> ## Documentation Index > Fetch the complete documentation index at: https://conductorone-docs-terraform-v2-owner-resources.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. # List Traffic Events > ListTrafficEvents returns a page of audit events recorded for the Edges owned by app_id, newest first, for the app-scoped Edge "Traffic" UI. Returns an empty page (never an error) when the audit reader isn't configured in this environment, or when app_id has no Edges. ## OpenAPI ````yaml https://spec.speakeasy.com/conductor-one/conductorone/my-source-with-code-samples get /api/v1/apps/{app_id}/traffic-events openapi: 3.1.0 info: description: The C1 API is a HTTP API for managing C1 resources. title: C1 API version: 0.1.0-alpha servers: - description: The C1 API server for the current tenant. url: https://{tenantDomain}.conductor.one variables: tenantDomain: default: example description: The domain of the tenant to use for this request. security: - bearerAuth: [] oauth: [] paths: /api/v1/apps/{app_id}/traffic-events: get: tags: - Time Bandit Control Plane summary: List Traffic Events description: |- ListTrafficEvents returns a page of audit events recorded for the Edges owned by app_id, newest first, for the app-scoped Edge "Traffic" UI. Returns an empty page (never an error) when the audit reader isn't configured in this environment, or when app_id has no Edges. operationId: c1.api.tbcontrolplane.v1.TBControlPlaneService.ListTrafficEvents parameters: - in: path name: app_id required: true schema: description: The appId field. type: string - in: query name: page_size schema: description: The pageSize field. format: int32 type: integer - in: query name: page_token schema: description: The pageToken field. type: string - in: query name: since schema: description: >- Unix seconds (0 = unset). Defaults to 24h before `until`, bounded to 30 days back and must not be in the future -- enforced by the handler, not this field's validation, since apigw only query-binds primitives, not google.protobuf.Timestamp. format: int64 type: string - in: query name: until schema: description: >- Unix seconds (0 = unset). Defaults to now when unset. Must not be in the future -- enforced by the handler; see `since`. format: int64 type: string responses: '200': content: application/json: schema: $ref: >- #/components/schemas/c1.api.tbcontrolplane.v1.TBControlPlaneServiceListTrafficEventsResponse description: Successful response components: schemas: c1.api.tbcontrolplane.v1.TBControlPlaneServiceListTrafficEventsResponse: description: The TBControlPlaneServiceListTrafficEventsResponse message. properties: events: description: The events field. items: $ref: '#/components/schemas/c1.api.tbcontrolplane.v1.TBTrafficEvent' type: - array - 'null' nextPageToken: description: The nextPageToken field. type: string title: Tb Control Plane Service List Traffic Events Response type: object x-speakeasy-name-override: TBControlPlaneServiceListTrafficEventsResponse c1.api.tbcontrolplane.v1.TBTrafficEvent: description: >- TBTrafficEvent is a curated projection of one ClickHouse audit row -- only the columns the Traffic UI needs. dest_host/dest_port/request_authority (egress-shaped) and model_route/model_target/logical_model (LLM-shaped) are separate raw fields rather than one pre-formatted "target" string, since which fields apply depends on `capability` and that formatting choice belongs to the UI layer, not this API. properties: attemptOrdinal: description: >- One-based provider attempt; 0 on the listener-flow row. A retried call bills once per attempt. format: uint64 type: string cacheReadTokens: description: The cacheReadTokens field. format: uint64 type: string cacheWriteTokens: description: The cacheWriteTokens field. format: uint64 type: string callRole: description: >- answer | auxiliary. An auxiliary call bills on top of the answer call. type: string capability: description: The capability field. enum: - TB_TRAFFIC_CAPABILITY_UNSPECIFIED - TB_TRAFFIC_CAPABILITY_EGRESS - TB_TRAFFIC_CAPABILITY_LLM type: string x-speakeasy-unknown-values: allow configGeneration: description: |- Time Bandit's own sha256 content hash of its daemon config -- not an Edge/C1 policy generation. Set on LLM rows only; empty on every egress row. type: string costLookup: description: The costLookup field. enum: - TB_COST_LOOKUP_UNSPECIFIED - TB_COST_LOOKUP_PRICED - TB_COST_LOOKUP_UNPRICED - TB_COST_LOOKUP_UNMATCHED - TB_COST_LOOKUP_ROUTE type: string x-speakeasy-unknown-values: allow costNanoUsd: description: >- Computed on read from the token counts above via pkg/inferenceprice; 0 and not a real price unless cost_lookup is PRICED. format: int64 type: string counterLatencyMs: description: The counterLatencyMs field. format: uint64 type: string counterRequestBytes: description: The counterRequestBytes field. format: uint64 type: string counterResponseBytes: description: The counterResponseBytes field. format: uint64 type: string destHost: description: >- Egress-shaped destination fields; empty when capability is LLM and no egress connection underlies the call. type: string destPort: description: The destPort field. format: uint32 type: integer eventId: description: Deterministic over tenant+flow+event_time. type: string eventTime: format: date-time type: - string - 'null' federatedSession: oneOf: - $ref: '#/components/schemas/c1.api.tbcontrolplane.v1.TBFederatedSession' - type: 'null' flowId: description: The flowId field. type: string ingressEnforcementMode: description: enforce | ...; empty alongside ingress_scope. type: string ingressScope: description: |- The direct-listener scope this call authenticated through, e.g. "squire-idjag-llm"; empty on capture/legacy ingress with no listener scope. type: string inputTokens: description: >- LLM token counts; zero on egress rows and on a listener-flow row that never reached a provider (see attempt_ordinal). format: uint64 type: string logicalModel: description: The logicalModel field. type: string modelName: description: >- The provider-native served model, e.g. "claude-opus-5" -- what cost is priced against. logical_model is only the caller-facing alias. type: string modelRoute: description: LLM-shaped fields; empty when capability is EGRESS. type: string modelTarget: description: The modelTarget field. type: string observationStatus: description: |- observed | over_limit | malformed. Anything but "observed" means the audit body wasn't fully parsed, so the token counts above are a floor, not a total. type: string outcome: description: The outcome field. enum: - TB_TRAFFIC_OUTCOME_UNSPECIFIED - TB_TRAFFIC_OUTCOME_ALLOWED - TB_TRAFFIC_OUTCOME_DENIED type: string x-speakeasy-unknown-values: allow outputTokens: description: The outputTokens field. format: uint64 type: string principalUserId: description: |- The C1 user id source_principal resolves to, when it's an OIDC principal whose subject is a real C1 user; empty for a service/agent principal or one c1 couldn't resolve to a user. type: string requestAuthority: description: The requestAuthority field. type: string routingRunId: description: >- Joins the listener-flow row and its provider-attempt child row -- one LLM request writes both; empty on non-LLM rows. type: string sourceConfidence: description: A | B | C | D | "" (unresolved). type: string sourcePrincipal: description: |- Caller identity. source_principal_kind and source_confidence qualify how source_principal was resolved (see AuditSource in the TB sink). type: string sourcePrincipalKind: description: The sourcePrincipalKind field. type: string verdictFromFallback: description: >- True when this row's verdict is the fail-closed default rather than an explicit rule match, so an empty verdict_reasons isn't a missing-data gap. type: boolean verdictReasons: description: >- Why `outcome` resolved as it did. Can be legitimately empty even on a DENY -- see verdict_from_fallback. items: type: string type: - array - 'null' verdictResolvedRaw: description: The verdictResolvedRaw field. type: string title: Tb Traffic Event type: object x-speakeasy-name-override: TBTrafficEvent c1.api.tbcontrolplane.v1.TBFederatedSession: description: >- TBFederatedSession is TB's secret-free hosted OAuth session lineage for a cryptographically attested call (see AuditFederatedSession in the TB sink). grant_jti_hash and proof_key_thumbprint are a hash and a public key thumbprint, not secrets. properties: clientId: description: The clientId field. type: string grantJtiHash: description: The grantJtiHash field. type: string issuerName: description: The issuerName field. type: string proofKeyThumbprint: description: The proofKeyThumbprint field. type: string resource: description: The resource field. type: string scopes: description: The scopes field. items: type: string type: - array - 'null' sessionId: description: The sessionId field. type: string tenantId: description: The tenantId field. type: string title: Tb Federated Session type: object x-speakeasy-name-override: TBFederatedSession securitySchemes: bearerAuth: scheme: bearer type: http oauth: description: >- This API uses OAuth2 with the Client Credential flow. Client Credentials must be sent in the BODY, not the headers. For an example of how to implement this, refer to the [c1TokenSource.Token()](https://github.com/ConductorOne/conductorone-sdk-go/blob/3375fe7c0126d17e7ec4e711693dee7b791023aa/token_source.go#L101-L187) function. flows: clientCredentials: scopes: {} tokenUrl: /auth/v1/token type: oauth2 ````