List Events

List events with filtering by agent, session, action type, tool name, decision, risk range, and time range.

GET /v1/events

cURL

curl "https://api.quintai.dev/v1/events?action_type=PROCESS_EXEC&agent_id=claude-code&min_risk=30" \
  -H "Authorization: Bearer qt_deploy_YOUR_TOKEN"

200

{
  "events": [
    {
      "id": "550e8400-e29b-41d4-a716-446655440000",
      "session_id": "6ba7b810-9dad-11d1-80b4-00c04fd430c8",
      "agent_id": "claude-code",
      "action_type": "PROCESS_EXEC",
      "tool_name": "curl",
      "arguments": ["-X", "POST", "https://api.example.com/data"],
      "risk_score": 45,
      "decision": "allow",
      "timestamp": "2026-04-12T14:32:00Z"
    }
  ]
}

Requires Authorization: Bearer header with a deploy token (qt_deploy_*) or Supabase JWT.

Query Parameters

agent_id · string

Filter by agent identifier (e.g., claude-code).

session_id · string

Filter by session UUID.

action_type · string

Filter by action type: PROCESS_EXEC, FILE_READ, FILE_WRITE, FILE_DELETE, NETWORK_CONNECT.

tool_name · string

Filter by tool name (binary basename, e.g., git, curl).

decision · string

Filter by policy decision: allow, block.

min_risk · number

Minimum risk score. Finite numbers only — NaN and Infinity are rejected.

max_risk · number

Maximum risk score.

since · datetime

RFC 3339 timestamp (2026-04-11T09:30:00Z) or a bare date (2026-04-11, interpreted as midnight UTC). Only return events on or after this time. Alias for start_time; start_time wins if both are given.

start_time · datetime

RFC 3339 timestamp or a bare date. Only return events on or after this time.

end_time · datetime

RFC 3339 timestamp or a bare date. Only return events on or before this time.

Response

events · array

Array of event records matching the filters.

Show event object properties

id · string

Event UUID.

session_id · string

Session UUID this event belongs to.

agent_id · string

Detected agent identifier.

action_type · string

Type of action: PROCESS_EXEC, FILE_READ, FILE_WRITE, FILE_DELETE, NETWORK_CONNECT.

tool_name · string

Binary basename of the invoked tool.

arguments · array

Process arguments or file paths.

risk_score · integer

Computed risk score (0-100).

decision · string

Policy decision: allow or block.

timestamp · datetime

When the event occurred.

cURL

curl "https://api.quintai.dev/v1/events?action_type=PROCESS_EXEC&agent_id=claude-code&min_risk=30" \
  -H "Authorization: Bearer qt_deploy_YOUR_TOKEN"

200

{
  "events": [
    {
      "id": "550e8400-e29b-41d4-a716-446655440000",
      "session_id": "6ba7b810-9dad-11d1-80b4-00c04fd430c8",
      "agent_id": "claude-code",
      "action_type": "PROCESS_EXEC",
      "tool_name": "curl",
      "arguments": ["-X", "POST", "https://api.example.com/data"],
      "risk_score": 45,
      "decision": "allow",
      "timestamp": "2026-04-12T14:32:00Z"
    }
  ]
}