Skip to main content

verdictan events

verdictan events examines recent governance events and exports event evidence from the Verdictan control plane.

The two subcommands must use API authentication. Set VERDICTAN_API_TOKEN. Alternatively, sign in before you run them. Event queries must use events:read. Event exports must use events:export.

verdictan events tail​

Use a single query for recent events. Use follow mode to poll for new events.

Usage​

verdictan events tail [OPTIONS]

Options​

FlagDescription
--jsonPrint JSON output as an alternative to terminal summaries.
--since <duration|rfc3339>Start the query at a relative duration like 10m, 2h, 7d, or an RFC3339 timestamp.
--cursor <cursor>Resume from a cursor returned by a previous call.
--limit <n>Maximum number of events to request (default: 100).
--event-type <type>Filter by event type such as decision.
--gateway-id <id>Filter by gateway identifier.
--verdict <verdict>Filter by allowed, blocked, redacted, or escalated.
--followPoll for new events continuously.
--follow-interval-secs <n>Poll interval for follow mode (default: 5).
--config <path>, --api-url <url>, --profile <name>, --region <region>Standard connection and profile overrides. Use VERDICTAN_API_TOKEN or a stored profile for authentication.

Examples​

# Last 5 minutes of events
verdictan events tail --since 5m

# Blocked events in the last hour, as JSON
verdictan events tail --since 1h --verdict blocked --json

# Follow one gateway and print each new event as JSON
verdictan events tail --gateway-id gw_prod_eu --follow --json

Output modes​

  <event-time> decision   blocked    model=<model> policy=<policy>

If the queried page is empty, the command prints No events found. in plain-text mode.

Non-follow --json prints the full API response object. The object includes the event array and the next cursor, if available. In follow mode, the CLI updates the cursor between polls and prints each new event. --follow does not change the output format. Add --json for one JSON object for each event.

verdictan events export​

Export event data to stdout in one of the supported formats.

Usage​

verdictan events export --since <duration|rfc3339> --format <csv|json> [OPTIONS]

Options​

FlagDescription
--since <duration|rfc3339>Mandatory export window start. Relative values use an integer followed by m, h, d, or w.
--format <csv|json>Export format implemented by the Events API.
--config <path>, --api-url <url>, --profile <name>, --region <region>Standard connection and profile overrides. Use VERDICTAN_API_TOKEN or a stored profile for authentication.

The command writes raw export bytes to stdout. Redirect the output to a file when you want a saved artifact.

Examples​

# Export the last 7 days as CSV
verdictan events export --since 7d --format csv > events-7d.csv

# Export the last 24 hours as structured JSON
verdictan events export --since 24h --format json > events-24h.json

Next steps​