> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nx1cloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Search one audit stream

> Search a stream with field-aware filters.

Each filter is `{field, operator, value}`, validated against that
stream's catalogue. An unknown field or an operator that cannot apply
to the field's type is rejected with a 400 naming what would have
worked — filters are never silently dropped.

Time bounds apply to the stream's own time field, which is not
`@timestamp` for Ranger. Free text matches only the stream's text
fields, since keyword fields are unanalysed and a substring query
against them matches nothing.

**Required roles**: `nx1_audit_viewer`



## OpenAPI

````yaml post /api/audit/search
openapi: 3.1.0
info:
  title: Nx1 AI API
  description: |

    AI API for Nx1 Data Platform Management and Automated Data Tasks.

    Authentication is required via PSK in Authorization header.

    Default PSK is | [ask a friend] |
  version: 0.10.2
servers: []
security: []
paths:
  /api/audit/search:
    post:
      tags:
        - Audit
      summary: Search one audit stream
      description: |-
        Search a stream with field-aware filters.

        Each filter is `{field, operator, value}`, validated against that
        stream's catalogue. An unknown field or an operator that cannot apply
        to the field's type is rejected with a 400 naming what would have
        worked — filters are never silently dropped.

        Time bounds apply to the stream's own time field, which is not
        `@timestamp` for Ranger. Free text matches only the stream's text
        fields, since keyword fields are unanalysed and a substring query
        against them matches nothing.

        **Required roles**: `nx1_audit_viewer`
      operationId: search_api_audit_search_post
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AuditSearchRequest'
        required: true
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuditSearchResponse'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
        '502':
          description: Bad Gateway
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '503':
          description: Service Unavailable
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
        - OAuth2AuthorizationCodeBearer: []
        - APIKeyHeader: []
components:
  schemas:
    AuditSearchRequest:
      properties:
        source:
          type: string
          title: Source
          description: '`ranger`, `api` or `decisions`.'
        filters:
          items:
            $ref: '#/components/schemas/AuditFilter'
          type: array
          title: Filters
        start:
          anyOf:
            - type: string
            - type: 'null'
          title: Start
          description: ISO-8601 lower bound, inclusive.
        end:
          anyOf:
            - type: string
            - type: 'null'
          title: End
          description: ISO-8601 upper bound, inclusive.
        text:
          anyOf:
            - type: string
            - type: 'null'
          title: Text
          description: Free text, matched across this stream's text fields only.
        limit:
          type: integer
          maximum: 500
          minimum: 1
          title: Limit
          default: 50
        offset:
          type: integer
          minimum: 0
          title: Offset
          default: 0
      type: object
      required:
        - source
      title: AuditSearchRequest
    AuditSearchResponse:
      properties:
        source:
          type: string
          title: Source
        total:
          type: integer
          title: Total
        events:
          items:
            additionalProperties: true
            type: object
          type: array
          title: Events
        time_field:
          type: string
          title: Time Field
      type: object
      required:
        - source
        - total
        - events
        - time_field
      title: AuditSearchResponse
    ErrorResponse:
      properties:
        error:
          type: string
          title: Error
          description: A brief description of the error that occurred.
        code:
          type: integer
          title: Code
          description: The HTTP status code associated with the error.
          default: 500
      type: object
      required:
        - error
      title: ErrorResponse
    HTTPValidationError:
      properties:
        detail:
          items:
            $ref: '#/components/schemas/ValidationError'
          type: array
          title: Detail
      type: object
      title: HTTPValidationError
    AuditFilter:
      properties:
        field:
          type: string
          title: Field
          description: Field name from the stream's catalogue.
        operator:
          type: string
          title: Operator
          description: Comparison to apply.
          default: is
        value:
          title: Value
          description: Value to compare against; unused by `exists`.
      type: object
      required:
        - field
      title: AuditFilter
    ValidationError:
      properties:
        loc:
          items:
            anyOf:
              - type: string
              - type: integer
          type: array
          title: Location
        msg:
          type: string
          title: Message
        type:
          type: string
          title: Error Type
        input:
          title: Input
        ctx:
          type: object
          title: Context
      type: object
      required:
        - loc
        - msg
        - type
      title: ValidationError
  securitySchemes:
    OAuth2AuthorizationCodeBearer:
      type: oauth2
      flows:
        authorizationCode:
          scopes: {}
          authorizationUrl: >-
            https://sso-rapid.rapid.nx1cloud.com/realms/rapid/protocol/openid-connect/auth
          tokenUrl: >-
            https://sso-rapid.rapid.nx1cloud.com/realms/rapid/protocol/openid-connect/token
    APIKeyHeader:
      type: apiKey
      in: header
      name: Authorization-PSK

````