Skip to main content

List audit events (SIEM feed)

GET 
/api/v1/audit-events

Poll this from a SIEM. Events come oldest first; store next_cursor and pass it as cursor next time. Events appear about 5 seconds after they happen (the feed holds back the newest few seconds so a cursor never skips one). order=desc with before pages newest first instead. Needs the workspace.audit_log permission: owners and admins hold it, and a workspace API key created with permissions: ["workspace.audit_log"] can read the log and nothing else.

Request​

Responses​

OK