---
title: "Get paginated audit sessions (threads)"
method: GET
path: "/admin/audit/sessions"
tags: ["admin"]
---

# Get paginated audit sessions (threads)

`GET /admin/audit/sessions`

Groups audit log entries by session id into threads and returns
one summary per thread — its latest entry, entry count, and time
span — ordered by latest activity. Entries without a session id
appear as single-entry threads. Filters apply to entries before
grouping.

## Query parameters

- `days` integer
- `start_date` string
- `end_date` string
- `requested_model` string
- `provider` string
- `method` string
- `path` string
- `user_path` string
- `error_type` string
- `status_code` integer
- `stream` boolean
- `search` string
- `limit` integer
- `offset` integer

## Response `200`

OK

- AdminAuditSessionsListResponse
  - `limit` integer
  - `offset` integer
  - `sessions` AdminAuditSessionResponse[]
    - `count` integer
    - `first_timestamp` string
    - `last_timestamp` string
    - `latest` AdminAuditLogEntryResponse
      - `alias_used` boolean
      - `auth_key_id` string
      - `auth_method` string
      - `bodies_omitted` boolean — BodiesOmitted marks a list entry whose request/response bodies (and other heavy payloads) were stripped server-side; the full entry is available from GET /admin/audit/detail. It also tells the dashboard the entry is persisted — a slim entry is never an in-flight request.
      - `cache_type` string
      - `client_ip` string
      - `conversation_payload` boolean — ConversationPayload reports that the entry's (stripped) bodies were shaped like a conversation, preserving the Interactions-drawer eligibility signal the dashboard otherwise sniffs from the bodies.
      - `data` AuditlogLogData
        - `api_key_hash` string
        - `attempts` AuditlogAttemptSnapshot[] — Attempts captures provider calls made for this logical request. SQL stores split this into audit_log_attempts; Mongo stores it embedded.
          - `duration_ns` integer
          - `error_code` string
          - `error_message` string
          - `error_type` string
          - `kind` string
          - `model` string
          - `provider_name` string
          - `provider_type` string
          - `response_body` unknown
          - `response_headers` object
          - `seq` integer
          - `started_at` string
          - `status_code` integer
          - `success` boolean
        - `error_code` string
        - `error_message` string — Error details (message can be long, so kept in JSON)
        - `failover` AuditlogFailoverSnapshot
          - `target_model` string
        - `labels` string[] — Labels are request labels extracted from configured tagging headers.
        - `max_tokens` integer
        - `request_body` unknown
        - `request_body_too_big_to_handle` boolean — Body capture status flags (set when body exceeds 1MB limit)
        - `request_headers` object — Optional headers (when LOGGING_LOG_HEADERS=true) Sensitive headers are auto-redacted
        - `request_revisions` AuditlogRequestRevisionSnapshot[] — RequestRevisions captures the ingress request-rewrite chain: one entry per registered rewriter that ran, in application order. Rewriters that changed the body carry the rewritten body; those that left it alone are recorded with NoChange so the audit trail still shows the step ran. RequestBody always remains the original client request; the last changed revision is what was forwarded downstream — when every rewriter was a no-op there is no such revision and the original body is what went upstream.
          - `body` unknown
          - `bytes_after` integer
          - `bytes_before` integer
          - `detail` unknown
          - `no_change` boolean — NoChange marks a rewriter that ran and left the body untouched. Such revisions record the step for operators — BytesAfter equals BytesBefore, Body is empty and TokensSaved is zero, though Detail may explain why nothing changed — but are not part of the chain that produced the forwarded request. Absent on entries written before no-change steps were tracked, which is why the flag is positive: an old revision always changed the body.
          - `rewriter` string
          - `seq` integer
          - `tokens_saved` integer — TokensSaved is the rewriter-reported estimate of prompt tokens this revision saved (e.g. token compression); zero when the rewriter does not report savings.
        - `response_body` unknown
        - `response_body_too_big_to_handle` boolean
        - `response_headers` object
        - `temperature` number — Request parameters
        - `user_agent` string — Identity
        - `workflow_features` AuditlogWorkflowFeaturesSnapshot
          - `audit` boolean
          - `budget` boolean
          - `cache` boolean
          - `failover` boolean
          - `guardrails` boolean
          - `usage` boolean
      - `duration_ns` integer — DurationNs is the request duration in nanoseconds
      - `error_type` string
      - `id` string — ID is a unique identifier for this log entry (UUID)
      - `method` string
      - `path` string
      - `provider` string — canonical provider type used for routing and filters
      - `provider_name` string
      - `request_id` string — Extracted fields for efficient filtering (indexed in relational DBs)
      - `requested_model` string — Core fields (indexed for queries)
      - `resolved_model` string
      - `session_id` string
      - `status_code` integer
      - `stream` boolean
      - `timestamp` string — Timestamp is when the request started
      - `usage` UsageRequestUsageSummary
        - `cache_write_input_tokens` integer
        - `cached_input_ratio` number
        - `cached_input_tokens` integer
        - `entries` integer
        - `estimated_cached_characters` integer
        - `input_tokens` integer
        - `output_tokens` integer
        - `rewrite_cost_saved` number
        - `rewrite_tokens_saved` integer
        - `total_tokens` integer
        - `uncached_input_tokens` integer
      - `user_path` string
      - `workflow_version_id` string
    - `session_id` string
  - `total` integer

## Other responses

- `400` — Bad Request
- `401` — Unauthorized

---

[API](https://skmtc.net/enterpilot/apis/gomodel-api.md) · [All operations](https://skmtc.net/enterpilot/apis/gomodel-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/enterpilot/gomodel-api/revisions/4c27ea61fcfe/schema)