Skip to content
SupaCloud Docs
Select themeSelect language

GET /api/governor/audit-reports — #1034: the WORKSPACE-WIDE governor audit reports (`agent_profile_id IS NULL`), the rows `run_weekly_audit_sweep` writes. Workspace-admin read, exactly like the per-profile `governor-audit` card beside it: it exposes aggregate quality metrics, not a mutation.

GET
/api/governor/audit-reports
curl --request GET \
  --url https://example.com/api/governor/audit-reports \
  --cookie supacloud_session=<supacloud_session>

Authorizations

Section titled “Authorizations”

Parameters

Section titled “Parameters”

Query Parameters

Section titled “Query Parameters”
limit
integer format: int64
offset
integer format: int64
include_facets
boolean

Recompute the verdict-source facet chips (default true).

Responses

Section titled “Responses”

200

Section titled “200”

One page of workspace-wide governor audit reports

Media typeapplication/json

GET /api/governor/audit-reports body — one page of workspace-wide governor audit reports + the total + the verdict-source facets.

object
facets
One of:
null
items
required
Array<object>

A persisted governor audit report projected for the read API (the agent-profile editor’s “Governor audit” card). Carries the audit window, the calibration kappa and the self-describing metrics blob (success rate, mean reward/cost, judge- trust verdict, quality score) so the FE renders the headline numbers without a second round trip. agent_profile_id is None on a workspace-wide audit.

object
agent_profile_id
string | null format: uuid
created_at
required
string format: date-time
id
required
string format: uuid
kappa

Cohen’s kappa of the LLM judge vs ground truth (None until enough calibration samples — the judge is then untrusted and the verdict is deterministic).

number | null format: float
metrics
required

The self-describing aggregate: sample_count, success_rate, mean_reward, mean_cost_usd, judge_trusted, quality_score, verdict_source. Runtime stays serde_json::Value; the spec types it as [GovernorAuditMetrics].

object
calibration_samples
integer | null format: int64
judge_trusted
boolean | null
mean_cost_usd
number | null format: double
mean_reward
number | null format: double
quality_score
number | null format: double
sample_count
integer | null format: int64
success_rate
number | null format: double
verdict_source
string | null
period_end
required
string format: date-time
period_start
required
string format: date-time
total
required
integer format: int64
Examplegenerated
{
  "facets": {
    "deterministic": 1,
    "judge": 1
  },
  "items": [
    {
      "agent_profile_id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
      "created_at": "2026-04-15T12:00:00Z",
      "id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
      "kappa": 1,
      "metrics": {
        "calibration_samples": 1,
        "judge_trusted": true,
        "mean_cost_usd": 1,
        "mean_reward": 1,
        "quality_score": 1,
        "sample_count": 1,
        "success_rate": 1,
        "verdict_source": "example"
      },
      "period_end": "2026-04-15T12:00:00Z",
      "period_start": "2026-04-15T12:00:00Z"
    }
  ],
  "total": 1
}

401

Section titled “401”

Authentication required

Media typeapplication/json

The canonical JSON body of every error response — the single source of truth the frontend binds to. Every AppError serializes as this exact shape, and the generated OpenAPI component ApiErrorBody (with its ErrorCode enum) is what the frontend error schema is generated from, so there is no hand-written error schema on either end.

object
code
required

Machine-readable, stable error code.

string
Allowed values: not_found unauthorized forbidden license_required license_expired bad_request unprocessable precondition_failed conflict method_not_allowed rate_limited too_many_requests quota_exceeded database_error docker_error vault_error internal_error
details
One of:
null
error
required

Human-readable message (the server’s English text; the client may localize by code).

string
Example
{
  "code": "not_found"
}

403

Section titled “403”

Permission denied

Media typeapplication/json

The canonical JSON body of every error response — the single source of truth the frontend binds to. Every AppError serializes as this exact shape, and the generated OpenAPI component ApiErrorBody (with its ErrorCode enum) is what the frontend error schema is generated from, so there is no hand-written error schema on either end.

object
code
required

Machine-readable, stable error code.

string
Allowed values: not_found unauthorized forbidden license_required license_expired bad_request unprocessable precondition_failed conflict method_not_allowed rate_limited too_many_requests quota_exceeded database_error docker_error vault_error internal_error
details
One of:
null
error
required

Human-readable message (the server’s English text; the client may localize by code).

string
Example
{
  "code": "not_found"
}

500

Section titled “500”

Structured server error

Media typeapplication/json

The canonical JSON body of every error response — the single source of truth the frontend binds to. Every AppError serializes as this exact shape, and the generated OpenAPI component ApiErrorBody (with its ErrorCode enum) is what the frontend error schema is generated from, so there is no hand-written error schema on either end.

object
code
required

Machine-readable, stable error code.

string
Allowed values: not_found unauthorized forbidden license_required license_expired bad_request unprocessable precondition_failed conflict method_not_allowed rate_limited too_many_requests quota_exceeded database_error docker_error vault_error internal_error
details
One of:
null
error
required

Human-readable message (the server’s English text; the client may localize by code).

string
Example
{
  "code": "not_found"
}