Chronary Audit Log API

openapi: 3.2.0
info:
  title: Chronary Audit Log API
  version: 1.0.0
  description: 'Calendar-as-a-service API for AI agents.


    Manage calendars, events, and availability for AI and human agents.

    All endpoints require an API key passed as a Bearer token.


    **Authentication:** `Authorization: Bearer chr_sk_...` or `Authorization: Bearer chr_ak_...`


    **Rate limit:** 10 requests/second per API key. Exceeds return HTTP 429.


    **Quotas:** Monthly operation limits by plan — see Billing & plans and Rate limits.


    **Agent bootstrap:** Custom extensions prefixed `x-agent-*` describe the self-signup flow for AI agents. These are not part of any registered OpenAPI extension — they are a Chronary convention.'
  contact:
    name: Chronary Support
    email: support@chronary.ai
    url: https://docs.chronary.ai
servers:
- url: https://api.chronary.ai
  description: Production
security:
- BearerAuth: []
tags:
- name: Audit Log
paths:
  /v1/audit-log:
    get:
      operationId: listAuditLog
      summary: List audit-log entries
      description: 'Returns mutating API operations and auth lifecycle events for the calling organization, clamped to the per-tier retention window (Free: 7d, Pro: 90d, Custom: per-contract). Only org-level API keys may call this endpoint — agent-scoped keys receive 403.'
      tags:
      - Audit Log
      parameters:
      - schema:
          type: string
          format: date-time
          description: Lower bound (inclusive). Clamped to retention window if older.
          example: '2026-05-01T00:00:00.000Z'
        required: false
        description: Lower bound (inclusive). Clamped to retention window if older.
        name: from
        in: query
      - schema:
          type: string
          format: date-time
          description: Upper bound (inclusive). Defaults to now.
          example: '2026-05-11T00:00:00.000Z'
        required: false
        description: Upper bound (inclusive). Defaults to now.
        name: to
        in: query
      - schema:
          type: string
          minLength: 1
          maxLength: 64
          description: Filter by exact action name, e.g. `agent.create`.
          example: agent.create
        required: false
        description: Filter by exact action name, e.g. `agent.create`.
        name: action
        in: query
      - schema:
          type: string
          minLength: 1
          maxLength: 32
          description: Filter by the first 20 chars of the actor API key.
          example: chr_sk_abcdef12345
        required: false
        description: Filter by the first 20 chars of the actor API key.
        name: actor_key_prefix
        in: query
      - schema:
          type: string
          description: Opaque pagination cursor from a previous response.
        required: false
        description: Opaque pagination cursor from a previous response.
        name: cursor
        in: query
      - schema:
          type: integer
          minimum: 1
          maximum: 200
          description: Page size (1–200). Defaults to 50.
          example: 50
        required: false
        description: Page size (1–200). Defaults to 50.
        name: limit
        in: query
      responses:
        '200':
          description: Audit-log page
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuditLogResponse'
        '400':
          description: Invalid query parameters
        '401':
          description: Unauthorized — missing or invalid API key
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '403':
          description: Agent-scoped key cannot access this resource
        '429':
          description: Rate limited — 10 requests per second per key exceeded
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
components:
  schemas:
    AuditLogEntry:
      type: object
      properties:
        id:
          type: string
          example: aud_abc123def456
        action:
          type: string
          example: agent.create
        actor_key_prefix:
          type:
          - string
          - 'null'
          example: chr_sk_abcdef12345
        agent_id:
          type:
          - string
          - 'null'
          example: null
        resource:
          type:
          - string
          - 'null'
          example: agt_1
        ip:
          type:
          - string
          - 'null'
          example: 203.0.113.10
        status:
          type: integer
          example: 201
        method:
          type: string
          example: POST
        path:
          type: string
          description: Route template (entity IDs replaced with `:id`).
          example: /v1/agents
        duration_ms:
          type: integer
          example: 42
        request_id:
          type:
          - string
          - 'null'
          example: req_8e9f...
        created_at:
          type: string
          format: date-time
          example: '2026-05-10T10:00:00.000Z'
      required:
      - id
      - action
      - actor_key_prefix
      - agent_id
      - resource
      - ip
      - status
      - method
      - path
      - duration_ms
      - request_id
      - created_at
    AuditLogResponse:
      type: object
      properties:
        data:
          type: array
          items:
            $ref: '#/components/schemas/AuditLogEntry'
        pagination:
          type: object
          properties:
            next_cursor:
              type:
              - string
              - 'null'
              description: Opaque cursor for the next page. Null if no more results.
              example: MjAyNi0wNS0xMFQxMDowMDowMC4wMDBafGF1ZF8x
          required:
          - next_cursor
        retention_days:
          type:
          - integer
          - 'null'
          description: Audit-log retention window for the caller plan (days). Null = unlimited (Custom plan).
          example: 90
        range_clamped:
          type: boolean
          description: True when the requested `from` was outside the retention window and the server clamped it. UI uses this to render an upgrade hint.
          example: false
      required:
      - data
      - pagination
      - retention_days
      - range_clamped
    Error:
      type: object
      properties:
        error:
          type: object
          properties:
            type:
              type: string
              example: invalid_request
            message:
              type: string
              example: The field "name" is required.
            request_id:
              type: string
              example: req_01H9X4M2P5R8T6V0
            required_plan:
              type: string
              example: pro
              description: 'plan_required: the plan that unlocks the feature'
            feature:
              type: string
              description: 'plan_required: the gated feature'
            metric:
              type: string
              description: 'quota_exceeded and count caps: the metric at its limit (a PLAN_LIMITS key, accepted by POST /v1/billing/upgrade-requests)'
            limit:
              type: integer
              description: 'quota_exceeded and count caps: the plan''s limit for `metric`'
            upgrade_url:
              type: string
              description: Where a human upgrades the plan
            docs_url:
              type: string
            contact_url:
              type: string
              description: 'Contract-managed plans: where to contact sales'
            retry_after:
              type: integer
              description: Seconds until the request may be retried
          required:
          - type
          - message
          - request_id
      required:
      - error
  securitySchemes:
    BearerAuth:
      type: http
      scheme: bearer
      description: 'API key with `chr_sk_*` for org-level access or `chr_ak_*` for agent-scoped access. Pass in the Authorization header: `Authorization: Bearer chr_sk_...`'
    SessionAuth:
      type: apiKey
      in: cookie
      name: chronary_session
      description: Console session JWT (HS256), issued by sign-in and sent as the `chronary_session` cookie (a Bearer JWT is also accepted). This is NOT a chr_sk_*/chr_ak_* API key — API keys are rejected with 401 on these endpoints.
x-agent-self-signup:
  url: https://api.chronary.ai/v1/agent/sign-up
  verify_url: https://api.chronary.ai/v1/agent/verify
  restricted_key_returned: true
  human_in_the_loop: otp_email
  rate_limit: 5 requests per 60s per client IP
x-agent-bootstrap-script:
  npx: npx @chronary/agent-init@latest
  shell: https://chronary.ai/agent-init.sh
  description: One-liner that performs sign-up, prompts for OTP, verifies, and creates a smoke calendar. Accepts CHRONARY_EMAIL and CHRONARY_OTP env vars for non-interactive flows.
x-llms-txt: https://docs.chronary.ai/llms.txt
x-llms-full-txt: https://docs.chronary.ai/llms-full.txt
x-mcp-server-card: https://chronary.ai/.well-known/mcp/server-card.json
x-api-catalog: https://chronary.ai/.well-known/api-catalog