List captured evaluation requests
Returns a paginated list of evaluation request entries captured from live credentials API traffic for the specified zone. Sorted by created_at descending (newest first). Use with the test evaluation endpoint for replay-based impact analysis.
Path parameters
The zone identifier
Query parameters
An opaque cursor used for paginating through a list of results
Cursor for forward pagination. Returned in Pagination.after_cursor. Mutually exclusive with before.
An opaque cursor used for paginating through a list of results
Cursor for backward pagination. Returned in Pagination.before_cursor. Mutually exclusive with after.
Maximum number of items to return per page.
Opt-in to additional response fields. Repeatable; matches the expand[] convention used across the Keycard API.
Field to sort by.
Sort direction. Default is desc (newest first).
Value shape for query[] and query[<field>] search parameters.
Wire conventions:
- Case-insensitive substring match (ILIKE).
- Repeated parameter instances are OR-ed across terms.
- Comma splitting is NOT performed; literal commas in a search term are preserved as part of the term.
Examples: ?query[name]=alpha&query[name]=beta -> name ILIKE %alpha% OR name ILIKE %beta% ?query[]=alpha -> any searchable field ILIKE %alpha%
Cross-field form is query[]; field-scoped form is query[<field>]. Field names are endpoint-specific; services declare each query parameter per operation.
Case-insensitive substring search on action. Repeatable; if multiple terms are supplied they are OR-ed.
Value shape for filter[<field>] query parameters.
Wire conventions:
- Repeated parameter instances are OR-ed across values.
- A single value containing comma-separated tokens is AND-ed across tokens.
Examples: ?filter[status]=a&filter[status]=b -> status in (a, b) ?filter[tag]=foo,bar -> tag contains foo AND bar ?filter[tag]=foo,bar&filter[tag]=baz -> (foo AND bar) OR baz
Field names and allowed values are endpoint-specific; services declare each filter[<field>] parameter per operation with an appropriate items.type/items.enum override.
Filter on active_decision. Repeatable; repeated instances OR across values. See FilterValues in the shared spec for the full wire convention.
Allowed values: allow, deny. Unknown values return 400 with the list of allowed values. Comma-separated single values are rejected with a 400 pointing at the repeated-parameter OR form.
Note: the allowed-value enum is enforced in the handler (not as an OpenAPI items.enum) so the server can return a targeted error for the comma-AND form instead of a generic "not in allowed values" response.
Value shape for filter[<field>] query parameters.
Wire conventions:
- Repeated parameter instances are OR-ed across values.
- A single value containing comma-separated tokens is AND-ed across tokens.
Examples: ?filter[status]=a&filter[status]=b -> status in (a, b) ?filter[tag]=foo,bar -> tag contains foo AND bar ?filter[tag]=foo,bar&filter[tag]=baz -> (foo AND bar) OR baz
Field names and allowed values are endpoint-specific; services declare each filter[<field>] parameter per operation with an appropriate items.type/items.enum override.
Filter on principal_type. Repeatable; repeated instances OR across values. See FilterValues in the shared spec for the full wire convention.
Allowed values: user, application. Unknown values return 400 with the list of allowed values. Comma-separated single values are rejected with a 400 pointing at the repeated-parameter OR form.
Note: the allowed-value enum is enforced in the handler (not as an OpenAPI items.enum) so the server can return a targeted error for the comma-AND form.
Value shape for filter[<field>] query parameters.
Wire conventions:
- Repeated parameter instances are OR-ed across values.
- A single value containing comma-separated tokens is AND-ed across tokens.
Examples: ?filter[status]=a&filter[status]=b -> status in (a, b) ?filter[tag]=foo,bar -> tag contains foo AND bar ?filter[tag]=foo,bar&filter[tag]=baz -> (foo AND bar) OR baz
Field names and allowed values are endpoint-specific; services declare each filter[<field>] parameter per operation with an appropriate items.type/items.enum override.
Filter on subject_type. Repeatable; repeated instances OR across values. See FilterValues in the shared spec for the full wire convention. Rows with NULL subject_type are excluded when this filter is present.
Allowed values: user, application. Unknown values return 400 with the list of allowed values. Comma-separated single values are rejected with a 400 pointing at the repeated-parameter OR form.
Note: the allowed-value enum is enforced in the handler.
Value shape for filter[<field>] query parameters.
Wire conventions:
- Repeated parameter instances are OR-ed across values.
- A single value containing comma-separated tokens is AND-ed across tokens.
Examples: ?filter[status]=a&filter[status]=b -> status in (a, b) ?filter[tag]=foo,bar -> tag contains foo AND bar ?filter[tag]=foo,bar&filter[tag]=baz -> (foo AND bar) OR baz
Field names and allowed values are endpoint-specific; services declare each filter[<field>] parameter per operation with an appropriate items.type/items.enum override.
Filter on authority_type. Repeatable; repeated instances OR across values. See FilterValues in the shared spec for the full wire convention. Rows with NULL authority_type are excluded when this filter is present.
Allowed values: delegation, impersonation. Unknown values return 400 with the list of allowed values. Comma-separated single values are rejected with a 400 pointing at the repeated-parameter OR form.
Note: the allowed-value enum is enforced in the handler.
Filter by shadow-evaluation presence. When true, returns only requests that had a shadow policy set version (shadow_psv_id IS NOT NULL). When false, returns only requests without one. Omit to return all.
Value shape for filter[<field>] query parameters.
Wire conventions:
- Repeated parameter instances are OR-ed across values.
- A single value containing comma-separated tokens is AND-ed across tokens.
Examples: ?filter[status]=a&filter[status]=b -> status in (a, b) ?filter[tag]=foo,bar -> tag contains foo AND bar ?filter[tag]=foo,bar&filter[tag]=baz -> (foo AND bar) OR baz
Field names and allowed values are endpoint-specific; services declare each filter[<field>] parameter per operation with an appropriate items.type/items.enum override.
Filter on principal_id by exact match. Repeatable; repeated instances OR across values. See FilterValues in the shared spec for the full wire convention. Comma-separated single values are rejected with a 400 pointing at the repeated-parameter OR form.
Value shape for filter[<field>] query parameters.
Wire conventions:
- Repeated parameter instances are OR-ed across values.
- A single value containing comma-separated tokens is AND-ed across tokens.
Examples: ?filter[status]=a&filter[status]=b -> status in (a, b) ?filter[tag]=foo,bar -> tag contains foo AND bar ?filter[tag]=foo,bar&filter[tag]=baz -> (foo AND bar) OR baz
Field names and allowed values are endpoint-specific; services declare each filter[<field>] parameter per operation with an appropriate items.type/items.enum override.
Filter on resource_id by exact match. Repeatable; repeated instances OR across values. See FilterValues in the shared spec for the full wire convention. Comma-separated single values are rejected with a 400 pointing at the repeated-parameter OR form.
Value shape for filter[<field>] query parameters.
Wire conventions:
- Repeated parameter instances are OR-ed across values.
- A single value containing comma-separated tokens is AND-ed across tokens.
Examples: ?filter[status]=a&filter[status]=b -> status in (a, b) ?filter[tag]=foo,bar -> tag contains foo AND bar ?filter[tag]=foo,bar&filter[tag]=baz -> (foo AND bar) OR baz
Field names and allowed values are endpoint-specific; services declare each filter[<field>] parameter per operation with an appropriate items.type/items.enum override.
Filter on subject_id by exact match. Repeatable; repeated instances OR across values. Rows with NULL subject_id are excluded when this filter is present. See FilterValues in the shared spec for the full wire convention.
Headers
API version header (date-based, e.g. 2026-02-01)
Unique request identifier specified by the originating caller and passed along by proxies.
Response
A paginated list of evaluation requests