audit operations

The exact fields each audit.* operation takes and returns.

Every op is POST /v1/<op> over HTTP and the MCP tool loom_<op>. The identity fields (org, namespace, agent, user_id, session_id) are filled from the token and the MCP session when a transport can; for an HTTP call with no token on a single-user server, the install's org on every op but code.* and tracker.* (which keep their plane's), and on some ops its namespace and agent; see identities and namespaces. The operations index explains role, kind and the MCP all listing. Unknown input fields are served and named in ignored_args.

audit.list

Query the audit log (tamper-evident per-row hashes).

POST /v1/audit.list · MCP loom_audit_list · role viewer · read · not listed under the MCP all toolset

Input field	Type	Default	Meaning
org	str	required	The tenant (first element of the identity tuple).
namespace	str \| None	None	None: every namespace the caller may read; naming one it cannot read gives an empty page.
event_type	str \| None	None	exact match
since	datetime \| None	None	only rows ts >= since
limit	int	50	At most this many rows per page, newest first; 1 to 500.
cursor	str \| None	None	opaque token from prior page
fields	list[str] \| None	None	The output fields the caller reads (a whitelist resolved against the row model; an unknown name is a 422); unset, every field.

Output field	Type	Meaning
rows	list[AuditListRow]	The page of audit rows, newest first (ties broken by request_id).
next_cursor	str \| None	Pass back as cursor for the next, older page; None when this page is the last.