List actions

GET

/v1/actions

const url = 'http://127.0.0.1:8080/v1/actions?shadow_differs=true';
const options = {
  method: 'GET',
  headers: {'Deedglass-Version': '2026-10-01', Authorization: 'Bearer <token>'}
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request GET \
  --url 'http://127.0.0.1:8080/v1/actions?shadow_differs=true' \
  --header 'Authorization: Bearer <token>' \
  --header 'Deedglass-Version: 2026-10-01'

Newest first, ordered by (created_at, id) descending, so rows added while you page only appear on a fresh first page. Filters combine with AND; list filters take a comma list (verdict=MISMATCH,UNVERIFIABLE). Unknown parameters are refused. A cursor is bound to the filters it was issued with: reuse it with different filters and the answer is 400 validation_failed on cursor. Requires actions:read (viewer and up).

Authorizations

bearerAuth
sessionCookie

Parameters

Header Parameters

Deedglass-Version

string

/^[0-9]{4}-[0-9]{2}-[0-9]{2}$/

The API version (YYYY-MM-DD). Leave it out to use your org’s pinned version (public routes use the latest). An unknown version is 400 api_version_invalid.

Query Parameters

agent

string

/^agt_[0-7][0-9a-hjkmnp-tv-z]{25}$/

An agent id (agt_…).

tool

string

<= 200 characters

A tool name, exact or a glob with * (stripe.*, *.execute); at most 200 bytes and three *.

state

string

A comma list of lifecycle states (contract §5).

decision

string

A comma list of allow, deny, require_approval.

verdict

string

A comma list of VERIFIED, MISMATCH, UNVERIFIABLE.

level

string

A comma list of L0, L1, L2.

on_behalf_of

string

<= 256 characters

The exact on-behalf-of reference.

created_at[gte]

string format: date-time

RFC 3339; inclusive.

created_at[lt]

string format: date-time

RFC 3339; exclusive.

string

>= 2 characters <= 64 characters

Text to find in the tool name or the error code (2 to 64 characters).

shadow_differs

string

Allowed values: true

Only true (S26): actions whose shadow policy decided, and decided differently from the enforced decision. Any other value is 400 validation_failed.

limit

integer

>= 1 <= 100

Page size, 1–100 (default 25).

cursor

string

next_cursor from the previous page, unchanged.

Responses

200

One page of actions.

application/json

object

object

required

string

Allowed value: list

data

required

Array<object>

One agent action. Its sections mirror the deed’s. status is the one field an agent needs; state is the exact lifecycle state (docs/GATE.md). The Gate’s own responses (POST /v1/actions and its result report) add execution.result and witness.reasons; lists leave both out. The full Action schema is in openapi.yaml.

object

has_more

required

boolean

next_cursor

required

string | null

Example

{
  "object": "list"
}

Headers

Deedglass-Request-Id

string

/^req_[0-7][0-9a-hjkmnp-tv-z]{25}$/

This request’s id. Quote it to support; it matches error.request_id.

Deedglass-Version

string

The API version this response follows.

default

An error. Every error has this envelope; doc_url explains the code.

application/json

object

error

required

object

type

required

string

Allowed values: invalid_request_error authentication_error permission_error policy_error rate_limit_error api_error

code

required

string

Allowed values: invalid_api_key api_key_revoked api_key_expired agent_suspended agent_stopped org_stopped insufficient_scope policy_denied approval_required approval_expired budget_exceeded intent_required intent_invalid intent_replay tool_unknown connector_unavailable upstream_error timeout rate_limited idempotency_conflict validation_failed not_found conflict internal_error authentication_required method_not_allowed request_too_large unsupported_media_type invalid_json api_version_invalid idempotency_key_invalid idempotency_key_in_use service_unavailable session_expired csrf_failed insufficient_role login_link_invalid login_code_invalid last_owner policy_unavailable policy_invalid credentials_missing destination_blocked vault_unavailable upstream_auth_failed upstream_not_found upstream_rate_limited response_too_large statement_refused row_limit_exceeded database_role_unsafe database_not_ready witness_not_configured approval_decided already_countersigned approver_not_eligible self_approval approval_needs_person context_changed approval_unsatisfiable approval_link_invalid approval_link_review_only approver_unmapped stripe_live_key_refused stripe_livemode_detected upstream_approval_pending schedule_needs_approval action_executing from_denied undo_unavailable undo_plan_stale already_undone undo_conflict replay_too_large replay_window_invalid suggestion_stale shadow_slot_taken suggestion_decided observe_not_enabled pro_required

message

required

One or more calm sentences with the next step.

string

param

required

The request field, query parameter or header the error is about.

string | null

request_id

required

string

/^req_[0-7][0-9a-hjkmnp-tv-z]{25}$/

doc_url

required

string format: uri

diagnostics

On policy_invalid only. Each problem with its line, code and hint.

Array<object>

One finding about a policy file, with its position and the next step. Codes are stable and listed in docs/POLICY_ERRORS.md. In the policy_invalid error envelope each diagnostic also carries object: policy_diagnostic. The full PolicyDiagnostic schema is in openapi.yaml.

object

action

object

checks

On undo_unavailable only. Every check of the undo, each with its fix. Additive (S23).

Array<object>

One of the twelve safety checks (S23 §3.3). Available means no check failed. The full UndoCheck schema is in openapi.yaml.

object

Example

{
  "error": {
    "type": "invalid_request_error",
    "code": "not_found",
    "message": "There's no endpoint at GET /v1/helth. Did you mean /v1/health?",
    "param": null,
    "request_id": "req_01j9zr3m5k8q2w7x4t6v0b1c9d",
    "doc_url": "https://docs.deedglass.com/errors/not_found"
  }
}

Headers

Deedglass-Request-Id

string

/^req_[0-7][0-9a-hjkmnp-tv-z]{25}$/

This request’s id. Quote it to support; it matches error.request_id.

Deedglass-Version

string

The API version this response follows.