---
title: "Search Audit Events"
method: POST
path: "/api/v1/search/secrets-admin/audit_events"
tags: ["Secrets Admin"]
---

# Search Audit Events

`POST /api/v1/search/secrets-admin/audit_events`

SearchAuditEvents returns audit events for paper secrets.
 Can filter by vault_id, actor (user ID or email), client IP.

## Request body

- C1ApiSecretsV1PaperSecretAdminServiceSearchAuditEventsRequest — The PaperSecretAdminServiceSearchAuditEventsRequest message.
  - `actorEmail` string — Filter by external email (partial match via full-text search)
  - `actorUserId` string — Filter by C1 user ID (internal users)
  - `clientIp` string — Filter by client IP (exact match)
  - `pageSize` integer — The pageSize field.
  - `pageToken` string — The pageToken field.
  - `vaultId` string — Filter by specific vault

## Response `200`

Successful response

- C1ApiSecretsV1PaperSecretAdminServiceSearchAuditEventsResponse — The PaperSecretAdminServiceSearchAuditEventsResponse message.
  - `list` object[], nullable — List contains OCSF events directly as JSON structs. Follows the same pattern as SystemLogServiceListEventsResponse.
  - `nextPageToken` string — The nextPageToken field.

---

[API](https://skmtc.net/conductorone/apis/c1-api.md) · [All operations](https://skmtc.net/conductorone/apis/c1-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/conductorone/c1-api/revisions/f2cf3228f366/schema)