# Audit API

Audit log. 1 operation under /api/v1. Errors are RFC 9457 problem+json with a stable `code` field. The complete schemas are in https://nebulactrl.com/api/v1/openapi.json.

## GET /audit-events

List audit events, newest first

Requires the admin scope (browser sessions hold every scope). Filter by `projectId`, `resourceId` and `type` (an action prefix).

Authentication: session cookie or `Authorization: Bearer nct_…` token.

Parameters:
- `cursor` (query, string): Opaque cursor from a previous page's nextCursor
- `limit` (query, integer (int64)): Page size (default 50, max 200)
- `projectId` (query, string (uuid)): Only events of this project
- `resourceId` (query, string): Only events about this resource (service, deployment, …)
- `type` (query, string): Action prefix, e.g. deployment. or variable.set

Response 200: OK (PageAuditEvent)
  - `items` (AuditEvent[] | null, required)
  - `nextCursor` (string): Present when more items exist
Errors: 401 Unauthorized; 403 Forbidden; 422 Unprocessable Entity; 500 Internal Server Error