/api/v1/audit
Operation ID: listAuditEvents
Authentication
Use one of the following authentication options. Permissions and workspace scope still apply. See authentication and access control.
-
Authorization: Bearer YOUR_ACCESS_TOKEN -
X-API-Key: YOUR_API_KEY
Parameters
-
cursorquery -
Opaque next_cursor from the preceding page; newest first, stable timestamp and ID ordering
string -
qquery -
Case-insensitive substring search across retained event attribution, operation, path and status
string- Maximum length
-
512
-
workspacequery -
Exact recorded workspace scope
string -
principalquery -
Exact recorded principal
string -
credential_idquery -
Stable non-secret API-key ID; never the key secret
string -
sincequery -
Only events at or after this time
string · date-time -
outcomequery -
failed: status 400 or higher; succeeded: below 400
string- Allowed values
-
["failed","succeeded"]
-
limitquery -
Maximum events; defaults to 100
integer- Minimum
-
1 - Maximum
-
1000
Responses
200 Audit events
Content type application/json
401 Authentication required or credential rejected
Content type application/json
403 Insufficient permission, disabled login, or invalid CSRF
Content type application/json
413 Request body exceeds the configured limit
Content type application/json
426 HTTPS required
Content type application/json
429 Request rate exceeded
Content type application/json
503 Service temporarily unavailable
Content type application/json
OpenAPI operation definition
{
"operationId": "listAuditEvents",
"parameters": [
{
"description": "Opaque next_cursor from the preceding page; newest first, stable timestamp and ID ordering",
"in": "query",
"name": "cursor",
"schema": {
"type": "string"
}
},
{
"description": "Case-insensitive substring search across retained event attribution, operation, path and status",
"in": "query",
"name": "q",
"schema": {
"maxLength": 512,
"type": "string"
}
},
{
"description": "Exact recorded workspace scope",
"in": "query",
"name": "workspace",
"schema": {
"type": "string"
}
},
{
"description": "Exact recorded principal",
"in": "query",
"name": "principal",
"schema": {
"type": "string"
}
},
{
"description": "Stable non-secret API-key ID; never the key secret",
"in": "query",
"name": "credential_id",
"schema": {
"type": "string"
}
},
{
"description": "Only events at or after this time",
"in": "query",
"name": "since",
"schema": {
"format": "date-time",
"type": "string"
}
},
{
"description": "failed: status 400 or higher; succeeded: below 400",
"in": "query",
"name": "outcome",
"schema": {
"enum": [
"failed",
"succeeded"
],
"type": "string"
}
},
{
"description": "Maximum events; defaults to 100",
"in": "query",
"name": "limit",
"schema": {
"maximum": 1000,
"minimum": 1,
"type": "integer"
}
}
],
"responses": {
"200": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/AuditList"
}
}
},
"description": "Audit events"
},
"401": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Error"
}
}
},
"description": "Authentication required or credential rejected"
},
"403": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Error"
}
}
},
"description": "Insufficient permission, disabled login, or invalid CSRF"
},
"413": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Error"
}
}
},
"description": "Request body exceeds the configured limit"
},
"426": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Error"
}
}
},
"description": "HTTPS required"
},
"429": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Error"
}
}
},
"description": "Request rate exceeded"
},
"503": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Error"
}
}
},
"description": "Service temporarily unavailable"
}
},
"summary": "List durable audit events",
"tags": [
"Audit"
]
}