Skip to content

Returns LLM fraud analysis events with pagination and filtering. Supports CSV export

GET
/api/events

Auto-generated from server.go. Handler: s.getEvents.

When the format=csv query parameter is supplied, the response is a streamed text/csv document with Content-Disposition: attachment — not a JSON body. The validator skips runtime body validation in that case via x-validation: skip (D-120). Schema below describes the default JSON branch.

format
string
default: json
Allowed values: json csv

Paginated list response (JSON) or CSV attachment when format=csv

Returns LLM fraud analysis events with pagination and filtering. When format=csv is set, the handler returns CSV instead of JSON; the CSV branch is annotated x-validation: skip in the path file (D-120) and does NOT use this schema.

Schema hand-written in Session 10. Required fields are the JSON keys the handler always emits in the JSON branch (EventItem with no omitempty tags on the JSON-encoder fields and an id field that is always present even when zero).

object
data
required
Array<object>
object
id
required

Analysis row id. The current handler does not scan id from ClickHouse so it is always zero on wire; the field is still emitted because EventItem has no omitempty tag.

integer
analysis_time
required

RFC3339 timestamp emitted by Go time.Time encoder. May carry a numeric offset (e.g. +02:00) rather than Z.

string
client_mac
required
string
fraud_type
required
integer
risk_score
required
number
requires_action
required
boolean
evidence
required

ClickHouse Array(String). May be empty array.

Array<string>
recommended_action
required
string
recommended_duration
required
integer
action_priority
required
string
action_executed
required
boolean
action_executed_at
required

RFC3339 timestamp string. Pre-migration the handler emitted *time.Time directly (so the zero value rendered as “1970-01-01T01:00:00+01:00” and a nil pointer rendered as JSON null). Post-migration the handler emits "" (empty string) for the nil-pointer case. Wireproof --shape (keys only) treats both as the same string-typed key.

string
action_expires_at
required

RFC3339 timestamp string. Empty string when no action is executed (was JSON null pre-migration). See action_executed_at note.

string
suspicion_reasons
required
Array<string>
total
required
integer
page
required
integer
totalPages
required
integer

Authentication is required or the supplied token is invalid.

Standardised error envelope per RFC 7807. Many existing endpoints still return an older shape (e.g. {"error": "..."}). This schema documents the target shape; legacy endpoints will be migrated in Phase 70. Per D-21 the spec describes current behaviour without enforcing the migration here.

object
type

A URI reference that identifies the problem type.

string format: uri-reference
default: about:blank
title

A short human-readable summary of the problem.

string
status

The HTTP status code generated by the origin server.

integer format: int32
>= 100 <= 599
detail

A human-readable explanation specific to this occurrence.

string
instance

A URI reference that identifies the specific occurrence.

string format: uri-reference
error

Legacy error message field. Will be removed once handlers are migrated.

string
details

Legacy per-field error details. Will be removed once handlers are migrated.

object
key
additional properties
string
requestId

The request id middleware-assigned identifier for tracing.

string

Result set too large for CSV export

Standardised error envelope per RFC 7807. Many existing endpoints still return an older shape (e.g. {"error": "..."}). This schema documents the target shape; legacy endpoints will be migrated in Phase 70. Per D-21 the spec describes current behaviour without enforcing the migration here.

object
type

A URI reference that identifies the problem type.

string format: uri-reference
default: about:blank
title

A short human-readable summary of the problem.

string
status

The HTTP status code generated by the origin server.

integer format: int32
>= 100 <= 599
detail

A human-readable explanation specific to this occurrence.

string
instance

A URI reference that identifies the specific occurrence.

string format: uri-reference
error

Legacy error message field. Will be removed once handlers are migrated.

string
details

Legacy per-field error details. Will be removed once handlers are migrated.

object
key
additional properties
string
requestId

The request id middleware-assigned identifier for tracing.

string

Internal server error

Standardised error envelope per RFC 7807. Many existing endpoints still return an older shape (e.g. {"error": "..."}). This schema documents the target shape; legacy endpoints will be migrated in Phase 70. Per D-21 the spec describes current behaviour without enforcing the migration here.

object
type

A URI reference that identifies the problem type.

string format: uri-reference
default: about:blank
title

A short human-readable summary of the problem.

string
status

The HTTP status code generated by the origin server.

integer format: int32
>= 100 <= 599
detail

A human-readable explanation specific to this occurrence.

string
instance

A URI reference that identifies the specific occurrence.

string format: uri-reference
error

Legacy error message field. Will be removed once handlers are migrated.

string
details

Legacy per-field error details. Will be removed once handlers are migrated.

object
key
additional properties
string
requestId

The request id middleware-assigned identifier for tracing.

string