description: >- Narrow to one audited action key (e.g. `procurement.createPurchaseOrder`). - schema: type: string in: query name: from required: false description: Lower bound (inclusive) of the audit window, as an ISO-8601 instant. - schema: type: string in: query name: to required: false description: Upper bound (inclusive) of the audit window, as an ISO-8601 instant. - schema: type: integer minimum: 0 exclusiveMinimum: true maximum: 9007199254740991 in: query name: limit required: false description: >- Cap on the number of entries returned (positive integer; a bad value 400s). responses: '200': description: The matching audit-log entries, most recent first. content: application/json: schema: type: array items: type: object properties: id: type: string action: type: string actorId: type: string outcome: type: string enum: - success - failure at: type: string correlationId: type: string entityType: type: string entityId: type: string idempotencyKey: type: string metadata: type: object additionalProperties: {} required: - id - action - actorId - outcome - at - correlationId additionalProperties: false description: The matching audit-log entries, most recent first. example: - id: audit-1 action: procurement.createPurchaseOrder actorId: audit-actor-x outcome: success at: '2026-07-16T09:30:00.000Z' correlationId: corr-1 entityType: purchaseOrder entityId: po-audit-1 metadata: resultCode: OK '400': description: >- The request failed schema validation; `error.fieldErrors` lists the fields. content: application/json: schema: $ref: '#/components/schemas/ValidationErrorResponse' '401': description: No valid credential was presented — send a bearer token. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '403': description: The actor is authenticated but lacks the required `pos.*` scope. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '500': description: An unexpected server error — safe to retry idempotent requests. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' security: - bearerAuth: [] components: schemas: ValidationErrorResponse: type: object required: - error additionalProperties: false description: >- A `VALIDATION_FAILED` envelope carrying the offending fields in `fieldErrors`. properties: error: type: object required: - code - message - statusCode additionalProperties: false properties: code: type: string enum: - VALIDATION_FAILED message: type: string statusCode: type: integer fieldErrors: type: array description: >- One entry per rejected field: the field path and why it was rejected. items: type: object required: - field - message additionalProperties: false properties: field: type: string description: Dot-path of the offending field. message: type: string description: Why the field was rejected. ErrorResponse: type: object required: - error additionalProperties: false description: The uniform failure envelope every non-2xx response returns. properties: error: type: object required: - code - message - statusCode additionalProperties: false properties: code: type: string enum: - VALIDATION_FAILED - UNAUTHORIZED - FORBIDDEN - NOT_FOUND - CONFLICT - BUSINESS_RULE_VIOLATION - INTERNAL_ERROR description: >- Machine-readable kernel `ResultCode` — branch on this, not on `message`. message: type: string description: >- Human-readable explanation. Safe to surface; never leaks server internals. statusCode: type: integer description: >- The HTTP status, mirrored into the body so a client need not read headers. securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: JWT description: >- `Authorization: Bearer `. Accepts EITHER a Keycloak access token (scopes-in-token) OR an opaque POS session token; both resolve to the same `pos.*` scope vocabulary the route guards enforce. ````