List audit events

Preview

Returns a paginated, workspace-scoped stream of audit events. Requires an Enterprise plan. Covers API key lifecycle, SSO enforcement changes, permission grants/revocations, workflow transitions, and AI-initiated actions. Not a raw data endpoint — metadata is allowlisted, actor names are omitted, and internal fields are never surfaced.

GET/api/v1/audit-log

Authorization

audit:readapi key scoperequired

Required scope when calling with an API key.

account:audit_readsession capabilityoptional

Required capability when calling with a signed-in session.

Query parameters

event_typestringoptional

Exact event type filter. e.g. api_key.created

Example: api_key.created

event_type_prefixstringoptional

Prefix filter. e.g. sso. returns all SSO events.

Example: sso.

actor_typestringoptional

Filter by actor kind: user, system, or ai.

Example: user

resource_typestringoptional

Filter by resource class. e.g. api_key, permission

Example: api_key

project_idstringoptional

Narrow to events on a specific project.

Example: proj_abc123

fromstringoptional

ISO 8601 timestamp lower bound (occurred_at >=).

Example: 2026-01-01T00:00:00Z

tostringoptional

ISO 8601 timestamp upper bound (occurred_at <=).

Example: 2026-12-31T23:59:59Z

limitnumberoptional

Results per page (1–100). Default 50.

Example: 50

cursorstringoptional

Opaque pagination cursor from previous response.

Example: eyJvY2N1cnJlZF9hdCI6IjIwMjYtMDUtMTNUMDk6MDA6MDAuMDAwWiIsImlkIjoiYWJjIn0=

Request

GET /api/v1/audit-log

curl -X GET "https://www.digitalstack360.com/api/v1/audit-log" \
  -H "Authorization: Bearer $DS_API_KEY"

Examples use a placeholder key from your environment. Store your key in $DS_API_KEY — never commit it.

Response

200 OK

{
  "data": [
    {
      "id": "uuid-event-1",
      "event_type": "api_key.created",
      "actor_type": "user",
      "actor_id": "uuid-user-123",
      "triggered_by": null,
      "resource_type": "api_key",
      "resource_id": "key_abc123",
      "project_id": null,
      "summary": "API key 'Integrations' created.",
      "metadata": {
        "source": "ui"
      },
      "occurred_at": "2026-05-13T09:00:00.000Z"
    },
    {
      "id": "uuid-event-2",
      "event_type": "sso.enforcement.enabled",
      "actor_type": "user",
      "actor_id": "uuid-admin-456",
      "triggered_by": null,
      "resource_type": "sso_config",
      "resource_id": "sso_xyz789",
      "project_id": null,
      "summary": "SSO enforcement enabled.",
      "metadata": {
        "mode": "enforced",
        "source": "ui"
      },
      "occurred_at": "2026-05-12T14:30:00.000Z"
    }
  ],
  "pagination": {
    "limit": 50,
    "cursor": "eyJvY2N1cnJlZF9hdCI6IjIwMjYtMDUtMTJUMTQ6MzA6MDAuMDAwWiIsImlkIjoidXVpZC1ldmVudC0yIn0=",
    "has_more": true
  }
}

Errors

401

missing_auth

No credentials provided

401

invalid_api_key

API key is invalid or revoked

403

scope_insufficient

Key lacks audit:read scope

403

enterprise_feature_required

Account is not on an Enterprise plan

404

not_found

project_id not found or not in your workspace