autonomy audit query

Query retained audit records

Synopsis

Reads audit records from the local audit store and prints matching records.

When –pg-url is set (or AUTONOMY_AUDIT_PG_URL is in the environment), records are read from the PostgreSQL audit_events table. Otherwise the local JSONL file store is used (–audit-dir).

Filters (all optional, ANDed together): –event-type exact event name (e.g. “rollout.plan.created”) –category audit domain: rollout | ha | relay | cert | auth | system | rollback –actor operator identity (e.g. “alice@example.com”) –outcome result: success | failure | denied | pending –source emitting component: orchestrator | edge | cli –start-time RFC3339 inclusive lower bound (e.g. “2026-01-01T00:00:00Z”) –end-time RFC3339 inclusive upper bound –limit maximum records to return (default 100, 0 = no limit)

Output: –output text tabwriter table (default): TIMESTAMP EVENT ACTOR RESOURCE OUTCOME SOURCE –output json pretty-printed JSON array

Usage

autonomy audit query [flags]

Options

      --actor string        filter by operator identity
      --audit-dir string    audit storage directory (default: AUTONOMY_AUDIT_DIR or XDG state path)
      --category string     audit domain filter: rollout | ha | relay | cert | auth | system | rollback
      --end-time string     inclusive RFC3339 end time
      --event-type string   exact event name filter (e.g. "rollout.plan.created")
      --limit int           maximum records to return (0 = no limit) (default 100)
      --outcome string      result filter: success | failure | denied | pending
      --output string       output format: "text" (tabwriter table) or "json" (array) (default "text")
      --pg-url string       PostgreSQL URL for DB-backed audit query (env: AUTONOMY_AUDIT_PG_URL)
      --source string       component filter: orchestrator | edge | cli
      --start-time string   inclusive RFC3339 start time (e.g. 2026-01-01T00:00:00Z)

See also