Skip to main content

List handled gate requests​

Returns one row per served gate request. Each row is the fully-hydrated GateRequestHandled_v1 event as stored, including per-plugin timings and per-round-trip HTTP metadata inline (no separate detail endpoint).

Default lookback when neither start_time nor end_time is provided is 24 hours — the endpoint is a high-volume activity log so the short default protects casual opens from scanning a full 30-day window. If only one bound is provided, the other is derived using the 24-hour default. Same 30-day cap applies when both bounds are provided.

Query Parameters
  • limit integer

    Possible values: <= 500

    The maximum number of items to return. Default 50.

  • offset integer

    The number of the first item to return.

  • start_time date-time

    RFC3339 timestamp. Inclusive lower bound on publish_time.

  • end_time date-time

    RFC3339 timestamp. Exclusive upper bound on publish_time.

  • filter string

    SCIM 2.0 filter over GET /gate/requests-handled.

    Top-level fields

    • event_id, analytics_correlation_id: identifier lookups.
    • method: exact-match HTTP method.
    • status_code: integer, supports ranges.
    • elapsed_seconds: number (seconds), supports ranges.
    • url: full string surface — eq/ne, sw/co/ew, and lexicographic gt/ge/lt/le.
    • otel_trace_id, otel_span_id, request_id: exact-match identifiers.
    • outcome: exact-match on the framework-derived outcome (allow / modify / reject / error).
    • instance_id, service_name, client_ip_address: identifier lookups.
    • request_length, response_length: integer bytes, support ranges.

    Sub-scopes

    target_round_trip.* — dotted access into the top-level target round-trip (method, url, status_code, request_length, response_length, elapsed_seconds). target_round_trip pr tests presence.

    plugins[...] — SCIM 2.0 value-path over the plugin array. Supported sub-attributes: plugin_index, plugin_id, plugin_type, outcome, elapsed_seconds. plugins pr tests non-emptiness.

    plugins.round_trips[...] — nested value-path over each plugin's HTTP round trips. Same six sub-attributes as target_round_trip.*. Written as a dotted parent (plugins.round_trips[…]) because the SCIM 2.0 filter parser used here doesn't implement RFC 7644's recursive value-paths; plugins[round_trips.status_code ge 500] produces the same result.

    plugins.reasons[...] — nested value-path over each plugin's reason list. Sub-attributes: code (exact-match), message (full string surface). plugins[reasons eq X] is short for plugins.reasons[code eq X] — code is the default sub-attribute.

    Supported operators

    • eq, ne: all scalar fields. Multi-value lookups: chain with or.
    • gt, ge, lt, le: numeric fields (status_code, elapsed_seconds, request_length, response_length, and their namesakes inside plugins[…] / round-trip sub-scopes) and lexicographic on full-string fields (url, message).
    • sw, co, ew: full-string fields (url, message).
    • pr: presence — scalars use IS NOT NULL; arrays use ARRAY_LENGTH > 0; structs use IS NOT NULL (plus a JSON-null guard on JSON-typed struct paths).

    Semantic notes

    plugins.plugin_type eq X and plugins[plugin_type eq X] compile to the same SQL (SCIM 2.0 multi-valued attribute semantics — "some plugin has plugin_type = X"). To match the same plugin across multiple predicates, use the bracketed form: plugins[plugin_type eq "opa" and outcome eq "reject"].

    Example: plugins[plugin_type eq "opa" and outcome eq "reject"]
Header Parameters
  • SlashID-OrgID string required

    The organization ID

    Example: af5fbd30-7ce7-4548-8b30-4cd59cb2aba1
Responses

OK

Schema
  • meta object
  • pagination object
  • limit integer
  • offset integer
  • total_count int64
  • cursor_pagination object

    Cursors are opaque. Follow the tokens the server returns; never construct, parse or modify one.

  • limit integer
  • next_cursor string

    Opaque token addressing the next page. Absent on the last page.

  • prev_cursor string

    Opaque token addressing the previous page. Absent on the first page.

  • last_cursor string

    Opaque token addressing the final page directly, so a client can jump to the end without a total count.

  • total_count int64

    Total number of matching items. Returned on the FIRST page only; clients cache it for the remainder of the walk.

  • errors object[]
  • httpcode integer
  • message string
  • code string

    Machine-readable reason, present only for errors that define one. Values today: unserved_org_region (the organization is homed in a region this deployment does not serve), wrong_region (the request must be sent to the organization's home region), region_route_missing (this instance has no route to the organization's home region).

  • result object[]
  • event_name string

    Possible values: [AuthenticationSucceeded_v1, AuthenticationFailed_v1, PersonCreated_v1, AnonymousPersonCreated_v1, PersonDeleted_v1, VirtualPageLoaded_v1, SlashIDSDKLoaded_v1, PersonIdentified_v1, PersonLoggedOut_v1, TokenMinted_v1, AnonymousTokenMinted_v1, PasswordChanged_v1, GdprConsentsChanged_v1, GateServerStarted_v1, GateRequestHandled_v1, GateHeartbeat_v1, PermissionCreated_InRegion_v1, PermissionCreated_v1, PermissionDeleted_InRegion_v1, PermissionDeleted_v1, RoleCreated_InRegion_v1, RoleCreated_v1, RoleDeleted_InRegion_v1, RoleDeleted_v1, RoleUpdated_InRegion_v1, RoleUpdated_v1, RolesSetToPerson_InRegion_v1, RolesSetToPerson_v1, PermissionsSetToPerson_InRegion_v1, PermissionsSetToPerson_v1, MitmAttackDetected_v1, PermissionUpdated_InRegion_v1, PermissionUpdated_v1, SuborganizationCreated_InRegion_v1, SuborganizationCreated_v1, OAuth2ClientCreated_InRegion_v1, OAuth2ClientCreated_v1, AWSIAMUserCreated_v1, AWSIAMRoleCreated_v1, AWSIAMRoleInlinePoliciesUpdated_v1, AWSIAMRoleManagedPoliciesUpdated_v1, AWSIAMRoleAssumeRolePolicyUpdated_v1, AWSIAMRolePermissionsBoundaryUpdated_v1, AWSIAMRoleDeleted_v1, GCPServiceAccountCreated_v1, GCPRoleCreated_v1, GCPIAMPolicyBindingUpdated_v1, GCPServiceAccountDeleted_v1, ActiveDirectorySPNCreated_v1, ActiveDirectorySPNRoleUpdated_v1, ActiveDirectorySPNDeleted_v1, ActiveDirectoryUserCreated_v1]

  • service_name string

    Human-readable service identity — the OpenTelemetry service.name attribute Gate also emits on traces and logs. Typically set by the operator to the deployment name (e.g. "gate-demo", "slashid-backend"); defaults to "gate".

  • instance_id uuid

    Stable UUID identifying a Gate installation across restarts. Generated on first boot and persisted to disk at monitoring.instance_id_file. When the file cannot be read or written, Gate falls back to the same UUID as analytics_correlation_id — so instance_id == analytics_correlation_id reliably signals "no persistent identity available".

  • start date-time

    Timestamp when the operation started

  • end date-time

    Timestamp when the operation ended

  • elapsed double

    Amount of time (in seconds) elapsed during the operation. Might be smaller than end-start (e.g., if the operation was paused)

  • method string

    Method of the HTTP Request

  • url string

    Target URL of the HTTP Request

  • status_code integer

    Status Code of the HTTP Response (-1 on I/O errors)

  • request_length int64

    Number of bytes transferred in the request body

  • response_length int64

    Number of bytes transferred in the response body

  • request_id uuid

    Gate-generated UUID that uniquely identifies this request within Gate's observability stream. Always populated. Distinct from otel_trace_id: the request_id is Gate's local handle for deduplication and lookup; otel_trace_id (when present) ties the request to the caller's distributed trace.

  • otel_trace_id string

    OpenTelemetry trace ID (32 lowercase hex characters) associated with this request. Populated from the current span's SpanContext when it is valid — either extracted from an incoming traceparent / Jaeger / Cloud Trace header, or synthesized locally when a tracing exporter is configured. Absent when no tracer provider is configured (the SDK's noop span yields an invalid SpanContext).

  • otel_span_id string

    OpenTelemetry span ID (16 lowercase hex characters) of the request-scoped span Gate created inside NewRequestObservability. Populated whenever otel_trace_id is populated.

  • outcome string

    Possible values: [allow, reject, modify, error]

    Describes what the plugin actually did to this request — not policy intent.

    • allow: plugin invoked next.ServeHTTP; request forwarded downstream unchanged.
    • modify: plugin invoked next.ServeHTTP but altered the request or response.
    • reject: plugin did NOT invoke next.ServeHTTP; short-circuited with its own response (rejection, redirect, cached response, UI response, etc.).
    • error: framework-emitted fallback. Plugins MUST NOT emit this.

    Monitoring/advisory-mode denials that let the request through use allow (that is what the plugin did) plus an advisory reason code (e.g., opa.policy_denied_advisory, ratelimit.exceeded_advisory).

  • target_round_trip object
  • start date-time

    Timestamp when the operation started

  • end date-time

    Timestamp when the operation ended

  • elapsed double

    Amount of time (in seconds) elapsed during the operation. Might be smaller than end-start (e.g., if the operation was paused)

  • method string

    Method of the HTTP Request

  • url string

    Target URL of the HTTP Request

  • status_code integer

    Status Code of the HTTP Response (-1 on I/O errors)

  • request_length int64

    Number of bytes transferred in the request body

  • response_length int64

    Number of bytes transferred in the response body

  • plugins object[]

    Timing and metadata information for all plugins used

  • start date-time

    Timestamp when the operation started

  • end date-time

    Timestamp when the operation ended

  • elapsed double

    Amount of time (in seconds) elapsed during the operation. Might be smaller than end-start (e.g., if the operation was paused)

  • plugin_index integer
  • plugin_id string
  • plugin_type string
  • outcome string

    Possible values: [allow, reject, modify, error]

    Describes what the plugin actually did to this request — not policy intent.

    • allow: plugin invoked next.ServeHTTP; request forwarded downstream unchanged.
    • modify: plugin invoked next.ServeHTTP but altered the request or response.
    • reject: plugin did NOT invoke next.ServeHTTP; short-circuited with its own response (rejection, redirect, cached response, UI response, etc.).
    • error: framework-emitted fallback. Plugins MUST NOT emit this.

    Monitoring/advisory-mode denials that let the request through use allow (that is what the plugin did) plus an advisory reason code (e.g., opa.policy_denied_advisory, ratelimit.exceeded_advisory).

  • reasons object[]
  • code string

    Possible values: [framework.plugin_missing_outcome, framework.plugin_double_outcome, framework.plugin_panic, opa.policy_allowed, opa.policy_denied, opa.policy_denied_advisory, opa.evaluation_failed, opa.input_build_failed, opa.body_read_failed, opa.result_unrecognized_shape, opa.trace_at, opa.input_hook_failed, ratelimit.allowed, ratelimit.throttled, ratelimit.exceeded, ratelimit.exceeded_advisory, ratelimit.limits_lookup_failed, ratelimit.check_failed, validate_jwt.token_present, validate_jwt.token_missing, validate_jwt.invalid_token, validate_jwt.token_expired, validate_jwt.groups_missing, validate_jwt.dependency_lookup_failed, validate_jwt.validation_skipped, validate_oauth2_token.token_present, validate_oauth2_token.token_missing, validate_oauth2_token.introspection_failed, validate_oauth2_token.token_inactive, validate_oauth2_token.scope_missing, validate_oauth2_token.claim_mismatch, request_oauth2_authenticator.token_injected, request_oauth2_authenticator.token_fetch_failed, token_exchange.token_exchanged, token_exchange.source_token_missing, token_exchange.exchange_failed, token_exchange.exchange_denied, token_translation_upgrade.token_upgraded, token_translation_upgrade.map_failed, token_translation_upgrade.mint_failed, token_translation_upgrade.no_match, token_translation_upgrade.custom_claims_filter_failed, token_translation_downgrade.token_downgraded, token_translation_downgrade.map_failed, token_translation_downgrade.mint_failed, token_translation_downgrade.no_match, token_translation_downgrade.token_missing, token_reminting.token_reminted, token_reminting.mint_failed, token_reminting.no_match, token_reminting.token_missing, token_reminting.token_invalid, anonymizer.body_anonymized, anonymizer.no_pii_detected, anonymizer.body_read_failed, tokenizer.body_tokenized, tokenizer.no_tokens_found, tokenizer.tokenizer_call_failed, mirroring.mirrored, mirroring.mirror_dispatch_failed, enforce_openapi_security.security_satisfied, enforce_openapi_security.security_failed, enforce_openapi_security.spec_not_found, enforce_openapi_security.security_scheme_not_supported, request_validator.request_valid, request_validator.request_invalid, request_validator.validator_call_failed, authentication_proxy.session_authenticated, authentication_proxy.session_missing, authentication_proxy.session_expired, authentication_proxy.login_flow, e2e_testing.injected, e2e_testing.no_op]

    Namespaced reason code. Namespace prefix (before the first .) is either framework for wrapper-emitted codes or the plugin_type for plugin-emitted codes. Enum-schema-gated so new codes require a schema PR. MUST BE KEPT IN SYNC with plugins/observability_reasons.go and each plugin's reason-code constants.

  • message string
  • details object

    Optional per-code diagnostic payload. Discriminated by code. Codes with no diagnostic payload have no variant declared here — absent variant means the details field is omitted on the wire.

    oneOf
  • code string

    Possible values: [framework.plugin_panic]

  • panic_value string

    fmt.Sprint of the recovered panic value.

  • stack string

    Runtime stack captured at panic time (may be truncated).

  • metadata object

    Optional per-plugin invariant per-invocation state. Discriminated by plugin_type. Plugins that don't opt into metadata have no variant here — absent variant means the field is omitted on the wire. Variants are added per-plugin as each plugin is retrofitted.

    oneOf
  • plugin_type string

    Possible values: [opa]

  • allowed boolean

    Boolean result of the OPA policy decision.

  • monitoring_mode boolean

    True iff the plugin was configured in monitoring mode. Distinguishes advisory vs. enforcement rejects.

  • decision_id string

    OPA decision ID for cross-referencing OPA logs (may be absent).

  • round_trips object[]

    HTTP requests executed by this plugin

  • start date-time

    Timestamp when the operation started

  • end date-time

    Timestamp when the operation ended

  • elapsed double

    Amount of time (in seconds) elapsed during the operation. Might be smaller than end-start (e.g., if the operation was paused)

  • method string

    Method of the HTTP Request

  • url string

    Target URL of the HTTP Request

  • status_code integer

    Status Code of the HTTP Response (-1 on I/O errors)

  • request_length int64

    Number of bytes transferred in the request body

  • response_length int64

    Number of bytes transferred in the response body

  • mcp object

    Parsed MCP / JSON-RPC view of the request. Present only when a plugin captured the request body AND the payload was JSON-RPC 2.0. Content is shaped by the operator's monitoring.mcp_visibility setting (none / method / tool / full), so a field being absent means either "not applicable to this call" or "the operator does not export it" — the two are deliberately indistinguishable to the reader.

  • method string

    JSON-RPC method, e.g. "tools/call". Absent for batches.

  • tool string

    MCP tool name for a single tools/call. Absent for batches.

  • resource_uri string

    URI for a single resources/read. Absent for batches.

  • prompt string

    Prompt name for a single prompts/get. Absent for batches.

  • is_batch boolean

    True when the payload carried multiple calls.

  • tools string[]

    Every tool named in the payload, batch or not. This is the field to read when asking "was tool X called" — the scalar tool is empty for batches by design, so that gate's batching cannot be used to slip a call past a scalar-keyed policy or a scalar-keyed UI filter.

  • calls object[]

    Per-call method and, subject to mcp_visibility, tool for EVERY call in the payload — batches included, where the scalar method/tool are absent by design.

    The scalar fields and the flat tools list cannot say WHICH tool was called with WHICH method in a batch, and a policy's correlated rules ("tool X and method Y on the same call") are defined over exactly that pairing. Without this, a recorded batch cannot be replayed against a draft policy and has to be reported as unevaluable rather than scored.

  • method string

    JSON-RPC method for this call, e.g. "tools/call".

  • tool string

    MCP tool name, when this call names one.

  • resource_uri string

    URI for a resources/read call, sanitized below mcp_visibility "full" exactly as the scalar resource_uri is.

  • prompt string

    Prompt name for a prompts/get call.

  • params object

    Raw JSON-RPC params. Emitted only under gate's mcp_visibility "full" — the only mode that ships request content. Arbitrary caller-controlled JSON: treat as untrusted data, never as markup.

  • truncated boolean

    True when params exceeded gate's monitoring.mcp_max_payload_bytes. The params field is omitted in that case rather than clipped, since clipping raw JSON mid-token yields an unparseable object.

  • subject object

    Who gate believes made the request, taken from the bearer token it found on the Authorization header or the configured cookie.

    Presence of this object means only "gate is new enough to report a subject" — it does NOT mean the request was authenticated. Read token_present for that. The four states are:

    token_present=false -> no credential was sent token_present=true, no subject -> a credential was sent that gate could not decode (opaque bearer, API key, malformed JWT) token_present=true, subject, verified=false -> claims decoded but NOT cryptographically checked token_present=true, subject, verified=true -> signature validated by a token-validating plugin

    The third state is the dangerous one and the reason claims_verified exists: gate's policy input decodes the token WITHOUT verifying its signature, so an unverified subject is a value the CALLER chose. Never render it as an established identity, and never let it drive an authorization or attribution decision on its own.

  • subject string

    The token's sub claim. For a SlashID-issued token this is the person ID; for a third-party IdP it is that IdP's own subject identifier, which is only meaningful together with issuer.

  • issuer string

    The token's iss claim. Required to interpret subject, which is unique only within an issuer — two IdPs can and do mint the same sub.

  • person_id string

    SlashID person ID, populated only when gate recognized the credential as a SlashID-issued token. Absent for third-party tokens: gate cannot map a foreign (issuer, subject) pair onto a SlashID person, so that resolution belongs to the reader.

  • claims_verified boolean

    True only when a token-validating plugin cryptographically checked this token's signature during THIS request. False means the claims were decoded and not verified — see the schema description.

  • token_present boolean

    Whether any credential was found on the request at all. Distinguishes an unauthenticated call from one whose credential gate could not decode; both otherwise present as an absent subject.

  • event_metadata object

    Metadata attached by the backend after ingest. A curated subset of common.EventMetadata from the proto plus one BQ-derived field (publish_time). source is omitted (always "Gate" for these events); event_type/event_name/event_version are already carried by the EventIdentifiers slice of the embedded ingress schema.

  • event_id uuid
  • timestamp string

    RFC3339Nano — client-set, when gate emitted the event.

  • publish_time date-time

    Pub/Sub ingest time, from the BigQuery table column. Not on the proto. Endpoints order by this field.

  • organization_id uuid
  • root_organization_id uuid
  • analytics_correlation_id uuid

    Per-gate-process identifier. Same value across every event emitted by one gate process (including its heartbeats); a new value on process restart.