> ## Documentation Index > Fetch the complete documentation index at: https://docs.celum.io/llms.txt > Use this file to discover all available pages before exploring further. # Flow l7 events > The L7 event log — what an edge click opens. Its absence was the one gap a **Authorisation:** `security:Read` on `krn:celum:supervisor:{name}:project:{project}:security:*`. **Assistant tool:** `get_project_l7` ## OpenAPI ````yaml /openapi.json get /api/supervisors/{name}/projects/{project}/security/flows/l7-events openapi: 3.0.3 info: description: >- The HTTP surface of the Celum backend, generated from its own router and authorisation map — so this list cannot drift from the server that serves it. **Every operation states the IAM action and resource it is authorised against.** That pairing is the part worth reading: a policy naming the right action against the wrong resource matches nothing, and fails silently. Request and response bodies come from the Go types the handlers send and decode. Where those types do not determine the shape (an interface, a map[string]any, an unknown custom encoding), the operation says so in `x-celum-schema-gap` instead of carrying a guessed schema. title: Celum API version: 1.0.0 servers: - description: Your Celum deployment url: https://{host} variables: host: default: celum.example.com description: The host your Celum backend is served from security: - sessionCookie: [] - bearerToken: [] tags: - description: AI assistant & MCP name: ai-assistant - description: Clusters & CAPI lifecycle name: capi - description: Certificates & external secrets name: certs - description: GitOps & apps name: gitops - description: IAM, audit & auth name: iam - description: Image library name: images - description: Infrastructure & supervisors name: infrastructure - description: Networking name: networking - description: Observability & platform health name: observability - description: Platform onboarding & settings name: platform-settings - description: Projects name: projects - description: Registries & mirroring name: registries - description: Security & flows name: security - description: Storage name: storage - description: Templates & addons name: templates - description: Virtualization platform (KubeVirt/CDI) name: virt - description: Virtual machines name: vms - description: Workloads & topology name: workloads paths: /api/supervisors/{name}/projects/{project}/security/flows/l7-events: get: tags: - projects summary: Flow l7 events description: >- The L7 event log — what an edge click opens. Its absence was the one gap a **Authorisation:** `security:Read` on `krn:celum:supervisor:{name}:project:{project}:security:*`. **Assistant tool:** `get_project_l7` operationId: get_supervisors_byName_projects_byProject_security_flows_l7Events parameters: - description: >- The supervisor's name, as registered under Administration → Supervisors. in: path name: name required: true schema: type: string - description: '' in: path name: project required: true schema: type: string responses: '200': content: application/json: schema: items: $ref: '#/components/schemas/clickhouse.L7EventRow' nullable: true type: array description: Success. '400': content: application/json: schema: $ref: '#/components/schemas/api.ErrorBody' description: Bad Request. '401': description: Not authenticated — no valid session cookie or API token. '403': content: application/json: schema: $ref: '#/components/schemas/api.ErrorBody' description: >- Authenticated, but no policy allows this action on this resource. The body carries the action and resource that were evaluated. '502': content: application/json: schema: $ref: '#/components/schemas/api.ErrorBody' description: Bad Gateway. components: schemas: clickhouse.L7EventRow: properties: attributedFqdn: type: string code: format: int32 minimum: 0 type: integer coveredByDst: items: type: string type: array coveredBySrc: items: type: string type: array destLabels: items: type: string type: array destPort: format: int32 minimum: 0 type: integer dnsAnswers: items: type: string type: array dnsQuery: type: string dropReasonDesc: type: string dstIdentity: format: int32 minimum: 0 type: integer dstIdentityLabels: items: type: string type: array dstIp: type: string dstNs: type: string dstPod: type: string dstWl: type: string egressAllowedBy: items: type: string type: array egressDeniedBy: items: type: string type: array forwardedFor: type: string forwardedHost: type: string forwardedProto: type: string httpProtocol: type: string ingressAllowedBy: items: type: string type: array ingressDeniedBy: items: type: string type: array l7Type: type: string latencyMs: type: number method: type: string protocol: type: string realClientIp: type: string sourceLabels: items: type: string type: array srcIdentity: format: int32 minimum: 0 type: integer srcIdentityLabels: items: type: string type: array srcIp: type: string srcNs: type: string srcPod: type: string srcWl: type: string time: format: date-time type: string trafficDirection: type: string url: type: string verdict: type: string required: - destPort - dstNs - dstWl - protocol - srcNs - srcWl - time - verdict type: object x-go-type: backend/internal/clickhouse.L7EventRow api.ErrorBody: properties: error: type: string required: - error type: object securitySchemes: sessionCookie: description: >- The session cookie issued by the OIDC sign-in flow. This is what a browser uses. in: cookie name: k8s-gate-session type: apiKey bearerToken: description: >- An API token, minted from your own identity page. A token carries the IAM groups you held **when it was minted**, and cannot bypass deletion approval — except for guest clusters inside a project that same token created. scheme: bearer type: http ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.