---
title: "Retrieves audit events for actions performed by team members within a 1Password account"
method: POST
path: "/api/v1/auditevents"
tags: ["api-v1"]
---

# Retrieves audit events for actions performed by team members within a 1Password account

`POST /api/v1/auditevents`

This endpoint requires your JSON Web Token to have the *auditevents* feature.

## Request body

- union
  - Cursor — Cursor
    - `cursor` string — Cursor to fetch more data if available or continue the polling process if required
  - ResetCursor — Reset cursor
    - `limit` number
    - `start_time` string, date-time
    - `end_time` string, date-time

## Response `200`

Audit events response object

- AuditEventItems — Cursor
  - `items` AuditEvent[]
    - `uuid` string
    - `timestamp` string, date-time
    - `actor_uuid` string
    - `actor_details` User — User object
      - `uuid` string
      - `name` string — Full name
      - `email` string, email
    - `action` 'activate' | 'update' | 'delete' | 'convert' | 'enblduo' | 'updatduo' | 'disblduo' | 'rdmchild' | 'detchild' | 'dlgsess' | 'create' | 'deolddev' | 'dealldev' | 'reauth' | 'begin' | 'complete' | 'propose' | 'updatfw' | 'join' | 'leave' | 'role' | 'purge' | 'view' | 'export' | 'replace' | 'grant' | 'revoke' | 'share' | 'delshare' | 'uisas' | 'enblmfa' | 'updatmfa' | 'disblmfa' | 'musercom' | 'muserdec' | 'sendpkg' | 'resendts' | 'prsndall' | 'trename' | 'tverify' | 'trevoke' | 'ssotknv' | 'enblsso' | 'disblsso' | 'chngpsso' | 'chngasso' | 'chngdsso' | 'delgsso' | 'addgsso' | 'cancel' | 'hide' | 'unhide' | 'upguest' | 'verify' | 'reactive' | 'suspend' | 'beginr' | 'provsn' | 'sendts' | 'unknown' | 'completr' | 'cancelr' | 'trvlaway' | 'trvlback' | 'changeks' | 'changemp' | 'changesk' | 'changenm' | 'changela' | 'tdvcsso' | 'sdvcsso' | 'patch' | 'updatea' | 'vrfydmn' | 'uvrfydmn' | 'dvrfydmn'
    - `object_type` 'account' | 'user' | 'device' | 'group' | 'gm' | 'vault' | 'item' | 'items' | 'itemhist' | 'vaultkey' | 'template' | 'uva' | 'gva' | 'invite' | 'ec' | 'miguser' | 'sso' | 'sub' | 'card' | 'pm' | 'slackapp' | 'file' | 'famchild' | 'sa' | 'satoken' | 'dlgdsess' | 'ssotkn' | 'report'
    - `object_uuid` string
    - `object_details` User — User object
      - `uuid` string
      - `name` string — Full name
      - `email` string, email
    - `aux_id` integer
    - `aux_uuid` string
    - `aux_details` User — User object
      - `uuid` string
      - `name` string — Full name
      - `email` string, email
    - `aux_info` string
    - `session` Session — Session information gathered about the client
      - `uuid` string
      - `login_time` string, date-time
      - `device_uuid` string
      - `ip` string
    - `location` Location — Geolocation Info about the client
      - `country` string
      - `region` string
      - `city` string
      - `longitude` number
      - `latitude` number
  - `cursor` string — Cursor to fetch more data if available or continue the polling process if required
  - `has_more` boolean — Whether there may still be more data to fetch using the returned cursor. If true, the subsequent request could still be empty.

## Other responses

- `401` — Unauthorized
- `500` — Internal Server Error
- `default` — Generic error

---

[API](https://skmtc.dev/1password/apis/events-api.md) · [All operations](https://skmtc.dev/1password/apis/events-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/1password/events-api/revisions/359da8b22780/schema)