Audit log
Security audit events for the workspace: sign-ins, member and role changes, API keys, settings changes, share links, exports and deletions. Poll the feed from a SIEM; needs the workspace.audit_log permission.
List audit events (SIEM feed)
Poll this from a SIEM. Events come oldest first; store `next_cursor` and pass it as `cursor` next time. Events appear about 5 seconds after they happen (the feed holds back the newest few seconds so a cursor never skips one). `order=desc` with `before` pages newest first instead. Needs the `workspace.audit_log` permission: owners and admins hold it, and a workspace API key created with `permissions: ['workspace.audit_log']` can read the log and nothing else.
Download audit events as CSV
Every event from `since` (default: 30 days ago) to `until` (default: now) as CSV, oldest first.
List audit event types
Every event type the audit log records, with what it means.