List Graph Mutations

get/v1/graphs/{graph_id}/audit/mutations

Every call that changed this graph, newest first: REST operations, external MCP clients, and in-app AI operator runs. Each entry names the operation, the outcome, who made it and with which credential, and the objects it touched. Arguments are not stored, only their SHA-256 fingerprint. Requires graph admin.

Authentication

Authenticate in any one of these ways — not all of them:

API key in the X-API-Key header.
Bearer token in the Authorization header.

Path parameters

Name	Type	Description
`graph_id`required	string	Graph identifier Constraints: matches `^(kg[a-f0-9]{16,}(?:_[a-zA-Z0-9]{1,20})?\|sec(?:_[a-zA-Z0-9]{1,20})?\|library)$`

Query parameters

Name	Type	Description
`surface`optional	string	Only calls from this surface One of: `api`, `mcp`, `operator`
`operation_name`optional	string	Only this operation or MCP tool
`user_id`optional	string	Only calls made as this user
`operation_id`optional	string	Only calls from this REST operation or operator run
`since`optional	string (date-time)	Only calls at or after this time
`until`optional	string (date-time)	Only calls before this time
`cursor`optional	string	The `next_cursor` of the previous page
`limit`optional	integer	Entries per page Default: `50` Constraints: 1–200

Example request

curl

curl -X GET "https://api.robosystems.ai/v1/graphs/{graph_id}/audit/mutations" \
  -H "X-API-Key: $ROBOSYSTEMS_API_KEY"

Responses

200 Successful Response

Field Type Description

graph_idrequired string

entriesrequired

MutationAuditEntry[]

One mutating call on the graph.

MutationAuditEntry fields

Field	Type	Description
`id`required	string	Audit entry identifier
`occurred_at`required	string (date-time)	When the call finished
`surface`required	string	Where the call came from: 'api' for a REST operation, 'mcp' for an external MCP client, 'operator' for an in-app AI operator run such as the console's /do One of: `api`, `mcp`, `operator`
`operation_name`required	string	The operation or MCP tool that ran
`status`required	string	Whether the call succeeded; a failed call changed nothing it reports One of: `completed`, `failed`
`error_code`optional	string	Why a failed call failed
`duration_ms`required	number	How long the call took
`user_id`optional	string	The user the call ran as
`auth_method`optional	string	How the caller authenticated, for example 'api_key' or 'oauth'
`api_key_prefix`optional	string	The first characters of the API key used, when one was
`request_id`optional	string	The HTTP request that made the call
`operation_id`optional	string	The REST operation's envelope id, or the operator run's operation id: every write an operator run makes shares it
`operator_type`optional	string	The operator that made the call, for surface 'operator'
`arguments_fingerprint`optional	string	SHA-256 of the call's arguments. The arguments themselves are not stored
`object_ids`optional	string[]	Identifiers of the objects the call touched

next_cursoroptional

string

Pass as cursor for the next, older page; null on the last page

Status	Meaning
400	Invalid request
401	Authentication required
403	Access denied
404	Resource not found
422	Validation Error
429	Rate limit exceeded
500	Internal server error