---
title: "Search Audit Events"
method: POST
path: "/api/v1/search/secrets/audit_events"
tags: ["Secrets"]
---

# Search Audit Events

`POST /api/v1/search/secrets/audit_events`

SearchAuditEvents returns audit events for a secret owned by the calling user.
 Returns sanitized OCSF events (IP addresses stripped for non-admin consumption).

## Request body

- C1ApiSecretsV1PaperSecretServiceSearchAuditEventsRequest — PaperSecretServiceSearchAuditEventsRequest searches audit events for a secret owned by the calling user. Only the secret creator may query events. Results are sanitized to include only time, event type, and actor information.
  - `pageSize` integer — Maximum number of results per page (0 uses server default, max 100).
  - `pageToken` string — Pagination token from a previous response's next_page_token.
  - `vaultId` string — Required. The vault ID of the secret whose audit events to retrieve.

## Response `200`

PaperSecretServiceSearchAuditEventsResponse contains a page of audit events
 for the requested secret.

- C1ApiSecretsV1PaperSecretServiceSearchAuditEventsResponse — PaperSecretServiceSearchAuditEventsResponse contains a page of audit events for the requested secret.
  - `list` object[], nullable — Sanitized OCSF events containing only time, event type, and actor fields. Sensitive fields such as IP addresses, messages, and raw payloads are removed.
  - `nextPageToken` string — Token to retrieve the next page of results. Empty when no more pages exist.

---

[API](https://skmtc.net/conductorone/apis/c1-api.md) · [All operations](https://skmtc.net/conductorone/apis/c1-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/conductorone/c1-api/revisions/f2cf3228f366/schema)