Search stored audit events (admin)

GET /fhir/AuditEvent · Admin API key required

Requires the root key, the admin role, or a credential with an explicit system/AuditEvent.read scope, . Read-only and immutable through the API. Answers 501 when audit storage is off. Events never contain request bodies, query strings, tokens, full IPs or (by default) patient references. Always needs a credential: the admin role (or root key) or an explicit `system/AuditEvent.read` scope. A wildcard `system/*` scope never covers AuditEvent.

Parameters

• date (query) - ge/le/gt/lt/eq prefix on recorded, e.g. ge2026-10-01; may be given twice for a range
• outcome (query)
• agent-name (query) - Label of the API key
• operation (query) - Filter by the audited route or operation name
• _count (query)
• _offset (query) - Number of events to skip, for paging. The Bundle's total is the full match count.

Responses

• 200 - FHIR searchset Bundle of AuditEvent
• 400 - FHIR OperationOutcome - bad date or outcome
• 401 - Credential required
• 403 - Credential lacks admin role or system/AuditEvent.read
• 501 - FHIR OperationOutcome (not-supported) - audit storage not enabled

Back to the API reference