dome audit

Command
Query	`dome audit query`
Stream	`dome audit stream`
Get	`dome audit get [event-id]`
Export	`dome audit export`
Chains	`dome audit chains`
Chain	`dome audit chain [activity-id]`

All commands scope the read to the active workspace (from dome config), so the server checks the workspace-level audit.view permission. Switch workspaces with dome workspace use <id> before running the command. Tenant- or org-scoped API keys with no workspace selected fall back to the tenant-level audit.view.

Query

dome audit query Query audit events with optional filters.

Flag	Type	Description
`--types`	string[]	Filter by event types
`--classes`	string[]	`governing`, `state_change`, `security`, `audit_access`
`--results`	string[]	`attempted`, `succeeded`, `denied`, `failed`, `filtered`, `noop`, `permitted`
`--agent-id`	string	Filter by agent ID
`--agent-ids`	string[]	Filter by agent IDs
`--primary-resource-id`	string	Filter by primary resource ID
`--primary-resource-kind`	string	Filter by primary resource kind
`--trace-id`	string	Filter by trace ID — events for one request
`--activity-id`	string	Filter by activity chain ID. Refer to Activity chains reference.
`--operation-id`	string	Filter by operation ID
`--parent-event-id`	string	Filter by parent event ID
`--actor-kind`	string	Filter by actor kind
`--actor-id`	string	Filter by actor ID
`--producer-service`	string	Filter by producer service
`--producer-gateway-id`	string	Filter by producer Gateway ID
`--request-surface`	string	Filter by request surface
`--caller-surface`	string	Filter by caller application surface
`--payload-filter`	string[]	`event.type:field` or `event.type:field=value` (repeatable). Refer to Payload filters reference.
`--since`	string	Start time (RFC3339)
`--until`	string	End time (RFC3339)
`--limit`	int32	Maximum results (default: 50)
`--page-token`	string	Cursor from a previous query
`--compact`	bool	Bounded investigation rows; use `audit get` for full payload

Stream

dome audit stream Stream audit events in real-time via SSE. Accepts the same filters as query except --limit and --compact.

Flag	Type	Description
`--types`	string[]	Filter by event types
`--classes`	string[]	Filter by event classes
`--results`	string[]	Filter by event results
`--agent-id`	string	Filter by agent ID
`--agent-ids`	string[]	Filter by agent IDs
`--primary-resource-id`	string	Filter by primary resource ID
`--primary-resource-kind`	string	Filter by primary resource kind
`--trace-id`	string	Filter by trace ID
`--activity-id`	string	Follow one activity chain live
`--operation-id`	string	Filter by operation ID
`--parent-event-id`	string	Filter by parent event ID
`--actor-kind`	string	Filter by actor kind
`--actor-id`	string	Filter by actor ID
`--producer-service`	string	Filter by producer service
`--producer-gateway-id`	string	Filter by producer Gateway ID
`--request-surface`	string	Filter by request surface
`--caller-surface`	string	Filter by caller application surface
`--payload-filter`	string[]	Payload filter (repeatable)
`--since`	string	Start time (RFC3339)
`--until`	string	End time (RFC3339)
`--page-token`	string	Cursor from a previous stream

Get

dome audit get [event-id] Get a single audit event by ID. Enum values — event class, result, actor kind, surface — render as short tokens (governing, denied, gateway_mcp) in both the table and --format json output, and the filter flags accept those same tokens. Refer to Enum rendering reference.

Export

dome audit export Export audit events in JSON-lines, JSON, OCSF, or CEF format. Pick the format your downstream pipeline expects:

Format	Output
`jsonl` (default)	One JSON object per line (NDJSON).
`json`	Single pretty-printed JSON array.
`ocsf`	OCSF v1.1.0 JSON array for Splunk, Sentinel, or Chronicle.
`cef`	Common Event Format lines for ArcSight, QRadar, or generic syslog.

Accepts the same filters as query, plus:

Flag	Type	Description
`--limit`	int32	Maximum results (default: 1000)
`--format`	string	`jsonl`, `json`, `csv`, `ocsf`, `cef` (default: `jsonl`)

# Export the last 24 hours as OCSF for a SIEM
dome audit export \
  --since 2026-05-26T00:00:00Z \
  --format ocsf > audit.ocsf.json

Chains

dome audit chains List activity chains in the active workspace. A chain is the set of audit events sharing one activity_id — a session, an LLM turn, a conversation thread, or a scripted run — computed at read time by grouping on activity_id within the workspace. A chain is listed when any of its events matches the filter. Per-chain counts always reflect the full chain. Drill into one chain’s events with dome audit chain <activity-id>. Refer to Activity chains reference for the model and trust labels.

Flag	Type	Description
`--types`	string[]	Chain contains an event of these types
`--classes`	string[]	Chain contains an event of these classes (`governing`, `state_change`, `security`, `audit_access`)
`--results`	string[]	Chain contains an event with these results (`attempted`, `succeeded`, `denied`, `failed`, `filtered`, `noop`, `permitted`)
`--agent-id`	string	Chain contains an event for this agent
`--agent-ids`	string[]	Chain contains an event for these agents
`--actor-kind`	string	Chain contains an event with this actor kind
`--actor-id`	string	Chain contains an event with this actor ID
`--producer-service`	string	Chain contains an event from this producer service
`--request-surface`	string	Chain contains an event from this request surface
`--since`	string	Start time (RFC3339)
`--until`	string	End time (RFC3339)
`--limit`	int32	Maximum chains (default: 50)
`--page-token`	string	Cursor from a previous chains query

Per-event identity filters (--trace-id, --operation-id, --parent-event-id) and payload filters identify a single event, not a chain, and are not offered here.

# Recent chains in the active workspace
dome audit chains --limit 20

# Chains that contain a denied governing event in the last day
dome audit chains \
  --classes governing \
  --results denied \
  --since 2026-06-05T00:00:00Z

Each row reports the chain’s activity_id, event count, last activity timestamp, outcome breakdown, trust label (server-owned, caller-asserted, or mixed — refer to Activity trust reference), and distinct event-type count.

Chain

dome audit chain [activity-id] Show one activity chain’s events in order. A drill-in into audit query filtered by activity_id. Accepts the same per-event filters as audit query to narrow the chain’s events further.

Flag	Type	Description
`--types`	string[]	Filter by event types
`--classes`	string[]	Filter by event classes
`--results`	string[]	Filter by event results
`--agent-id`	string	Filter by agent ID
`--actor-kind`	string	Filter by actor kind
`--actor-id`	string	Filter by actor ID
`--payload-filter`	string[]	Payload filter as `event.type:field` or `event.type:field=value` (repeatable)
`--since`	string	Start time (RFC3339)
`--until`	string	End time (RFC3339)
`--limit`	int32	Maximum events (default: 200)
`--page-token`	string	Cursor from a previous query

# Every event in one chain
dome audit chain case-12345

# Only the denied events in that chain
dome audit chain case-12345 --results denied

Emit events into a chain

Set --activity (or DOME_ACTIVITY_ID) on the root command to assert a stable activity ID. Every Connect RPC the run makes carries X-Dome-Activity-Id, so the audit events all share one activity_id and form one chain.

# One run, many commands, one chain.
export DOME_ACTIVITY_ID="case-12345"

dome agents register --name worker
dome rules deploy ./rules
dome audit query --limit 5

# Inspect the chain you just emitted.
dome audit chains --since 2026-06-05T00:00:00Z
dome audit chain case-12345

--activity overrides DOME_ACTIVITY_ID. The ID is opaque to Dome — pick whatever maps to your unit of work. The header is first-party only and is never forwarded to third-party LLM or MCP backends. The --activity emit flag (root command) and the --activity-id filter flag (audit reads) are distinct: one stamps events, the other selects them.

Overview

Connect

Govern

Operate

Settings

Developer

Session

Standalone

Query

Stream

Get

Export

Chains

Chain

Emit events into a chain

​Query

​Stream

​Get

​Export

​Chains

​Chain

​Emit events into a chain

Query

Stream

Get

Export

Chains

Chain

Emit events into a chain