Context

The GET /api/v1/activities endpoint accepts an event_type query parameter as a free-form string (max 64 chars). Invalid values silently return empty results.

Proposed Solution

Define a StrEnum or Literal type for the 12 known event types (hired, fired, promoted, demoted, onboarded, offboarded, status_changed, task_completed, task_started, cost_incurred, tool_used, delegation_sent, delegation_received) and use it as the parameter type. This makes the OpenAPI schema self-documenting and rejects invalid values with a 400.

Files

• src/synthorg/api/controllers/activities.py (parameter type)

Source

Found during PR #832 review (security-reviewer agent).