GET
/
api
/
v1
/
events
{
  "nodes": [
    {
      "id": "evt_xyz123",
      "kind": "network_connection",
      "timestamp": "2025-09-29T10:23:45Z",
      "agent_id": "agent_abc",
      "metadata": {
        "destination": "malicious.example.com",
        "destination_ip": "192.0.2.1",
        "port": 443
      },
      "verdict": "blocked"
    }
  ],
  "pageInfo": {
    "hasNextPage": true,
    "endCursor": "cursor123"
  }
}
Retrieves a paginated list of V2 events for the authenticated user’s project. Supports filtering by agent ID, ashkaal kind, metadata names, and Kubernetes context fields.
Requires Bearer token authentication

​
Query Parameters

​
filter.agent_id
string
Filter events by agent ID
​
filter.kind
string
Filter events by ashkaal kind (e.g., “network_connection”, “process_execution”)
​
filter.metadata.name
array
Filter events by metadata name. Multiple values can be provided
​
filter.cluster
string
Filter events by Kubernetes cluster name
​
filter.namespace
string
Filter events by Kubernetes namespace
​
filter.node
string
Filter events by Kubernetes node name
​
sort.field
string
default:"created_at"
Field to sort by
​
sort.order
string
default:"desc"
Sort order: “asc” or “desc”
​
first
integer
Number of items to return (forward pagination)
​
after
string
Cursor for forward pagination

​
Example

curl -H "Authorization: Bearer $GARNET_API_TOKEN" \
  "https://api.garnet.ai/v1/events?filter.cluster=production&sort.order=desc&first=50"

​
Response

​
nodes
array
List of event objects in V2 ashkaal format
​
pageInfo
object
Pagination information with cursors
{
  "nodes": [
    {
      "id": "evt_xyz123",
      "kind": "network_connection",
      "timestamp": "2025-09-29T10:23:45Z",
      "agent_id": "agent_abc",
      "metadata": {
        "destination": "malicious.example.com",
        "destination_ip": "192.0.2.1",
        "port": 443
      },
      "verdict": "blocked"
    }
  ],
  "pageInfo": {
    "hasNextPage": true,
    "endCursor": "cursor123"
  }
}