Query Audit
query_auditQuery audit events by action, time, or target, and inspect consolidation lifecycle records with the source filter.
Instructions
Advanced audit query. source='events' queries action/time/target audit events (for normal users prefer memory_activity); source='consolidation' inspects consolidation/lifecycle/reflection audit records (admin). Consolidates the legacy query_audit_events/query_consolidation_audit tools.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum number of results to return. | |
| scope | No | Optional scope that narrows memory access; leave blank for the token default. | |
| since | No | Only include memories or activity on or after this ISO 8601 timestamp. | |
| until | No | Only include memories or activity on or before this ISO 8601 timestamp. | |
| action | No | Usage action or audit-event action filter, depending on the tool. | |
| bucket | No | Memory bucket or namespace to read from or write to; use % only for tools that support wildcard reads. | |
| offset | No | Number of matching records to skip for pagination. | |
| source | No | Optional source filter for system statistics. | events |
| target_id | No | Optional audit target ID to filter audit events. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |