Query Activity Chains
QueryActivityChains lists activity chains — groups of audit events that share one Correlation.activity_id within the caller’s workspace scope. The grouping is a server-side group-by on activity_id over exactly the events QueryEvents would return for the same scope, so a chain summary can never reveal anything a workspace reader couldn’t already see. Drill-in to a chain’s events is QueryEvents with activity_id set.
Authorizations
Bearer authentication header of the form Bearer <token>, where <token> is your auth token.
Query Parameters
start_time / end_time bound the chains by event accepted_at. A chain is included when any of its events falls in the range; first_at/last_at in the summary reflect only the events within the range.
page_size caps the number of chain summaries returned (server clamps).
page_token continues a previous QueryActivityChains call (cursor by last_at, activity_id descending).
workspace_id optionally narrows to a single workspace; same semantics as QueryEventsRequest.workspace_id (a scoping request, still permission-gated).
The filters below narrow the chains LIST to chains that CONTAIN at least one event matching them; per-chain counts/sets still reflect the FULL chain (all its events), and the drill-in (QueryEvents with activity_id) is unfiltered. Same field semantics as QueryEventsRequest. The per-event identity filters (trace_id / operation_id / event_id / parent_event_id) and payload_filters are intentionally not offered here — they identify a single event/request, not a chain.
See QueryEventsRequest.producer_gateway_id.
Caller application attribution; independent of request_surface transport.