---
title: "List audit events"
method: GET
path: "/v1/audit"
---

# List audit events

`GET /v1/audit`

## Query parameters

- `action` string — Return only events with this exact action, or events whose action starts with it followed by a dot (`workspace` returns `workspace.member_added` but not `workspace_automation.created`). Lowercase, as actions are.
- `occurred_before` union — Return events that occurred before this date. Must fall within the one-year retention window; an earlier date is rejected.
  - string, date
  - string, date-time
- `occurred_after` union — Return events that occurred after this date. Must fall within the one-year retention window; an earlier date is rejected.
  - string, date
  - string, date-time
- `cursor` string — The cursor to continue from
- `page_size` integer — Maximum number of audit events to return per page

## Response `200`

List of audit events

- object
  - `events` object[], required
    - `id` string, required — The ID of the audit event
    - `object` 'audit_event', required — The object type of the audit event
    - `action` string, required — The action that was recorded. See the [audit events reference](/audit-events) for every action and the `data` it carries. Actions are added over time, so treat this as an open set of strings rather than a fixed list.
    - `occurred_at` string, date-time, required — When the action happened, to the millisecond
    - `collected_at` string, date-time, required — When Granola recorded the event. Usually the same moment as `occurred_at`, but later for events we learn about after the fact — a meeting recording is recorded once its summary finishes, and a note viewed offline is recorded when that device next reaches us. Events are returned in `collected_at` order, so this is the field that never moves under a cursor, and it carries microseconds to keep events that share a millisecond ordered.
    - `actor` union, required — Who performed the action
      - object — A public API key authenticated the request.
        - `object` 'api_key', required — The object type of the actor
        - `id_suffix` string, required — The final eight characters of the non-secret API key identifier.
      - object — A person in your workspace performed the action.
        - `object` 'user', required — The object type of the actor
        - `id` string, nullable, required — The ID of the user who performed the action, or null if the recorded actor was not a resolvable user.
        - `email` string, email, nullable, required — The email of the user who performed the action, or null if the account no longer exists.
      - object — No identifiable user performed the action — it came from an automated process, such as a scheduled job or an inbound webhook from a connected service. This variant carries no other fields.
        - `object` 'system', required — The object type of the actor
      - object — A person performed the action without signing in, so there is no account to name — for example, someone opening a note through a shared link. Distinct from `system`, which means no person was involved at all. This variant carries no other fields; the `ip_address` and `user_agent` in `context` are the only attribution available.
        - `object` 'anonymous', required — The object type of the actor
    - `data` object, required — Details of the action. The fields depend on the action, and their names are the ones Granola records internally, so they are camelCase rather than snake_case. See the [audit events reference](/audit-events) for the fields each action carries.
    - `context` object, required — How the request that produced this event reached Granola
      - `ip_address` string, nullable, required — The IP address the request came from, or null if it was not recorded.
      - `user_agent` string, nullable, required — The user agent of the client that made the request, or null if it was not recorded.
      - `client_version` string, nullable, required — The Granola client version that made the request, or null if it was not recorded.
  - `hasMore` boolean, required — Whether there are more audit events to fetch. A page can hold fewer than `page_size` events and still not be the last one, so page on this and `cursor` rather than on the number of events returned.
  - `cursor` string, nullable, required — The cursor to continue from

## Other responses

- `400` — Bad request
- `401` — Unauthorized - Invalid API key

---

[API](https://skmtc.net/granola/apis/granola-api.md) · [All operations](https://skmtc.net/granola/apis/granola-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/granola/granola-api/revisions/d7f5ed610820/schema)