docs(api): document audit events and fix the private key update path

- Add the OpenAPI attribute for GET /audit-events
- Document PATCH /security/keys/{uuid} with its uuid parameter instead
  of /security/keys
This commit is contained in:
Andras Bacsai
2026-10-05 21:24:20 +02:00
parent e11be922b4
commit 111ff9adae
5 changed files with 490 additions and 105 deletions
@@ -8,9 +8,80 @@ use Illuminate\Http\JsonResponse;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Validator;
use Illuminate\Validation\Rule;
use OpenApi\Attributes as OA;
class AuditEventsController extends Controller
{
#[OA\Get(
summary: 'List',
description: 'List audit events of the team. Only team admins and owners can view audit events. Actor e-mail, token, metadata, changes, IP address, and user agent are returned only for tokens with the read:sensitive or root permission.',
path: '/audit-events',
operationId: 'list-audit-events',
security: [
['bearerAuth' => []],
],
tags: ['Audit Events'],
parameters: [
new OA\Parameter(name: 'per_page', in: 'query', description: 'Items per page.', required: false, schema: new OA\Schema(type: 'integer', default: 25, minimum: 1, maximum: 100)),
new OA\Parameter(name: 'page', in: 'query', description: 'Page number.', required: false, schema: new OA\Schema(type: 'integer', default: 1, minimum: 1)),
new OA\Parameter(name: 'search', in: 'query', description: 'Search text.', required: false, schema: new OA\Schema(type: 'string', maxLength: 255)),
new OA\Parameter(name: 'action', in: 'query', description: 'Filter by action. Use all for every action.', required: false, schema: new OA\Schema(type: 'string', maxLength: 255)),
new OA\Parameter(name: 'source', in: 'query', description: 'Filter by source.', required: false, schema: new OA\Schema(type: 'string', enum: ['all', 'ui', 'api', 'mcp', 'webhook', 'system', 'scheduler'])),
],
responses: [
new OA\Response(
response: 200,
description: 'A page of audit events, newest first.',
content: [
new OA\MediaType(
mediaType: 'application/json',
schema: new OA\Schema(
type: 'object',
properties: [
'current_page' => ['type' => 'integer'],
'data' => [
'type' => 'array',
'items' => [
'type' => 'object',
'properties' => [
'id' => ['type' => 'integer'],
'team_id' => ['type' => 'integer', 'nullable' => true],
'event' => ['type' => 'string'],
'source' => ['type' => 'string'],
'action' => ['type' => 'string'],
'level' => ['type' => 'string'],
'actor_type' => ['type' => 'string', 'nullable' => true],
'actor_id' => ['type' => 'integer', 'nullable' => true],
'actor_name' => ['type' => 'string', 'nullable' => true],
'resource_type' => ['type' => 'string', 'nullable' => true],
'resource_uuid' => ['type' => 'string', 'nullable' => true],
'resource_name' => ['type' => 'string', 'nullable' => true],
'description' => ['type' => 'string', 'nullable' => true],
'created_at' => ['type' => 'string', 'format' => 'date-time'],
],
],
],
'per_page' => ['type' => 'integer'],
'last_page' => ['type' => 'integer'],
'total' => ['type' => 'integer'],
]
)
),
]),
new OA\Response(
response: 401,
ref: '#/components/responses/401',
),
new OA\Response(
response: 403,
description: 'Only team admins and owners can view audit logs.',
),
new OA\Response(
response: 422,
ref: '#/components/responses/422',
),
]
)]
public function index(Request $request): JsonResponse
{
$teamId = getTeamIdFromToken();
@@ -253,12 +253,15 @@ class SecurityController extends Controller
#[OA\Patch(
summary: 'Update',
description: 'Update a private key.',
path: '/security/keys',
path: '/security/keys/{uuid}',
operationId: 'update-private-key',
security: [
['bearerAuth' => []],
],
tags: ['Private Keys'],
parameters: [
new OA\Parameter(name: 'uuid', in: 'path', required: true, description: 'Private Key UUID', schema: new OA\Schema(type: 'string')),
],
requestBody: new OA\RequestBody(
required: true,
content: [
@@ -300,6 +303,10 @@ class SecurityController extends Controller
response: 400,
ref: '#/components/responses/400',
),
new OA\Response(
response: 404,
description: 'Private Key not found.',
),
new OA\Response(
response: 422,
ref: '#/components/responses/422',