> ## Documentation Index > Fetch the complete documentation index at: https://docs.domesystems.ai/llms.txt > Use this file to discover all available pages before exploring further. # Query Activity Chains > QueryActivityChains lists activity chains — groups of audit events that share one Correlation.activity_id within the caller's workspace scope. The grouping is a server-side group-by on activity_id over exactly the events QueryEvents would return for the same scope, so a chain summary can never reveal anything a workspace reader couldn't already see. Drill-in to a chain's events is QueryEvents with activity_id set. ## OpenAPI ````yaml GET /v1/audit/chains openapi: 3.0.3 info: title: Dome Platform API description: Connect and REST APIs for the Dome agent governance platform. version: 2.0.0 servers: - url: https://api.domesystems.ai description: Production security: [] tags: - name: Agents - name: Authorization - name: Guards - name: Tools - name: Tool Catalog - name: Models - name: Model Pools - name: Quotas - name: Gateways - name: Webhooks - name: Audit - name: Workspaces - name: Access Control - name: Tenants - name: Platform Keys - name: Enrollment - name: Platform - name: Identity paths: /v1/audit/chains: get: tags: - Audit description: |- QueryActivityChains lists activity chains — groups of audit events that share one Correlation.activity_id within the caller's workspace scope. The grouping is a server-side group-by on activity_id over exactly the events QueryEvents would return for the same scope, so a chain summary can never reveal anything a workspace reader couldn't already see. Drill-in to a chain's events is QueryEvents with activity_id set. operationId: Audit_QueryActivityChains parameters: - name: start_time in: query description: >- start_time / end_time bound the chains by event accepted_at. A chain is included when any of its events falls in the range; first_at/last_at in the summary reflect only the events within the range. schema: type: string format: date-time - name: end_time in: query schema: type: string format: date-time - name: page_size in: query description: >- page_size caps the number of chain summaries returned (server clamps). schema: type: integer format: int32 - name: page_token in: query description: |- page_token continues a previous QueryActivityChains call (cursor by last_at, activity_id descending). schema: type: string - name: workspace_id in: query description: >- workspace_id optionally narrows to a single workspace; same semantics as QueryEventsRequest.workspace_id (a scoping request, still permission-gated). schema: type: string - name: event_types in: query description: >- The filters below narrow the chains LIST to chains that CONTAIN at least one event matching them; per-chain counts/sets still reflect the FULL chain (all its events), and the drill-in (QueryEvents with activity_id) is unfiltered. Same field semantics as QueryEventsRequest. The per-event identity filters (trace_id / operation_id / event_id / parent_event_id) and payload_filters are intentionally not offered here — they identify a single event/request, not a chain. schema: type: array items: type: string - name: event_classes in: query schema: type: array items: type: integer format: enum - name: results in: query schema: type: array items: type: integer format: enum - name: agent_id in: query schema: type: string - name: agent_ids in: query schema: type: array items: type: string - name: actor_kind in: query schema: type: integer format: enum - name: actor_id in: query schema: type: string - name: producer_service in: query schema: type: string - name: request_surface in: query schema: type: integer format: enum - name: producer_gateway_id in: query description: See QueryEventsRequest.producer_gateway_id. schema: type: string - name: caller_surface in: query description: >- Caller application attribution; independent of request_surface transport. schema: type: integer format: enum responses: '200': description: OK content: application/json: schema: $ref: '#/components/schemas/QueryActivityChainsResponse' components: schemas: QueryActivityChainsResponse: type: object properties: chains: type: array items: $ref: '#/components/schemas/ActivityChainSummary' next_page_token: type: string ActivityChainSummary: type: object properties: activity_id: type: string description: >- activity_id is the raw/display id shared by the chain's events. It is the drill-in handle. Customer-provided when caller-asserted (see Correlation.activity_id) — safe inside the scope-gated audit UI. workspace_id: type: string description: |- workspace_id is the workspace the chain lives in (chains are workspace-scoped). event_count: type: string description: >- event_count is the number of events in the chain (within the time range). first_at: type: string description: >- first_at / last_at are the earliest and latest accepted_at across the chain's events (within the time range). format: date-time last_at: type: string format: date-time allowed_count: type: string description: >- Outcome rollup: event counts by result. Mirrors EventResult so the UI can render the same allowed/denied/filtered/error chips it uses elsewhere. denied_count: type: string filtered_count: type: string error_count: type: string agents: type: array items: type: string description: >- agents is a bounded set of distinct agent ids that appear on the chain's events (server-capped; not exhaustive when the cap is hit). event_types: type: array items: type: string description: |- event_types is a bounded set of distinct event types on the chain (server-capped). server_owned_count: type: string description: >- Trust breakdown: how many of the chain's events carry each activity_trust label. A chain can be mixed-trust (e.g. server-owned CP events + a caller-asserted gateway hop); the UI surfaces "anchored by N server-owned". caller_asserted_count: type: string description: |- ActivityChainSummary is the read-surface rollup for one activity chain (events sharing one Correlation.activity_id within a workspace), computed by a server-side group-by. Counts and sets are bounded server-side so the summary stays cheap; activity_id is the chain handle and the drill-in key (QueryEvents with activity_id set). ````