List sub-processor changes

GET/v1/trust/changes

List sub-processor changes.

Changes to your organization's sub-processors found by the daily check, newest first, at most 500: a sub-processor added, removed or used for the first time, a new region, or a model provider serving a new model. The daily check compares the sub-processors used in the last 90 days or configured now with the previous check; the first check of an organization records a baseline and reports nothing. Organization-wide only.

Requires an organization owner or admin. The window defaults to the 90 days up to now and can be at most 366 days long.

Errors: 400 when start_time is not before end_time or the window is longer than 366 days; 402 when the organization's plan does not include the Trust Pack controls; 403 for a caller who is not an organization owner or admin.

Authorization

AuthorizationBearer va_
A platform API key (va_...), created under Settings > API keys. Scoped to an organization or one workspace, with an admin or member role. Used by the management API.

Query parameters

organizationstringrequired
the organization slug
start_timestring<date-time>
start of the window, ISO 8601 date-time; default 90 days before end_time
end_timestring<date-time>
end of the window, ISO 8601 date-time; default now

Responses

200application/json

organizationstring
The organization slug the report is for.
start_timestring<date-time>
Start of the report window (ISO 8601 date-time).
end_timestring<date-time>
End of the report window (ISO 8601 date-time).
last_checked_atstring<date-time>
When the daily check last ran for the organization (ISO 8601 date-time); absent before the first check.
dataobject[]
The changes in the window, newest first, at most 500.
Child attributes
- idstring<uuid>
  The change id (UUID).
- kindenum<string>
  What changed. SUBPROCESSOR_ADDED: a sub-processor that was not there before. SUBPROCESSOR_REMOVED: no longer used in the report window and no longer configured. SUBPROCESSOR_FIRST_USED: a configured sub-processor received data for the first time. REGION_ADDED: data processed in a new region. MODEL_ADDED: a model provider served a new model (not emailed; sent to the webhook).
  One of "SUBPROCESSOR_ADDED", "SUBPROCESSOR_REMOVED", "SUBPROCESSOR_FIRST_USED", "REGION_ADDED", "MODEL_ADDED"
- categoryenum<string>
  What kind of party it is. MODEL_PROVIDER: an AI model provider the requests were sent to. TOOL_SERVER: an upstream MCP server or API called through the MCP Gateway. PLATFORM: a service VectorAxis itself uses to run the gateway (hosting, edge, embeddings, AI guardrail checks).
  One of "MODEL_PROVIDER", "TOOL_SERVER", "PLATFORM"
- subprocessorstring
  The sub-processor's key, as in the sub-processor report (for example openai, an integration slug, aws).
- namestring
  The sub-processor's name.
- subjectstring
  The model (MODEL_ADDED), the region (REGION_ADDED), or the usage OBSERVED / CONFIGURED (SUBPROCESSOR_ADDED).
- descriptionstring
  The change as a sentence.
- regionstring
  The deployment region whose snapshot found it.
- detected_atstring<date-time>
  When the change was found (ISO 8601 date-time).
- notified_atstring<date-time>
  When the alerts (email, webhook) went out; null while pending.
notesstring[]
How to read the report: what is and is not counted.

VectorAxis is built by GK Labs, a member of NVIDIA Inception.