Sign in

v1

latestOpenAPI 3.1.02026-07-2418848.0 KB
Audit Logs

Query Audit Logs

Query audit events with cursor-based pagination. Returns events in ECS (Elastic Common Schema) format by default, with optional Splunk CIM format support.

This endpoint is designed for SIEM integration with platforms like Azure Sentinel, Splunk, Elastic SIEM, and other security monitoring tools.

Authentication: Requires a tenant-level audit API key (different from team API tokens). Contact support to obtain your audit API key.

get/api/audit-logs

Query parameters

startTimestring date-time
Example:2025-01-01T00:00:00Z

Start of the time range (inclusive). Must be an RFC3339/ISO 8601 timestamp. Example: 2025-01-01T00:00:00Z

endTimestring date-time
Example:2025-01-15T00:00:00Z

End of the time range (exclusive). Must be an RFC3339/ISO 8601 timestamp. Example: 2025-01-15T00:00:00Z

cursorstring

Opaque cursor string for pagination. Use the nextCursor value from a previous response to fetch the next page of results.

limitinteger

Maximum number of events to return per request. Defaults to 100. Maximum allowed value is 1000.

eventType'auth.login' | 'auth.logout' | 'iam.user.created' | 'iam.user.deleted' | 'iam.user.invited' | 'iam.role.granted' | 'iam.role.revoked' | 'admin.api_key.created' | 'admin.api_key.deleted' | 'admin.settings.changed' | 'admin.integration.connected' | 'admin.integration.disconnected' | 'admin.team.created' | 'admin.team.deleted' | 'data.file.created' | 'data.file.archived' | 'data.file.deleted' | 'data.file.exported' | 'data.file.invite_sent' | 'data.file.visited' | 'data.file.settings.changed'

Filter events by action type.

userIdstring

Filter events by the ID of the user who performed the action.

format'ecs' | 'splunk'

Output format for audit events.

  • ecs (default): Elastic Common Schema format, compatible with Azure Sentinel, Elastic SIEM
  • splunk: Splunk Common Information Model format

Response

Audit events retrieved successfully

nextCursorstring nullable

Opaque cursor for fetching the next page. Pass this value as the cursor parameter in subsequent requests. Null when there are no more results.

hasMoreboolean required

Whether there are more events available beyond this page

serverTimestring date-time required

Server timestamp when the response was generated (ISO 8601)

Example response

{
  "events": [
    {
      "id": "abc123xyz",
      "@timestamp": "2025-01-14T12:00:00Z",
      "event": {
        "id": "abc123xyz",
        "category": [
          "authentication"
        ],
        "action": "auth.login",
        "outcome": "success"
      },
      "user": {
        "id": "user_12345"
      },
      "user.target": {
        "id": "user_99999"
      },
      "url": {
        "path": "/api/auth/sign-in"
      },
      "eraser": {
        "teamId": "team_67890",
        "workspaceId": "workspace_11111",
        "metadata": {
          "method": "sso",
          "changedFields": [
            "name",
            "defaultWorkspaceAccess"
          ]
        }
      }
    }
  ],
  "nextCursor": "eyJ0aW1lc3RhbXAiOiIyMDI1LTAxLTE0VDEyOjAwOjAwWiIsImlkIjoiYWJjMTIzIn0=",
  "hasMore": true,
  "serverTime": "2025-01-15T10:30:00Z"
}