> ## Documentation Index > Fetch the complete documentation index at: https://docs.openmail.sh/llms.txt > Use this file to discover all available pages before exploring further. # List correspondent policy audit events > Read the append-only audit trail for correspondent policy, newest first. Two kinds of event share one stream: `rule_added`, `rule_removed`, `mode_changed`, and `scope_deleted` record who moved the boundary and how (`scope_deleted` covers a pod or inbox being deleted, which cascade-deletes its policy — the row carries the modes and rules that were removed, so lifting a restriction by deleting its scope is not a silent operation). `send_rejected` and `inbound_rejected` record what the boundary refused: a send the outbound policy would not make, and inbound mail it would not accept. Both are deduped to one row per inbox + correspondent per hour, so neither a looping agent nor an outside sender can flood the trail. Rows are never updated or deleted. Requires an account-wide API key — pod- and inbox-scoped keys are rejected, so an agent cannot read, and therefore cannot reason about, the record of the boundary confining it. ## OpenAPI ````yaml /api-reference/openapi.json get /v1/policy/audit openapi: 3.0.3 info: title: OpenMail API description: >- Email infrastructure API for AI agents. Create inboxes, send and receive email, and get real-time notifications via webhooks. version: 1.0.0 license: name: Proprietary servers: - url: https://api.openmail.sh security: - bearerAuth: [] tags: - name: pods description: Isolated sub-accounts for your end users or tenants - name: inboxes description: Email inboxes and their webhook configuration - name: messages description: Sending and listing messages - name: threads description: Conversation threads and read status - name: attachments description: Downloading and extracting text from attachments - name: policy description: >- Correspondent policy — provider-enforced allow/block rules and allowlist mode, scoped per account, pod, or inbox. Account-wide key only. - name: feedback description: Reporting bugs, friction, and feature requests to the OpenMail team paths: /v1/policy/audit: get: tags: - policy summary: List correspondent policy audit events description: >- Read the append-only audit trail for correspondent policy, newest first. Two kinds of event share one stream: `rule_added`, `rule_removed`, `mode_changed`, and `scope_deleted` record who moved the boundary and how (`scope_deleted` covers a pod or inbox being deleted, which cascade-deletes its policy — the row carries the modes and rules that were removed, so lifting a restriction by deleting its scope is not a silent operation). `send_rejected` and `inbound_rejected` record what the boundary refused: a send the outbound policy would not make, and inbound mail it would not accept. Both are deduped to one row per inbox + correspondent per hour, so neither a looping agent nor an outside sender can flood the trail. Rows are never updated or deleted. Requires an account-wide API key — pod- and inbox-scoped keys are rejected, so an agent cannot read, and therefore cannot reason about, the record of the boundary confining it. operationId: getPolicyAudit parameters: - schema: type: string in: query name: podId required: false description: >- Confine the operation to one pod's policy. Accepts the pod ID. Mutually exclusive with `inboxId`. - schema: type: string in: query name: inboxId required: false description: >- Confine the operation to one inbox's policy. Mutually exclusive with `podId`. - schema: type: string in: query name: action required: false description: >- Comma-separated actions to include: `rule_added`, `rule_removed`, `mode_changed`, `scope_deleted`, `send_rejected`, `inbound_rejected`. Omit for all. - schema: type: string enum: - inbound - outbound in: query name: direction required: false description: >- `inbound` governs who may send to the inbox; `outbound` governs who the inbox may send to (enforced across To, Cc, and Reply-To on every send path). - schema: type: string in: query name: since required: false description: ISO-8601 timestamp. Only events at or after this time (inclusive). - schema: type: string in: query name: until required: false description: ISO-8601 timestamp. Only events strictly before this time. - schema: type: string in: query name: limit required: false description: Page size, 1–100. Defaults to 50. - schema: type: string in: query name: offset required: false description: Rows to skip. Defaults to 0. responses: '200': description: >- A page of audit events plus the unpaginated `total`. Each event carries its scope (with the pod name / inbox address resolved at read time, or null if since deleted), the acting console user where there was one, and an action-specific `detail` object: `type`/`valueType`/`value` for rule events, `from`/`to` for mode changes, and `rejectedRecipient`/`reason`/`matchedScope` for rejected sends. content: application/json: schema: description: >- A page of audit events plus the unpaginated `total`. Each event carries its scope (with the pod name / inbox address resolved at read time, or null if since deleted), the acting console user where there was one, and an action-specific `detail` object: `type`/`valueType`/`value` for rule events, `from`/`to` for mode changes, and `rejectedRecipient`/`reason`/`matchedScope` for rejected sends. type: object additionalProperties: true '400': description: >- An unknown `action`, or a `since`/`until` that is not a valid timestamp content: application/json: schema: description: >- An unknown `action`, or a `since`/`until` that is not a valid timestamp allOf: - $ref: '#/components/schemas/Error' '403': description: >- The authenticating key is scoped and cannot read the audit trail (`forbidden`) content: application/json: schema: description: >- The authenticating key is scoped and cannot read the audit trail (`forbidden`) allOf: - $ref: '#/components/schemas/Error' '404': description: Pod or inbox not found content: application/json: schema: description: Pod or inbox not found allOf: - $ref: '#/components/schemas/Error' components: schemas: Error: type: object additionalProperties: true properties: error: type: string message: type: string securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: API key ````